What does the Authentication Request Protocol do, and what does an <AuthnRequest> typically specify?

The SP sends an <AuthnRequest> asking the IdP to authenticate the user and return an assertion; the goal is to establish a security context at the SP, and the protocol is the heart of the Web Browser SSO profile.

A typical <AuthnRequest> carries:

• ID: a unique request ID that the IdP echoes back as InResponseTo, so the SP can match the answer to its own request.
• Issuer: the SP's entity ID, so the IdP knows who is asking (and can look up its metadata).
• AssertionConsumerServiceURL or an index: where the response must be sent.
• ProtocolBinding: how the response should be delivered (usually HTTP POST).
• Optional NameIDPolicy (persistent or transient identifier), RequestedAuthnContext (required strength) and ForceAuthn (demand a fresh login even if an SSO session exists).

The IdP answers with a <Response> that contains a status code and, on success, the signed assertion. If the user already has a session at the IdP, no login screen appears at all: that is the "single" in single sign-on.

Go deeper:

• SAML 2.0: Authentication Request Protocol (Wikipedia) — a real AuthnRequest and Response explained line by line.