code: def _check_subject_identifier_matches_requested(self, authentication_request, sub):
          # type (oic.message.AuthorizationRequest, str) -> None
          
          if 'claims' in authentication_request:
              requested_id_token_sub = authentication_request['claims'].get('id_token', {}).get('sub')
              requested_userinfo_sub = authentication_request['claims'].get('userinfo', {}).get('sub')
              if requested_id_token_sub and requested_userinfo_sub and requested_id_token_sub != requested_userinfo_sub:
                  raise AuthorizationError('Requested different subject identifier for IDToken and userinfo: {} != {}'
                                           .format(requested_id_token_sub, requested_userinfo_sub))
  
              requested_sub = requested_id_token_sub or requested_userinfo_sub
              if requested_sub and sub != requested_sub:
                  raise AuthorizationError('Requested subject identifier \'{}\' could not be matched'
                                           .format(requested_sub))
docs: Verifies the subject identifier against any requested subject identifier using the claims request parameter.
          :param authentication_request: authentication request
          :param sub: subject identifier
          :raise AuthorizationError: if the subject identifier does not match the requested one