[Saml-admins] Re: OpenID Connect best practices