title: How is the principal identified in the AuthnRequest for SAML 2.0 Web Browser SSO
body: <p>I'm new to SAML and having a bit of trouble fully understanding the full SAML2 SSO process.  </p>
  
  <p>Specifically, when The Service Provider responds to a resource request with a  element, what piece of data in the  element identifies the principal (i.e. the user) to be validated by the identity provider?</p>
  
  <p>For example, there does not appear to be anything to identify the principal in the following AuthnRequest:</p>
  
  <pre><code>&lt;samlp:AuthnRequest
  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
  ID="identifier_1"
  Version="2.0"
  IssueInstant="2004-12-05T09:21:59"
  AssertionConsumerServiceIndex="0"&gt;
  &lt;saml:Issuer&gt;https://sp.example.com/SAML2&lt;/saml:Issuer&gt;
  &lt;samlp:NameIDPolicy
    AllowCreate="true"
    Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/&gt;&lt;/samlp:AuthnRequest&gt;
  </code></pre>
  
  <p>Does the information identifying the principal get added after the AuthnRequest reaches the browser (maybe from a cookie?), or does information identifying the specific user not get sent to the identity provider at all?</p>