Instead of getting first SSO service from federation, get first SSO service that has a supported binding (until other bindings become supported).