code: protected boolean isUserInfoValid(String userInfoStr, String subClaim) {
          String userInfoSubClaim = getUserInfoSubClaim(userInfoStr);
          if (userInfoSubClaim == null || subClaim == null || userInfoSubClaim.compareTo(subClaim) != 0) {
              Tr.error(tc, "USERINFO_INVALID", new Object[] { userInfoStr, subClaim });
              return false;
          }
          return true;
      }
docs: per oidc-connect-core-1.0 sec 5.3.2, sub claim of userinfo response must match sub claim in id token.