SAML federation bug: First occurence of NameID is always chosen

[MichaelTran262]

Description

When an Identity Provider has multiple NameID formats available, for example:

<ns0:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</ns0:NameIDFormat>
<ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</ns0:NameIDFormat>
<ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</ns0:NameIDFormat>

And we configure SAML federation with NameID Policy Format to Persistent, it will take the Unpsecified option, because it is the first one.


If Transient would be first and we chose Persistent

<ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</ns0:NameIDFormat>
<ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</ns0:NameIDFormat>

Then Keycloak would throw an error:
Can not have Transient NameID Policy Format together with SUBJECT Principal Type
And the IDP would not have been added even if it has Persistent as a second option.