Technically you are supposed to sign in only once on one of web sites. There are global events and some examples. I guess the idea is to contact your ping federate on SecurityEvents.Authentication.Execute and see if a user is authenticated and if yes you just sign him in. Essentially it should happen once per user per web site.