OptionalforceAsk the identity provider to authenticate the person again even if it has a session.
OptionalisAsk the identity provider not to interact with the person.
OptionalnonceFor requestBinding: 'post': a CSP nonce for the auto-submit script on the form page.
OptionalrelayOpaque state the identity provider returns unchanged (at most 80 bytes, Bindings 3.4.3). Typically where to go after sign-in.
OptionalrequestOptionalresponseOptionalsubjectWho the request is for: sent as the AuthnRequest's <saml:Subject><saml:NameID> (Core 3.4.1), a
hint like OIDC's login_hint. An identity provider holding several accounts in one browser uses it
to pick that account, or pre-fills its sign-in screen with it. It is never proof of who signs in:
the Response's assertion says that.
OptionalsubjectThe hint's NameID Format, e.g. the one the identity provider issued it in (SamlLogin.nameIdFormat).
Per sign-in choices; each defaults to the configuration.