The authnContextClassRef value from the SAML assertion will be stored in the session property authncontextclassref.

<saml2:AuthnContext>
  <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI</saml2:AuthnContextClassRef>
</saml2:AuthnContext>

The id_token claims population is performed using the GenerateJWTTokenValve in the execution flow of the OpenID Connect Provider. Populate claims using session property expansion, based on the session properties in the previous step.

(Session property expansion only works on single values. For multi-values (for example roles in the above example), a supporting valve must be added to the flow prior to generating the JWT id_token. )

In this example the JWT is populated according to the session values populated above.

• Click Stage changes and commit changes

When UserInfo (optional) has been added to the OpenID Connect Provider, the userinfo endpoint will point to a pipe that will add claims to the response using PropertyAddValve.

This pipe example populates and returns the same claims as above.

{
		"id": "userinfo",
		"valves": [
			{
                "name": "ItemCreateValve",
                "config": {
                    "dest_id": "userinfo_props"
                }
            },
            {
                "name": "PropertyAddValve",
                "config": {
                    "name": "authorization",
                    "value": "{{request.Authorization}}"
                }
            },
            {
                "name": "PropertyReplaceValve",
                "config": {
                    "source": "authorization",
                    "dest": "access_token",
                    "token": "Bearer ",
                    "replacement": ""
                }
            },
            {
                "name": "SessionResolveValve",
                "config": {
                    "alias": "{{item.access_token}}",
                    "require_session": "true",
                    "require_auth_session": "false"
                }
            },
			{
				"name": "PropertyAddValve",
				"config": {
					"name": "sub",
					"value": "{{session.user_id}}"
				}
			},
			{
				"name": "PropertyAddValve",
				"config": {
					"name": "given_name",
					"value": "{{session.firstName}}"
				}
			},
			{
				"name": "PropertyAddValve",
				"config": {
					"name": "family_name",
					"value": "{{session.LastName}}"
				}
			},
			{
				"name": "PropertyAddValve",
				"config": {
					"name": "email",
					"value": "{{session.mail}}"
				}
			},
			{
				"name": "PropertyFromSessionToItem",
				"config": {
					"source": "roles"
				}
			},
			{
				"name": "PropertyRenameValve",
				"config": {
					"source": "roles",
					"dest": "role"
				}
			},
			{
  "name": "PropertyRemoveValve",
    "config": { 
              "name":"access_token,authorization"
    }
}
		],
		"created": "2017-11-13T09:53:46.595Z"
	}

NB! The amr claim is not part of UserInfo.