sub field is required in processUserInfoResponse() when skipSubjectCheck is set

[mhamann]

It seems that even with the skipSubjectCheck flag provided, calls to processUserInfoResponse() throw an error when the sub field is missing. This seems somewhat misleading. Would it not be appropriate to move the sub check into the default case and ignore it when skipSubjectCheck is present?

[panva]

sub is still a required value and a userinfo response without one is invalid. The skip symbol is not meant to be a free pass for invalid userinfo responses.

[mhamann]

Yes, makes sense based on the spec.

How would you handle a non-compliant provider like GitHub? I suppose that's essentially outside the scope of this library...

[panva]

GitHub is not an openid provider, so not calling a userinfo function. Use protectedResourceRequest instead