Feature Request: Use dynamic value in the cookie for SAML and OpenID authentication

[xingzhang-suse]

Is your feature request related to a problem?

#34

Solution you'd like

1. Generate a unique nonce (UUID) per login attempt when the user is redirected to the IdP.
2. Store the token as putToken(nonce, userToken) instead of the fixed "samlSso" key.
3. Put the nonce in the temp cookie, so the second-phase PATCH /token_auth_server uniquely identifies the login attempt.
4. Optionally pass the nonce as RelayState to the IdP for callback validation.
5. Validate and invalidate the specific nonce on the PATCH call — preventing replay and cleaning up stale entries.
6. Apply the same fix to OpenIdAuthService.scala — confirmed to use the identical KEY = "samlSso" pattern.
7. Add TTL/cleanup for pending login entries to prevent unbounded in-memory map growth.

Alternatives you've considered

No response

Anything else?

No response