'Creates an authentication request.
:param destination: Where the request should be sent.
:param vorg: The virtual organization the service belongs to.
:param scoping: The scope of the request
:param binding: The protocol to use for the Response !!
:param nameid_format: Format of the NameID
:param service_url_binding: Where the reply should be sent dependent
on reply binding.
:param message_id: The identifier for this request
:param consent: Whether the principal have given her consent
:param extensions: Possible extensions
:param sign: Whether the request should be signed or not.
:param sign_prepare: Whether the signature should be prepared or not.
:param allow_create: If the identity provider is allowed, in the course
of fulfilling the request, to create a new identifier to represent
the principal.
:param kwargs: Extra key word arguments
:return: tuple of request ID and <samlp:AuthnRequest> instance'

def create_authn_request(self, destination, vorg='', scoping=None, binding=saml2.BINDING_HTTP_POST, nameid_format=None, service_url_binding=None, message_id=0, consent=None, extensions=None, sign=None, allow_create=False, sign_prepare=False, **kwargs):

    client_crt = None
    if ('client_crt' in kwargs):
        client_crt = kwargs['client_crt']
    args = {}
    try:
        args['assertion_consumer_service_url'] = kwargs['assertion_consumer_service_urls'][0]
        del kwargs['assertion_consumer_service_urls']
    except KeyError:
        try:
            args['assertion_consumer_service_url'] = kwargs['assertion_consumer_service_url']
            del kwargs['assertion_consumer_service_url']
        except KeyError:
            try:
                args['attribute_consuming_service_index'] = str(kwargs['attribute_consuming_service_index'])
                del kwargs['attribute_consuming_service_index']
            except KeyError:
                if (service_url_binding is None):
                    service_urls = self.service_urls(binding)
                else:
                    service_urls = self.service_urls(service_url_binding)
                args['assertion_consumer_service_url'] = service_urls[0]
    try:
        args['provider_name'] = kwargs['provider_name']
    except KeyError:
        if (binding == BINDING_PAOS):
            pass
        else:
            args['provider_name'] = self._my_name()
    _msg = AuthnRequest()
    for param in ['scoping', 'requested_authn_context', 'conditions', 'subject', 'scoping']:
        try:
            _item = kwargs[param]
        except KeyError:
            pass
        else:
            del kwargs[param]
            if isinstance(_item, _msg.child_class(param)):
                args[param] = _item
            elif isinstance(_item, dict):
                args[param] = RequestedAuthnContext(**_item)
            else:
                raise ValueError(('%s    or    wrong    type    expected    %s' % (_item, param)))
    try:
        args['name_id_policy'] = kwargs['name_id_policy']
        del kwargs['name_id_policy']
    except KeyError:
        if allow_create:
            allow_create = 'true'
        else:
            allow_create = 'false'
        if (nameid_format == ''):
            name_id_policy = None
        else:
            if (nameid_format is None):
                nameid_format = self.config.getattr('name_id_format', 'sp')
                if (nameid_format is None):
                    nameid_format = NAMEID_FORMAT_TRANSIENT
                elif isinstance(nameid_format, list):
                    nameid_format = nameid_format[0]
            name_id_policy = samlp.NameIDPolicy(allow_create=allow_create, format=nameid_format)
        if (name_id_policy and vorg):
            try:
                name_id_policy.sp_name_qualifier = vorg
                name_id_policy.format = saml.NAMEID_FORMAT_PERSISTENT
            except KeyError:
                pass
        args['name_id_policy'] = name_id_policy
    try:
        nsprefix = kwargs['nsprefix']
    except KeyError:
        nsprefix = None
    if kwargs:
        (_args, extensions) = self._filter_args(AuthnRequest(), extensions, **kwargs)
        args.update(_args)
    try:
        del args['id']
    except KeyError:
        pass
    if (sign is None):
        sign = self.authn_requests_signed
    if ((sign and self.sec.cert_handler.generate_cert()) or (client_crt is not None)):
        with self.lock:
            self.sec.cert_handler.update_cert(True, client_crt)
            if (client_crt is not None):
                sign_prepare = True
            return self._message(AuthnRequest, destination, message_id, consent, extensions, sign, sign_prepare, protocol_binding=binding, scoping=scoping, nsprefix=nsprefix, **args)
    return self._message(AuthnRequest, destination, message_id, consent, extensions, sign, sign_prepare, protocol_binding=binding, scoping=scoping, nsprefix=nsprefix, **args)
