code: func (idp *IdentityProvider) ServeSSO(w http.ResponseWriter, r *http.Request) {
  	req, err := NewIdpAuthnRequest(idp, r)
  	if err != nil {
  		log.Printf("failed to parse request: %s", err)
  		http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
  		return
  	}
  
  	if err := req.Validate(); err != nil {
  		log.Printf("failed to validate request: %s", err)
  		http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
  		return
  	}
  
  	// TODO(ross): we must check that the request ID has not been previously
  	//   issued.
  
  	session := idp.SessionProvider.GetSession(w, r, req)
  	if session == nil {
  		return
  	}
  
  	// we have a valid session and must make a SAML assertion
  	if err := req.MakeAssertion(session); err != nil {
  		log.Printf("failed to make assertion: %s", err)
  		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
  		return
  	}
  	if err := req.WriteResponse(w); err != nil {
  		log.Printf("failed to write response: %s", err)
  		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
  		return
  	}
  }
docs: // ServeSSO handles SAML auth requests.
  //
  // When it gets a request for a user that does not have a valid session,
  // then it prompts the user via XXX.
  //
  // If the session already exists, then it produces a SAML assertion and
  // returns an HTTP response according to the specified binding. The
  // only supported binding right now is the HTTP-POST binding which returns
  // an HTML form in the appropriate format with Javascript to automatically
  // submit that form the to service provider's Assertion Customer Service
  // endpoint.
  //
  // If the SAML request is invalid or cannot be verified a simple StatusBadRequest
  // response is sent.
  //
  // If the assertion cannot be created or returned, a StatusInternalServerError
  // response is sent.