# "contains" operator for Claim Criterion

**URL:** <https://discuss.pomerium.com/t/contains-operator-for-claim-criterion/487>\
**Category:** Support\
**Tags:** idp, k8s\
**Created:** [July 28, 2025, 9:48am UTC](https://discuss.pomerium.com/t/contains-operator-for-claim-criterion/487 "2025-07-28T09:48:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vijay](https://avatars.discourse-cdn.com/v4/letter/v/4bbf92/32.png) [@vijay](https://discuss.pomerium.com/u/vijay)\
**Post date:** [July 28, 2025, 9:48am UTC](https://discuss.pomerium.com/t/contains-operator-for-claim-criterion/487/1 "2025-07-28T09:48:14Z")

</div>

## What happened?

According to the [Pomerium Policy language](https://0-22-0.docs.pomerium.com/docs/capabilities/ppl#string-matcher), the “contains” operator should work with the claims string matcher

```auto
ingress.pomerium.io/policy: |
  allow:
    and:
      - claim/custom:groups: "[Devleads, Developer]"

```

`{"level":"info","service":"authorize","method":"GET","path":"/favicon.ico","host":"test-app.pomerium.dev.com","query":"","allow":true,"allow-why-true":["claim-ok"],"deny":false,"deny-why-false":["valid-client-certificate-or-none-required"],"time":"2025-07-28T09:25:31Z","message":"authorize check"}`

## What did you expect to happen?

```auto
ingress.pomerium.io/policy: |
  allow:
    and:
      - claim/custom:groups:
            contains: "Developer"

```

`{"level":"info","service":"authorize","method":"GET","path":"/","host":"test-app.pomerium.dev.com","query":"","allow":false,"allow-why-false":["claim-unauthorized","non-pomerium-route"],"deny":false,"deny-why-false":["valid-client-certificate-or-none-required"],"time":"2025-07-28T09:25:54Z","message":"authorize check"}`

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/cdf94bbc61fc2884f64c13686e638a4331e25013.png)

## What’s your environment like?

- Pomerium version (retrieve with `pomerium --version`): v0.22.1
- Server Operating System/Architecture/Cloud: EKS

## What’s your config.yaml?

```auto
autocert: false
dns_lookup_family: V4_ONLY
address: :443
grpc_address: :443
certificate_authority_file: "/pomerium/ca/ca.crt"
certificates:
authenticate_service_url: https://authenticate.pomerium.dev.com
authorize_service_url: https://pomerium-authorize.pomerium.svc.cluster.local
databroker_service_url: https://pomerium-databroker.pomerium.svc.cluster.local
idp_provider: oidc
idp_scopes: openid profile email
idp_provider_url: https://cognito-idp.eu-west-1.amazonaws.com/eu-west-1_AYuZSIE6
jwt_claims_headers:
  - groups
idp_client_id: idp_client_id
idp_client_secret: idp_client_secret
databroker_storage_tls_skip_verify: false

```

## Additional context

The issue is that Cognito passes the groups as strings instead of lists

```auto
"[Devleads, Developer]"

```

Are there any other operators that can check for the substring in `claim/custom:groups`?

---

<div class="post-metadata">

**Author:** ![anon77921604](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@anon77921604](https://discuss.pomerium.com/u/anon77921604)\
**Post date:** [September 8, 2025, 2:39pm UTC](https://discuss.pomerium.com/t/contains-operator-for-claim-criterion/487/2 "2025-09-08T14:39:33Z")

</div>

Hi Vijay,

Thank you for using Pomerium!

In the case of claim matching, the claim criterion must match the supplied value exactly.

e.g.

```yaml
allow:
  or:
    - "claim/cognito:groups": Devleads
    - "claim/cognito:groups": Developer

```

Is there a reason you are forming a custom claim as a string rather than using Cognito’s built-in cognito:groups claim? The built-in claim should be a compatible list.

---

<div class="post-metadata">

**Author:** ![vijay](https://avatars.discourse-cdn.com/v4/letter/v/4bbf92/32.png) [@vijay](https://discuss.pomerium.com/u/vijay)\
**Post date:** [October 15, 2025, 9:19am UTC](https://discuss.pomerium.com/t/contains-operator-for-claim-criterion/487/3 "2025-10-15T09:19:23Z")

</div>

The reason we have the custom:claims is because they are linked to Okta groups. Cognito uses Okta as an external IdP.

I’ll check if it’s possible to map Okta with cognito:groups or find a workaround.

Right now, we’re unable to directly connect Okta with Pomerium due to the plan we’re on with Okta.

Thank you for clarifying. I appreciate it!