(Copied from GitHub, submitted here as suggested by William)

After a few hours of headache, I think I found some code with unintentional behavior.

While trying to use getAuthenticationMethodClaims() to pass back some amr values in id tokens, I realized why my custom authentication script was returning an empty JSON for the amr field ("amr":"[]").

In IdTokenFactory.java, the following line is in setAmrClaim:

CustomScriptConfiguration script = externalAuthenticationService.getCustomScriptConfiguration(
    AuthenticationScriptUsageType.BOTH, acrValues);

Due to the usage of AuthenticationScriptUsageType.BOTH, "script" is set to null unless the usage type of your custom authentication script is set to "Both methods". I think the intention was to check for scripts of any usage type (Web, Native, or Both methods) corresponding to "acrValues", but the current code only accepts scripts that are specifically set to "Both methods". After changing the usage type of my script from "Web" to "Both methods", everything now works as intended (properly getting the amr field in id tokens), but this shouldn't be necessary (future users will run into the same issue if using "Web" or "Native" usage types).