Consider to make use of amr claim values for auth method

Jwt has an amr (authentication method reference) claim and the following draft defines values for authentication methods, like otp, sms, fingerprint etc., together with an open registry for new methods.

https://tools.ietf.org/html/draft-jones-oauth-amr-values-00

They might be useful for the authorization server to tell the client which kind of strong authentication is expected, so that the client can display an appropriate ui (an app could be able to ask for an otp from a device or for a fingerprint, the server could tell the app what method the resource owner has chosen when setting up strong auth).

No files, tests, or entry points are identified. Start by reviewing the JWT amr claim proposal linked in the issue and the project's authorization flow; the expected behavior and an acceptance test would need to be defined before implementation can be considered done.

Written by the indexing model from the issue text.