SSO sign-in failed whenever the provider sent no email, with no hook to
supply one. mapProfileToUser runs on every OIDC and SAML sign-in before the
user is looked up and can return the email, name, image, and emailVerified.
A SAML NameID now becomes the email only when its Format is emailAddress,
matching Keycloak and Ory Polis. Persistent and transient NameIDs are opaque
and were being stored as user emails.
Gustavo Valverde
7484c5dd3e