---
title: About SP-initiated SSO with the SamlFederationHandler and PingAM
description: SP-initiated SSO occurs when a user attempts to access a protected application directly through the SP. Because the user's federated identity is managed by the IdP, the SP sends a SAML authentication request to the IdP. After the IdP authenticates the user, it provides the SP with a SAML assertion for the user.
component: pinggateway
version: 2025.11
page_id: pinggateway:gateway-guide:federation-about-sp-init
canonical_url: https://docs.pingidentity.com/pinggateway/2025.11/gateway-guide/federation-about-sp-init.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-10-22T14:04:06Z
---

# About SP-initiated SSO with the SamlFederationHandler and PingAM

SP-initiated SSO occurs when a user attempts to access a protected application directly through the SP. Because the user's federated identity is managed by the IdP, the SP sends a SAML authentication request to the IdP. After the IdP authenticates the user, it provides the SP with a SAML assertion for the user.

The following sequence diagram shows the flow of information in SP-initiated SSO, when PingGateway acts as a SAML 2.0 SP:

![SP-initiated SSO sequence diagram](_images/saml-sp-initiated.svg)