For the auth and audit middleware, we look for certain user claims in the JWT, like `sub` and `name` to get the user's identity. We should add a call to the [/user-info endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo) if the required claims are not populated and get the claims from there.