We’re using keycloak in a OpenId Connect flow and have setup everything fine so far. The only remaining thing I want to do is to manipulate the sub in a certain way: The ID provider sends us a sub, which we map 1:1 to the sub in the token. But now we want to manipulate this sub like

IDP

{
  "customField": "SAM",
  "sub": "sub1"
}

which in the token we want to look like

{
  "sub": "SAM:sub1"
}

Is this possible? If so, how?

I already to somehow achieve this by mappers but cannot get it to work.