Already fixed in new saml2 lib: https://github.com/simplesamlphp/saml2/blob/master/src/SAML2/AuthnRequest.php#L560