[keycloak-user] NameID formats

Hi, I am using simplesamlphp's builtin "test authentication sources" functionality against my keycloak server. From what I understand it should be possible to obtain the regular username as a NameID, if I ask for the format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent. However, simplesaml test auth source keeps telling me: I am trying to use (mostly) clients that require access to the normal username, and not some string like above. - in keycloak client config I have set NameID format to "username". - in simplesaml I (think I) request urn:oasis:names:tc:SAML:2.0:nameid-format:persistent So the question: how can I make keycloak return the regular (active directory) username to a client? As a workaround I now use "urn:oid:2.5.4.4" for a username, as for most users this is identical to the username. MJ