code: func getIDTokenStr(jwtSigningKey *ecdsa.PrivateKey, r *http.Request, at *AccessToken, scopeStr string) (string, error) {
  	// for each valid oidc standard scope, fetch related data
  	token := jwt.New(jwt.SigningMethodES384)
  
  	// setup basic claims
  	token.Claims["sub"] = at.Username
  	token.Claims["iss"] = issuer
  	token.Claims["iat"] = at.CreatedAt.Unix()
  	token.Claims["exp"] = at.ExpirationTime().Unix()
  	token.Claims["aud"] = at.ClientID
  
  	// check scopes for additional claims
  	err := setValuesFromScope(token, scopeStr, r, at)
  	if err != nil {
  		return "", fmt.Errorf("failed to get additional claims for id token: %s", err)
  	}
  
  	return token.SignedString(jwtSigningKey)
  }
docs: // getIDTokenStr returns an oidc ID token string
  // It will set the default required claims
  // and calls setValuesFromScope to set additional claims