code: func (req *IdpAuthnRequest) Validate() error {
  	if err := xml.Unmarshal(req.RequestBuffer, &req.Request); err != nil {
  		return err
  	}
  
  	// TODO(ross): is this supposed to be the metdata URL? or the target URL?
  	//   i.e. should idp.SSOURL actually be idp.Metadata().EntityID?
  	if req.Request.Destination != req.IDP.SSOURL {
  		return fmt.Errorf("expected destination to be %q, not %q",
  			req.IDP.SSOURL, req.Request.Destination)
  	}
  	if req.Request.IssueInstant.Add(MaxIssueDelay).Before(TimeNow()) {
  		return fmt.Errorf("request expired at %s",
  			req.Request.IssueInstant.Add(MaxIssueDelay))
  	}
  	if req.Request.Version != "2.0" {
  		return fmt.Errorf("expected SAML request version 2, got %q", req.Request.Version)
  	}
  
  	// find the service provider
  	serviceProvider, serviceProviderFound := req.IDP.ServiceProviders[req.Request.Issuer.Value]
  	if !serviceProviderFound {
  		return fmt.Errorf("cannot handle request from unknown service provider %s",
  			req.Request.Issuer.Value)
  	}
  	req.ServiceProviderMetadata = serviceProvider
  
  	// Check that the ACS URL matches an ACS endpoint in the SP metadata.
  	acsValid := false
  	for _, acsEndpoint := range serviceProvider.SPSSODescriptor.AssertionConsumerService {
  		if req.Request.AssertionConsumerServiceURL == acsEndpoint.Location {
  			req.ACSEndpoint = &acsEndpoint
  			acsValid = true
  			break
  		}
  	}
  	if !acsValid {
  		return fmt.Errorf("invalid ACS url specified in request: %s", req.Request.AssertionConsumerServiceURL)
  	}
  
  	return nil
  }
docs: // Validate checks that the authentication request is valid and assigns
  // the AuthnRequest and Metadata properties. Returns a non-nil error if the
  // request is not valid.