SP-Initiated SSO

When configuring Shibboleth SP to use a PingFederate (PingIdentity) IdP, do not use the "/idp/" endpoint as this is a proprietary Ping endpoint for IdP-Initiated SSO which is not for SAML 2 requests and will drop the RelayState parameter.  Use the "/idp/SSO.saml2" endpoint for expected Shibboleth SP behavior.

PingFederate has non-standard metadata handling and usage and is unable to automatically consume multiple entity descriptions at once.