How the server established a session: the native sign-in it ran, or the IdP its own OAuth round trip went to. Never read off the ID token, whose identities lists every IdP linked to the user, not the one used now.
identities
How the server established a session: the native sign-in it ran, or the IdP its own OAuth round trip went to. Never read off the ID token, whose
identitieslists every IdP linked to the user, not the one used now.