Context: SAML2 Web Browser SSO profile. (HTTP POST binding). Federated SSO.

If the IdP gets an `<AuthnRequest>` from the SP, should / must / can the IdP do the user authentication first, or read/validate the `<AuthnRequest>` first?

(the implementation we have in mind could be based on IBM's WebSeal and TFIM... where it seems the User is redirected to authenticate BEFORE the TFIM actually looks at the `<AuthnRequest>`. At least, if I'm properly understanding the docs)

Edit: My Context also includes that the User is not yet locally authenticated at the IdP, when the SP's `<AuthnRequest>` is received at IdP.