[Saml-admins] OpenID Connect best practices