Make sure your application in PingOne has an authentication policy assigned that contains the external IdP initiating SSO. For more information, see Applying authentication policies to an application.

  1. In the IdP, configure the RelayState parameter to contain the applicationId when the IdP sends an SAML assertion to PingOne.

    This is the Client ID copied from the application in PingOne.


    For some applications, the applicationId is also known as the Client ID.

  2. Optionally, you can also include applicationUrl in the RelayState.

    If the target application is an OIDC application without a target_link_uri configured, include the applicationUrl in the RelayState. The applicationUrl is used only when target_link_uri is not configured.


    The RelayState parameter should also be URL-encoded. The following are examples of the full parameter sent to PingOne: