Describe the bug

if oidcclaimsquery get a jwt token that doesn't have sub for any reason it will fail to cast nil to string.

To Reproduce

use a token without sub

Expected behavior

Better error handling instead of failing without clue what is happening.