Getting claims from identity providers

[dleske]

Is there a way to get information about the authenticated user's claims other than having the application query the identity provider? It would be very useful if all claims were forwarded through headers as described here but is there another way to retrieve this information I just don't know about?

There appears to be _forward_auth_claims set in the cookie but I can't pull this apart and I doubt I'm supposed to.

Apologies for raising an issue for this, but I haven't been able to figure this out and no idea where to look next.