The authentication request will be responded with an assertion that satisfies following:

MUST contain <sa:AuthnStatement>
MUST specify the Level of Authentication as AuthnStatement/AuthnContext/AuthnContextClassRef.
MUST use the LoA profile [SAML2LOA] to return LoA to the SP.
SHOULD have AudienceRestriction/Audience element referencing the SP.
MAY contain <AttributeStatement> detailing user's attributes as relevant to SP and/or requested using AttributeConsumingServiceIndex.
SHOULD have an <AttributeStatement> containing a discovery bootstrap (attribute named "urn:liberty:disco:2006-08:DiscoveryEPR" whose value is an endpoint reference) as described in [Disco2] section 4 "Discovery Service ID-WSF EPR conveyed via a Security Token".
MAY have additional Attribute Statements conveying other endpoint references. Rather than providing additional EPRs at SSO, using discovery is RECOMMENDED. If additional EPRs are passed, the attributes SHOULD be named "urn:liberty:disco:2006-08:DiscoveryEPR" even if they do not refer to discovery service. The SP, when seeing "urn:liberty:disco:2006-08:DiscoveryEPR" attribute MUST look at the Attribute/AttributeValue/EndpointReference/Metadata/ServiceType element to determine the type of the end point reference. The SP SHOULD consider any attribute whose value is an <a:EndpointReference> to be a bootstrap.