title: Keycloak AttributeToRoleMapper with multiple values
body: <p>My project has a SAML identity provider with multiple roles which we would like to map to a single role in our Keycloak server.</p>
  
  <p>Unfortunately, the isAttributePresent method expects to only have one IdP role mapped and checked in the SAML response. </p>
  
  <p>If you create one mapper for each IdP role mapped to a single role, the login flow will fail after the second login because the mappers are evaluated one by one and if the last one to be evaluated fails, the role is removed.</p>
  
  <p>Mappers:</p>
  
  <ul>
  <li>mapper1 - IdpRole1 -> KC_ROLE</li>
  <li>mapper2 - IdpRole2 -> KC_ROLE</li>
  </ul>
  
  <p>Users:</p>
  
  <ul>
  <li>user1 - has IdpRole1, IdpRole2</li>
  <li>user2 - has IdpRole1</li>
  <li>user3 - has IdpRole2</li>
  </ul>
  
  <p>user1:</p>
  
  <ul>
  <li><p>first login:</p>
  
  <ul>
  <li><p>importNewUser is called for mapper1, KC_ROLE is associated</p></li>
  <li><p>importNewUser is called for mapper2, KC_ROLE is associated </p></li>
  </ul></li>
  <li>second login:
  
  <ul>
  <li>updateBrokeredUser is called for mapper1, KC_ROLE is associated </li>
  <li>updateBrokeredUser is called for mapper2, KC_ROLE is associated </li>
  </ul></li>
  </ul>
  
  <p>user2:</p>
  
  <ul>
  <li>first login:
  
  <ul>
  <li>importNewUser is called for mapper1, KC_ROLE is associated </li>
  <li>importNewUser is called for mapper2, KC_ROLE is associated </li>
  </ul></li>
  <li>second login:
  
  <ul>
  <li>updateBrokeredUser is called for mapper1, KC_ROLE is associated </li>
  <li>updateBrokeredUser is called for mapper2, KC_ROLE is removed </li>
  </ul></li>
  </ul>
  
  <p>user3:</p>
  
  <ul>
  <li>first login:
  
  <ul>
  <li>importNewUser is called for mapper1, KC_ROLE is associated </li>
  <li>importNewUser is called for mapper2, KC_ROLE is associated </li>
  </ul></li>
  <li>second login:
  
  <ul>
  <li>updateBrokeredUser is called for mapper1, KC_ROLE is removed </li>
  <li>updateBrokeredUser is called for mapper2, KC_ROLE is associated</li>
  </ul></li>
  </ul>
  
  <p>Therefore, user1 and user 3 will have the role, but user2 will not.</p>
  
  <p>Are there any workarounds to this? Is there any plan for supporting multiple values?</p>