Is there a way to convert saml assertion to token claims without storing them as role/group or user attribute

Getting advice
, , ,
1

I have an saml2.0 identity provider, I have some assertions coming in , I want to map those assertions into custom claims in my keycloak jwt token,
how can i achieve this.
I dont want to really store the incoming assertion into a role/group or user attribute…
I just want to get those attributes from saml assertion, not store anywhere in keycloak, and mint the info in token.

Is this possible?

2

There is something called userSession mapper in saml/oidc identity provider mapper, and user session note mapper in client scopes… i am thinking of exploring that combination to check if it will work.

but , the time out (user session timeout), etc could be challenging… not sure if it will work.

has any one tried such a thing??