anchor.diff:  ** [2] - PrivateKey/X509Certificate{SIGNING,DECRYPTION} - The SP's first signing and decryption credential.
   ** [3] - PrivateKey/X509Certificate{SIGNING,DECRYPTION} - The SP's second decryption credential.
   Signing is always done using the first `SIGNING` key in the list.
  +* `ProviderDetails#entityId` - (required) the entity ID of the Identity Provider. Always a fixed URI value or string,
  +no patterns allowed.
  +* `ProviderDetails#webSsoUrl`  - (required) a fixed URI value for the IDP Single Sign On endpoint where
  +the SP sends the `AuthNRequest` messages.
  +* `ProviderDetails#signAuthNRequest` - A boolean indicating whether or not to sign the `AuthNRequest` with the SP's private key, defaults to `true`
  +* `ProviderDetails#binding` - A `Saml2MessageBinding` indicating what kind of binding to use for the `AuthNRequest`, whether that be `REDIRECT` or `POST`, defaults to `REDIRECT`
   
   When an incoming message is received, signatures are always required, the system will first attempt
   to validate the signature using the certificate at index [0] and only move to the second
  
positive.code: [[servlet-saml2-sp-initiated]]
  ==== Authentication Requests - SP Initiated Flow
  
  To initiate an authentication from the web application, a simple redirect to
  
  `+{baseUrl}/saml2/authenticate/{registrationId}+`
  
  The endpoint will generate an `AuthNRequest` by invoking the `createAuthenticationRequest` method on a
  configurable factory. Just expose the `Saml2AuthenticationRequestFactory` as a bean in your configuration.
  [source,java]
  ----
  public interface Saml2AuthenticationRequestFactory {
      String createAuthenticationRequest(Saml2AuthenticationRequest request);
  }
  ----
  
  
negative.code: [[servlet-saml2-rpr-relyingparty]]
  ===== Relying Party
  
  * `registrationId` - (required) a unique identifer for this configuration mapping.
  This identifier may be used in URI paths, so care should be taken that no URI encoding is required.
  * `localEntityIdTemplate` - (optional) A URI pattern that creates an entity ID for this application based on the incoming request. The default is
  