CommandResult has new property SecurityTokens that is set from AcsCommand from the new property Saml2SecurityTokens on Saml2Response.
The initial created SessionSecurityToken respects the ValidFrom and ValidTo values from the security tokens in the CommandResult for its validity.
Use CreateSessionSecurityToken of SessionAuthenticationModule to create the SessionSecurityToken
Respect SessionSecurityTokenHandler.DefaultTokenLifetime if no lifetime is passed by a condition
CommandResult  holds a reference to the Saml2Response to enable easy access to the information needed for further operations.
Introduced new method on CommandResult to compute the token validity.
Take IssueInstant and default token lifetime as fallback if no condition is defined to compute the token lifetime.
Respect the configured session token lifetime if shorter.