When Salesforce is configured as a Service Provider in a SAML SSO flow, what must the Identity Provider include in the SAML assertion for the login to succeed?