Fix lifecycle management

Check full endTime when expiring users to avoid multiple expirations
Remove lifecycle.status label each time endTime is updated

iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/cern/CernHrLifecycleHandler.java

@@ -27,6 +27,7 @@
 import java.util.List;
 import java.util.Optional;
 
+import org.joda.time.DateTimeComparator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Profile;
@@ -138,7 +139,7 @@ && accountWasSuspendedByIamLifecycleJob(a)) {
   }
 
   private void expireIfActiveAndMember(IamAccount a) {
-    if (CernHrLifecycleUtils.isActiveMembership(a.getEndTime()) && a.isActive()) {
+    if (DateTimeComparator.getInstance().compare(a.getEndTime(), new Date()) > 0 && a.isActive()) {
       expireAccount(a);
     }
   }

iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java

@@ -18,6 +18,7 @@
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Strings.isNullOrEmpty;
+import static it.infn.mw.iam.core.lifecycle.ExpiredAccountsHandler.LIFECYCLE_STATUS_LABEL;
 import static java.lang.String.format;
 import static java.util.Objects.isNull;
 
@@ -460,6 +461,7 @@ public IamAccount setAccountEndTime(IamAccount account, Date endTime) {
     Date previousEndTime = account.getEndTime();
     if (ObjectUtils.notEqual(previousEndTime, endTime)) {
       account.setEndTime(endTime);
+      account.removeLabelByName(LIFECYCLE_STATUS_LABEL);
       account.touch();
       accountRepo.save(account);
       eventPublisher.publishEvent(new AccountEndTimeUpdatedEvent(this, account, previousEndTime,