Force NameId format is broken for latest keycloack SAML

Hi,

I recently upgraded by Keyclock from 4.6.0 Wildfly (very old) to latest 19.0.2 (Wildfly) and I can see the Force Name Id format toggle that used to add Name Id format of our choice to SAML Response doesn’t work as intended ?

Current behaviour in 19.0.2 is regardless of whatever Name ID format we select (email, username) and toggle on Force name ID format, keycloack always sends persistent with encoded username in SAML Response. Which wasn’t the case of older versions.

I am hoping to understand if it’s an intentional, if so would like to know the reason or a bug?

Thanks