Properly parse SingleSignOnService

[klizhentas]

What happened:

In case if SAML entity descriptor contains multiple tags like this:

    <tag0:SingleSignOnService Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' Location='https://...'></tag0:SingleSignOnService>

Teleport's SAML library gets confused and picks the last one that is the wrong one. It has to specifically pick the service with a proper binding.

This causes us a lot of trouble setting some identity providers up.

What you expected to happen:

How to reproduce it (as minimally and precisely as possible):

Environment:

• Teleport version (use teleport version):
• Tsh version (use tsh version):
• OS (e.g. from /etc/os-release):

Browser environment

• Browser Version (for UI-related issues):
• Install tools:
• Others:

Relevant Debug Logs If Applicable

• tsh --debug
• teleport --debug

[kontsevoy]

Punt if not easy to fix.

[russjones]

Let's check if this has been fixed upstream since then.