App1 SAML SP

Prototype — PingFederate SAML → JWT bridge

Not authenticated. Login via PingFed-B (which authenticates against PingFed-A).

Login with PingFed

Logged in as SAML session active

---

Access App2

Choose which flow to demonstrate:

Auth Code flow Token Exchange flow

Auth Code: browser redirects through PingFed-B — no login prompt if session exists.
Token Exchange: App1 calls PingFed-B /token directly with the SAML assertion.