code: func (sp *ServiceProvider) MakeAuthenticationRequest(idpURL string) (*AuthnRequest, error) {
  	req := AuthnRequest{
  		AssertionConsumerServiceURL: sp.AcsURL,
  		Destination:                 idpURL,
  		ProtocolBinding:             HTTPPostBinding, // default binding for the response
  		ID:                          fmt.Sprintf("id-%x", randomBytes(20)),
  		IssueInstant:                TimeNow(),
  		Version:                     "2.0",
  		Issuer: Issuer{
  			Format: "urn:oasis:names:tc:SAML:2.0:nameid-format:entity",
  			Value:  sp.MetadataURL,
  		},
  		NameIDPolicy: NameIDPolicy{
  			AllowCreate: true,
  			// TODO(ross): figure out exactly policy we need
  			// urn:mace:shibboleth:1.0:nameIdentifier
  			// urn:oasis:names:tc:SAML:2.0:nameid-format:transient
  			Format: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
  		},
  	}
  	return &req, nil
  }
docs: // MakeAuthenticationRequest produces a new AuthnRequest object for idpURL.