diff --git a/app/forms/openid_connect_authorize_form.rb b/app/forms/openid_connect_authorize_form.rb
index 0b3d7b3aa65..b9340a5c530 100644
--- a/app/forms/openid_connect_authorize_form.rb
+++ b/app/forms/openid_connect_authorize_form.rb
@@ -110,7 +110,8 @@ def aal_values
   end
 
   def aal
-    Saml::Idp::Constants::AUTHN_CONTEXT_CLASSREF_TO_AAL[aal_values.sort.max]
+    Saml::Idp::Constants::AUTHN_CONTEXT_CLASSREF_TO_AAL[aal_values.sort.max] ||
+      Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF
   end
 
   def_delegators :ial_context,
diff --git a/app/presenters/openid_connect_user_info_presenter.rb b/app/presenters/openid_connect_user_info_presenter.rb
index 7f52a4aebc1..2b18fef1d25 100644
--- a/app/presenters/openid_connect_user_info_presenter.rb
+++ b/app/presenters/openid_connect_user_info_presenter.rb
@@ -21,6 +21,8 @@ def user_info
     info.merge!(ial2_attributes) if scoper.ial2_scopes_requested?
     info.merge!(x509_attributes) if scoper.x509_scopes_requested?
     info[:verified_at] = verified_at if scoper.verified_at_requested?
+    info[:ial] = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
+    info[:aal] = Saml::Idp::Constants::AUTHN_CONTEXT_AAL_TO_CLASSREF[identity.aal]
 
     scoper.filter(info)
   end
diff --git a/spec/forms/openid_connect_authorize_form_spec.rb b/spec/forms/openid_connect_authorize_form_spec.rb
index bb76a2dd5fd..05f45dfd74b 100644
--- a/spec/forms/openid_connect_authorize_form_spec.rb
+++ b/spec/forms/openid_connect_authorize_form_spec.rb
@@ -356,6 +356,98 @@
     end
   end
 
+  describe '#aal' do
+    context 'when DEFAULT_AAL passed' do
+      before do
+        default = Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF
+        IdentityConfig.store.valid_authn_contexts.push(default)
+      end
+
+      after do
+        IdentityConfig.store.valid_authn_contexts.pop
+      end
+
+      let(:acr_values) { Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 0' do
+        expect(form.aal).to eq(Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF)
+      end
+    end
+
+    context 'when AAL1 passed' do
+      before do
+        aal1 = Saml::Idp::Constants::AAL1_AUTHN_CONTEXT_CLASSREF
+        IdentityConfig.store.valid_authn_contexts.push(aal1)
+      end
+
+      after do
+        IdentityConfig.store.valid_authn_contexts.pop
+      end
+
+      let(:acr_values) { Saml::Idp::Constants::AAL1_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 1' do
+        expect(form.aal).to eq(1)
+      end
+    end
+
+    context 'when AAL2 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL2_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 2' do
+        expect(form.aal).to eq(2)
+      end
+    end
+
+    context 'when AAL2_PHISHING_RESISTANT passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL2_PHISHING_RESISTANT_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 2' do
+        expect(form.aal).to eq(2)
+      end
+    end
+
+    context 'when AAL2_HSPD12 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL2_HSPD12_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 2' do
+        expect(form.aal).to eq(2)
+      end
+    end
+
+    context 'when AAL3 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL3_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 3' do
+        expect(form.aal).to eq(3)
+      end
+    end
+
+    context 'when AAL3_HSPD12 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL3_HSPD12_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 3' do
+        expect(form.aal).to eq(3)
+      end
+    end
+  end
+
+  describe '#aal' do
+    context 'when IAL and AAL passed' do
+      aal2 = Saml::Idp::Constants::AAL2_AUTHN_CONTEXT_CLASSREF
+      ial2 = Saml::Idp::Constants::IAL2_AUTHN_CONTEXT_CLASSREF
+
+      let(:acr_values) do
+        "#{aal2} #{ial2}"
+      end
+
+      it 'returns ial and aal' do
+        expect(form.aal).to eq(2)
+        expect(form.ial).to eq(2)
+      end
+    end
+  end
+
   describe '#verified_within' do
     context 'without a verified_within' do
       let(:verified_within) { nil }
diff --git a/spec/presenters/openid_connect_user_info_presenter_spec.rb b/spec/presenters/openid_connect_user_info_presenter_spec.rb
index 4411d4a0422..c380b2875da 100644
--- a/spec/presenters/openid_connect_user_info_presenter_spec.rb
+++ b/spec/presenters/openid_connect_user_info_presenter_spec.rb
@@ -17,6 +17,7 @@
       user: create(:user, profiles: [profile]),
       service_provider: service_provider.issuer,
       scope: scope,
+      aal: 2,
     )
   end
 
@@ -26,12 +27,17 @@
     subject(:user_info) { presenter.user_info }
 
     it 'has basic attributes' do
+      ial = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
+      aal = Saml::Idp::Constants::AUTHN_CONTEXT_AAL_TO_CLASSREF[identity.aal]
+
       aggregate_failures do
         expect(user_info[:sub]).to eq(identity.uuid)
         expect(user_info[:iss]).to eq(root_url)
         expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
         expect(user_info[:email_verified]).to eq(true)
         expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
+        expect(user_info[:ial]).to eq(ial)
+        expect(user_info[:aal]).to eq(aal)
       end
     end