Fix SAML broker serialization failure for EncryptedID attribute values (SamlEncryptedId)

[Dpragt]

When using the extended SAML broker with an IdP that returns an AttributeValue containing saml:EncryptedID, login fails during broker context serialization.

The parser and mapper path already handles this type:

• SAMLAttributeValueParser parses saml:EncryptedID into SamlEncryptedId
• UserAttributeMapper can decrypt it successfully (attribute.decrypt=true)

However, serialization later fails in:

BaseWriter.writeAttributeTypeWithoutRootTag(...)
thrown error: PL00084: Writer: Unsupported Attribute Value:nl.first8.keycloak.dom.saml.v2.assertion.SamlEncryptedId
This happens in the flow:
SAMLDataMarshaller.serialize -> SAMLAssertionWriter -> BaseWriter -> SerializedBrokeredIdentityContext.serialize

Observed behavior

SAML response is accepted
Mapper decrypts ActingSubjectID correctly
Broker flow crashes before authentication completes due to unsupported writer type
Expected behavior
SamlEncryptedId should be serializable as a valid SAML attribute value (or otherwise safely handled), so broker login can complete.

Proposed fix
Reintroduce the following code from git history:

} else if (attributeValue instanceof SamlEncryptedId) {
    logger.debug("EncryptedID is not implemented yet.");

Additional context
There appears to have been partial support in earlier history, but it was never completed and later removed (possibly unintentionally). I can prepare a PR restoring the "not implemented yet" logger instead of throwing.

[0314R]

@Dpragt thank you for the PR and detailed write-up. I have approved the PR.

Unfortunately, our broker for eHerkenning (Signicat) no longer allows passing encrypted attributes in the login response. I even asked their support team, but even a manual override from them is not an option. Therefore our team cannot reproduce the scenario you've described.

You have probably already considered this, but just like Signicat forces decryption of attributes, your eHerkenning broker might at least provide the option for decrypting attributes there. When the option used to exist in the old Signicat dashboard, it was called "Decrypt attributes at the broker".

Hope this helps, and thanks again for looking into this use case.