How to add script mappers to Keycloak:
https://www.keycloak.org/docs/latest/server_development/index.html#_script_providers
https://www.keycloak.org/docs/latest/server_development/index.html#openid-connect-protocol-mapper

I guess the relevant script mapper needed for vcenter is one to overwrite the sub claim with a user value different from the UUID that Keycloak uses by default as sub claim.

The code within the script mapper then is something like this
token.setSubject(user.PROPERTY_NEEDED_BY_VCENTER);
or
token.setSubject(user.ATTRIBUTE_NEEDED_BY_VCENTER[0]);

I just recently worked this out for my SAML client.

I first had to create a script file full-name-mapper.js with the following contents:

var user = keycloakSession.getContext().getUser();
var fullName = user.getFirstName() + " " + user.getLastName()
exports = fullName

Next, I created a META-INF/keycloak-scripts.json file like this:

{
    "saml-mappers": [
        {
            "name": "Full Name Mapper",
            "fileName": "full-name-mapper.js",
            "description": "Combine firstName and lastName in a single field"
        }
    ]
}

Then I had to create a JAR file like this:

jar -cvf mappers.jar full-name-mapper.js META-INF/keycloak-scripts.json

Finally, in my container build I have to copy the jar to /opt/keycloak/providers and set the environment variable KC_FEATURES=preview as shown below:

FROM quay.io/keycloak/keycloak:26.5 AS builder

# Enable health and metrics support
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_DB=postgres

# Configure a database vendor
ENV KC_PROXY_HEADERS=xforwarded
ENV KC_HTTP_ENABLED=true
ENV KC_DB=postgres
ENV KC_FEATURES=preview

COPY mappers.jar /opt/keycloak/providers/mappers.jar

WORKDIR /opt/keycloak
RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:26.5
COPY --from=builder /opt/keycloak/ /opt/keycloak/
COPY . /opt/keycloak/themes/zanclus

# change these values to point to a running postgres instance
ENV KC_HTTP_ENABLED=true
ENV KC_DB=postgres
ENV KC_DB_URL=jdbc:postgresql://postgresql:5432/keycloak
ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]

I then restarted my quadlet which is running Keycloak and the mapper is now listed: