This step is due once SSO team has adjusted the FM's SSO client to have the new data format in the sub claim.

Effectively this step drops usage of deprecated_sub claim, moving back to the plain sub claim.