You possibly failed to import the oidc-claim-rules.xml file into the transcoding registry master file where the SAML imports are done. Neither the "mail" attribute, nor much of anything else, is going to get encoded if it doesn't know what names to call anything on the wire, and it will log all that. -- Scott