By default, OpenAM 12.0.0 signs id_tokens using RS256. The present example implementation does not validate such id_tokens.