AuthnRequest

AuthnRequest is a SAML protocol message used in SAML 2.0 web browser single sign-on. It is sent by a Service Provider to an Identity Provider to request the authentication of a user. The request initiates the SSO flow and asks the IdP to perform user authentication and to return a SAML Response containing an assertion.

A typical AuthnRequest includes identifiers and constraints such as the SAML version, a unique request ID, issue timestamp, and the Destination (the IdP SSO endpoint). It carries the Issuer element with the SP’s entityID, and may specify an AssertionConsumerServiceURL to indicate where the IdP should deliver the final response. Optional elements include ForceAuthn, IsPassive, ProtocolBinding, and NameIDPolicy (to request a specific name identifier format and creation policy). RequestedAuthnContext can specify preferred authentication context classes, and AttributeConsumingServiceIndex may indicate which attributes the SP wishes to receive.

Transmission commonly uses HTTP bindings. In the HTTP-Redirect binding, the AuthnRequest is deflated, base64-encoded, and appended as a query parameter. In the HTTP-POST binding, it is base64-encoded and included in an auto-submitting form. The request may be signed to provide integrity and authenticity, either via HTTP-Redirect or XMLSignature on the message.

Processing involves the IdP validating the request, authenticating the user, and issuing a SAML Response containing an assertion to the SP’s assertion consumer service URL. Security considerations include proper signing, validation of destination and audience, clock checks, and replay prevention.