Optionalauthenticationwauth: the authentication method the identity provider must use, e.g. http://schemas.microsoft.com/claims/multipleauthn.
OptionalforceMake the identity provider authenticate the person again even if it has a session: wfresh=0.
Optionalfreshnesswfresh: the most minutes since the person authenticated that this sign-in accepts. forceAuthn wins.
Optionalhomewhr: the home realm, the account provider the person belongs to, for an identity provider that federates.
OptionalparamsFurther query parameters, for an identity provider that reads its own (e.g. login_hint). The protocol's own cannot be replaced.
OptionalrelayApplication state that comes back unchanged in wctx (at most 1024 bytes). Typically where to go after sign-in.
Per sign-in choices.