Mapping user enable status from freeipa (Keycloak 17.0.0)

Freeipa 389 ldap stores uses enabled/disabled status with a hidden “nsaccountlock” attribute. If the user is disabled, this is TRUE (not a binary).
I’m looking to understand how I can map this to the keycloak “enabled” attribute using a user-attribute-ldap-mapper.
Freeipa is our canonical source of truth and right now keycloak is just readonly from ldap.
Is it possible to do some kind of substitution within the mapper to replace TRUE/FALSE or otherwise map the TRUE from nsaccountlock to keycloak.enabled FALSE?

I’m interested if you found a solution to this. I’m also using FreeIPA with Keycloak and encountering issues mapping nsAccountLock to “enabled.”