What do AuthnInstant and SessionIndex in the authentication statement record, and what is the SessionIndex later used for?

Question

Accepted Answer

AuthnInstant is the moment the user actually authenticated at the IdP; SessionIndex identifies the IdP session the assertion belongs to, so that a later Single Logout can name exactly which session to end.
The authentication statement deliberately separates three times: the assertion's IssueInstant (when it was written), the AuthnInstant (when the user last proved their identity, here 09:23:50) and the validity window in Conditions. With SSO these can differ a lot: a user who logged in at 08:00 may get a fresh assertion for a new SP at 11:00 with AuthnInstant still 08:00. An SP that demands a recent login can compare AuthnInstant with the current time, or ask for re-authentication with ForceAuthn.
The SessionIndex (here 234122) is the link between SSO and logout: when the session ends, the IdP's <LogoutRequest> to each SP quotes this index, so the SP knows which local session to terminate.
Go deeper:

OASIS: SAML V2.0 Core specification (PDF) — section 2.7.2 defines the authentication statement and its attributes.