How to map a SAML NameID assertion to email address?

Getting advice
1

I receive from a saml identity provider the following saml response (shortened):

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="[MASKED]" ID="[MASKED]" InResponseTo="[MASKED]" IssueInstant="2024-10-03T13:36:28.756Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
	<saml2:Assertion ID="[MASKED]" IssueInstant="2024-10-03T13:36:28.756Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
		<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
			<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">firstname.lastname@test.com</saml2:NameID>
			<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
				<saml2:SubjectConfirmationData InResponseTo="[MASKED]" NotOnOrAfter="2024-10-03T13:41:28.757Z" Recipient="[MASKED]"/>
			</saml2:SubjectConfirmation>
		</saml2:Subject>
	</saml2:Assertion>
</saml2p:Response>

Now I try to map the NameID assertion value to the keycloak’s user email address but this does not work. I tried to do so using a mapper of type “Attribute Importer” with the “Attribute Name” set to “NameID”. Furthermore I tried to map it using a mapper of type “XPath Attribute Importer” set to “//saml2:NameID[1]/text()”.
The NameID is however picked as username. So how can I set this also for the email address?

grafik
grafik488×532 14.3 KB