PingOne Platform APIs

SAML SSO Using GET

GET {{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token

The GET /{{envID}}/saml20/idp/sso operation initiates the SAML single sign-on action through a GET request. In the request URL, the SAMLRequest parameter contains the encoded SAML authentication request information.

Here is a sample SAML <AuthnRequest> in plain text:

<samlp:AuthnRequest
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    ID="identifier_1"
    Version="2.0"
    IssueInstant="2004-12-05T09:21:59">
    <saml:Issuer>https://sp.example.com/SAML2</saml:Issuer>
  </samlp:AuthnRequest>

For SAML assertions, PingOne supports the following Subject NameID formats:

Format Description

urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

The Subject’s NameID format is not specified.

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

The Subject’s NameID format is in the form of an email address.

urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

The Subject’s NameID format is an opaque unique identifier for a user that retains the same value over time.

urn:oasis:names:tc:SAML:2.0:nameid-format:transient

The Subject’s NameID format is a randomly generated identifier. A different value is used for each SSO for a given user.

For GET requests, the <AuthnRequest> encoding is compressed (RFC1951 Deflate), Base64 encoded, and URL encoded.
Query parameters
Parameter Description

RelayState

Passes the defaultTarget information to the IdP.

SAMLRequest

The encoded SAML authentication request information.

Example Request

  • cURL

  • C#

  • Go

  • HTTP

  • Java

  • jQuery

  • NodeJS

  • Python

  • PHP

  • Ruby

  • Swift

curl --location --globoff '{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token'
var options = new RestClientOptions("{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Get);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main

import (
  "fmt"
  "net/http"
  "io"
)

func main() {

  url := "{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token"
  method := "GET"

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, nil)

  if err != nil {
    fmt.Println(err)
    return
  }
  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
GET /{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token HTTP/1.1
Host: {{authPath}}
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("text/plain");
RequestBody body = RequestBody.create(mediaType, "");
Request request = new Request.Builder()
  .url("{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token")
  .method("GET", body)
  .build();
Response response = client.newCall(request).execute();
var settings = {
  "url": "{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token",
  "method": "GET",
  "timeout": 0,
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
var request = require('request');
var options = {
  'method': 'GET',
  'url': '{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token',
  'headers': {
  }
};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
import requests

url = "{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token"

payload = {}
headers = {}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token');
$request->setMethod(HTTP_Request2::METHOD_GET);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
require "uri"
require "net/http"

url = URI("{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body
var request = URLRequest(url: URL(string: "{{authPath}}/{{envID}}/saml20/idp/sso?SAMLRequest={{SAMLRequest}}&RelayState=token")!,timeoutInterval: Double.infinity)
request.httpMethod = "GET"

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()