opentoken | parse encrypted tokens in the opentoken format | Encryption library

I feel like from a design standpoint, it would be best to keep the convention that the property names match the JSON property names. So, you could add both properties, and then check which one is not null.

After having a call with a couple people over at PingFederate, I figured out how to configure and use PF oauth instead of utilizing their opentoken implementation.

The gist is that the user is sent to SSO and when they come back to my angular app, they hit a url with a token. Then, I do an API call back to PF with the token to get their oauth token.

Then in my API, I have a dual configuration for azure ad service principal and PF like this:

For your first question - How to configure SP initiated SSO from Pingfed, and retrieve the user attributes from the Okta Idp connection. If you are using OpenToken which is a custom adapter, you can download from PingFederate download side, refer here. This custom adapter is the Opentoken adapter that transfers user attributes between the application and the PingFederate server. On the SP side, the OpenToken Adapter can be used to transfer user-identity information to the target SP application. On the IDP side the OpenToken adapter allows the PingFederate server to receive the user's identity from the IDP application.

Here is a note from PingFederate about OpenToken Adapter. Note: To integrate applications for use with the OpenToken Adapter, download an integration kit for PingFederate from the Ping Identity Downloads website and follow instructions for installing and using Agent Toolkits in the accompanying documentation. Follow the configuration instructions in this topic to set up the OpenToken Adapter to use with your applications.

For your second question - How I can map the attributes from the SAML assertion sent from Okta to Pingfed SP into an opentoken to my target application. For SAML connections, the IdP application can provide an authentication context to the service provider (SP) by including the authnContext attribute with the desired value in the secure token. The OpenToken doc will provide you more info on authnContext.
Here is a definition of Authncontext - Authentication context is defined as the information, additional to the authentication assertion itself, that the relying party may require before it makes an entitlements decision with respect to an authentication assertion. Such context may include, but is not limited to, the actual authentication method used. Here is configuring Authn Context in PingFederate.