Duplicate subject mappings with non-matching conditions block working mappings for same attribute value

[marythought]

Description

When multiple subject mappings exist for the same attribute value, and one mapping's condition fails to match (e.g., uses a selector that doesn't evaluate), it prevents OTHER mappings for that same value from granting access. Removing the non-matching mapping fixes the issue.

Steps to Reproduce

1. Create attribute value test_weight
2. Create mapping A: .preferred_username IN ["alice"] → test_weight (action: read)
3. Create mapping B: .sub IN ["alice-uuid"] → test_weight (action: read)
   (Note: .sub doesn't evaluate in claims mode — see Subject mapping .sub selector doesn't match in claims ERS mode #3188)
4. Attempt decrypt as alice (whose preferred_username is "alice")

Expected Behavior

Mapping A should match (preferred_username = "alice") and grant access, regardless of whether mapping B matches or not. Multiple mappings for the same value should be evaluated independently.

Actual Behavior

The entitlement evaluation returns empty (Entitlements:map[]). Neither mapping grants access. Decrypt fails with permission_denied.

Proof That Mapping A Works Alone

1. Delete mapping B (the .sub one)
2. Retry decrypt as alice
3. Success — mapping A now evaluates correctly and grants access

Impact

This is critical for applications that evolve their subject mapping strategy. If old mappings with outdated selectors are left in the platform, they silently break working mappings for the same attribute values. There is no error message indicating which mapping or selector caused the failure — the audit log only shows Entitlements:map[].

Suggested Fix

Subject mappings for the same attribute value should be evaluated independently. A non-matching mapping should not affect the evaluation of other mappings. Consider:

• Evaluating all mappings and granting access if ANY match (union semantics)
• Or at minimum, logging which specific mapping/condition failed to help debugging

Environment

• Platform: latest
• ERS mode: claims
• Keycloak 25.0