[thomasnymand]

A login now belongs to the OIOSAML session it was made in and has a maximum length, as NemLog-in's technical requirements for service providers ask.

Changes

• Maximum session length: a login ends MaximumSessionLength minutes after the authentication at the IdP (new Federation element, default 480), or at the IdP's SessionNotOnOrAfter if that is earlier, however active the user is. The end is stored with the login (Saml20AssertionLite.ValidUntil) and checked on every read.
• Expired sessions stay expired: the in-process and SQL Server session stores no longer read or extend a session past its idle timeout, and writing to an expired session starts it afresh. Before, an expired session could be read and revived until the cleanup ran (or forever with DisableCleanup).
• Saml20Identity.IsInitialized() is true only when the session holds a completed login that has not ended. Before, any value in the session, such as a pending AuthnRequest, made it true.
• Forms ticket bound to the session: the default SetSamlPrincipal action issues the Forms ticket itself, with a hash of the OIOSAML session id in its UserData and an expiry no later than the login. A ticket presented with a different OIOSAML session doesn't count as logged in, so the documented Global.asax check signs it out. Tickets an application issues itself are left alone.
• readme.md: new "Session lifetime" section.

Upgrade notes

• Sessions stored by 3.0.4 have no ValidUntil and keep working until they time out.
• Logins end after at most 8 hours by default; set <MaximumSessionLength> in the Federation section to change it.
• IsInitialized() is false between sending the AuthnRequest and receiving the response.
• The Forms ticket's UserData is now set by the library; an application that needs its own UserData should issue its own ticket in its own login action.

Tests

SessionLifetimeTest (length calculation, expired in-process sessions) and SessionStoreTest (pre-login session, ended login, Forms tickets from this and other sessions).