I’m aware that this can be changed, but I’m just curious as to why the sub claim is set to be either the appuser.userName or the client id by default, rather than the actual user id (uid) in the default custom authorization server provided by Okta.
sub (appuser != null) ? appuser.userName: app.clientId