Expose more useful SAML fields

[Benjamin-Displayr]

This PR exposes the following fields/attributes:

• The ID attribute of the SAML Assertion
• The expiration date of the SAML Assertion. Taken from the NotOnOrAfter attribute of the SubjectConfirmationData
  • This was already looked up to check for IsValid but this PR exposes it to callers.
• The list of Audience values from the SAML AudienceRestriction
• The SessionNotOnOrAfter attribute from the SAML AuthnStatement

The ID and the expiration date of the SAML Assertion are useful in detecting replay attacks. The ID uniquely identifies individual Assertion responses, so the application can keep track of ones it has seen before. The expiration date determines how long the Assertion the is valid for and therefore how long the application needs to keep track of it for to detect replays.

The Audience values are useful for validating that the Assertion is actually intended for the consuming application, this can also be used to match the correct customer in a multi tenant setup using IdP initiated flow.

The SessionNotOnOrAfter attribute is an optional attribute that an IdP can set as a way to tell the consuming application how long it should create a local session for.