def _check_subject_identifier_matches_requested(self, authentication_request, sub):
        # type (oic.message.AuthorizationRequest, str) -> None
        """
        Verifies the subject identifier against any requested subject identifier using the claims request parameter.
        :param authentication_request: authentication request
        :param sub: subject identifier
        :raise AuthorizationError: if the subject identifier does not match the requested one
        """
        if 'claims' in authentication_request:
            requested_id_token_sub = authentication_request['claims'].get('id_token', {}).get('sub')
            requested_userinfo_sub = authentication_request['claims'].get('userinfo', {}).get('sub')
            if requested_id_token_sub and requested_userinfo_sub and requested_id_token_sub != requested_userinfo_sub:
                raise AuthorizationError('Requested different subject identifier for IDToken and userinfo: {} != {}'
                                         .format(requested_id_token_sub, requested_userinfo_sub))

            requested_sub = requested_id_token_sub or requested_userinfo_sub
            if requested_sub and sub != requested_sub:
                raise AuthorizationError('Requested subject identifier \'{}\' could not be matched'
                                         .format(requested_sub))
Verifies the subject identifier against any requested subject identifier using the claims request parameter.
        :param authentication_request: authentication request
        :param sub: subject identifier
        :raise AuthorizationError: if the subject identifier does not match the requested one