Add IAL and AAL to token response

app/forms/openid_connect_authorize_form.rb

@@ -110,7 +110,8 @@ def aal_values
   end
 
   def aal
-    Saml::Idp::Constants::AUTHN_CONTEXT_CLASSREF_TO_AAL[aal_values.sort.max]
+    aal_value = aal_values.sort.max || ::Idp::Constants::DEFAULT_AAL
+    Saml::Idp::Constants::AUTHN_CONTEXT_CLASSREF_TO_AAL[aal_value]
   end
 
   def_delegators :ial_context,

app/presenters/openid_connect_user_info_presenter.rb

@@ -21,6 +21,8 @@ def user_info
     info.merge!(ial2_attributes) if scoper.ial2_scopes_requested?
     info.merge!(x509_attributes) if scoper.x509_scopes_requested?
     info[:verified_at] = verified_at if scoper.verified_at_requested?
+    info[:ial] = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
+    info[:aal] = Saml::Idp::Constants::AUTHN_CONTEXT_AAL_TO_CLASSREF[identity.aal]
 
     scoper.filter(info)
   end

spec/forms/openid_connect_authorize_form_spec.rb

@@ -356,6 +356,65 @@
     end
   end
 
+  describe '#aal' do
+    context 'when AAL1 passed' do
+      before do
+        IdentityConfig.store.valid_authn_contexts.push(Saml::Idp::Constants::AAL1_AUTHN_CONTEXT_CLASSREF)
+      end
+
+      after do
+        IdentityConfig.store.valid_authn_contexts.pop
+      end
+
+      let(:acr_values) { Saml::Idp::Constants::AAL1_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 1' do
+        expect(form.aal).to eq(1)
+      end
+    end
+
+    context 'when AAL2 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL2_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 2' do
+        expect(form.aal).to eq(2)
+      end
+    end
+
+    context 'when AAL2_PHISHING_RESISTANT passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL2_PHISHING_RESISTANT_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 2' do
+        expect(form.aal).to eq(2)
+      end
+    end
+
+    context 'when AAL2_HSPD12 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL2_HSPD12_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 2' do
+        expect(form.aal).to eq(2)
+      end
+    end
+
+    context 'when AAL3 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL3_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 3' do
+        expect(form.aal).to eq(3)
+      end
+    end
+
+    context 'when AAL3_HSPD12 passed' do
+      let(:acr_values) { Saml::Idp::Constants::AAL3_HSPD12_AUTHN_CONTEXT_CLASSREF }
+
+      it 'returns 3' do
+        expect(form.aal).to eq(3)
+      end
+    end
+
+  end
+
   describe '#verified_within' do
     context 'without a verified_within' do
       let(:verified_within) { nil }

spec/presenters/openid_connect_user_info_presenter_spec.rb

@@ -17,6 +17,7 @@
       user: create(:user, profiles: [profile]),
       service_provider: service_provider.issuer,
       scope: scope,
+      aal: 2,
     )
   end
 
@@ -32,6 +33,8 @@
         expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
         expect(user_info[:email_verified]).to eq(true)
         expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
+        expect(user_info[:ial]).to eq(Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial])
+        expect(user_info[:aal]).to eq(Saml::Idp::Constants::AUTHN_CONTEXT_AAL_TO_CLASSREF[identity.aal])
       end
     end