Clearify BankID IdP behaviour when user cancels authentication

[martin-lindstrom]

Section 3.4 of the "Implementation Profile for BankID Identity Providers within the Swedish eID Framework - version 1.0" specification should be updated to clarify that an IdP makes sure that there are no dangling BankID-session.

If the user clicks "Cancel" in the IdP UI after giving his or hers personal identity number but before starting the BankID-app, the BankID-session will be left hanging and preventing the user from using its BankID for the next couple of minutes (until the session times out). This is because the IdP initiates the BankID operation after it has been given the personal identity number.

A solution may be that the IdP initiates a new BankID-operation just to make sure to kill the previous one (the newly created will also be invalidated by the BankID server).

Of course, the best solution would be if the BankID-API defined a Cancel-method, but this will have to be communicated in other channels.