[keycloak-user] Is it possible to map 'sub' claim of external identity provider to attribute