> policy:
> - allow:
> or:
> # - email:
> # is: john.doe@acme.local
> - claim/email:
> has: john.doe@acme.local
> - claim/family_name:
> is: Doe
> pass_identity_headers: true
>
> ```
>
> The above example results in a DENY, while the family\_name claim is Doe and the email claim is john.doe@acme.local. I double checked the user claims in [https://authenticate.localhost/.pomerium](https://authenticate.localhost/.pomerium)
>
> The policy results in ALLOW when only using the email criteria type. When I only use claim/email instead it results in DENY again.
>
> Is there something I’m missing regarding the use of IDP claims in PPL?
---
### Author:  [@alex](https://discuss.pomerium.com/u/alex)
#### Post date: [October 20, 2021, 4:52pm UTC](https://discuss.pomerium.com/t/using-claims-in-ppl/24/2 "2021-10-20T16:52:33Z")
Additional info from the thread:
[Alex](https://app.slack.com/team/U027D9090FL) [18 minutes ago](https://pomerium-io.slack.com/archives/CK92MUAES/p1634747660070300?thread_ts=1634723921.068100&cid=CK92MUAES)
Hi [@Ronnie Vink](https://pomerium-io.slack.com/team/U01DVGRMWC9) . Have you tried using `is` instead of `has` for `claim/email` ?And as an aside, I’m curious why you want to use `claim/email` over just `email` ; do you have a situation where they’d be different?
[Ronnie Vink](https://app.slack.com/team/U01DVGRMWC9) [15 minutes ago](https://pomerium-io.slack.com/archives/CK92MUAES/p1634747809070700?thread_ts=1634723921.068100&cid=CK92MUAES)
yup used the `is` as well. it’s not about `claim/email` specifically. it’s about using idp claims like the `claim/family_name` example (or `claim/groups` ) in policies which seems to be not working at all. (edited)
[Ronnie Vink](https://app.slack.com/team/U01DVGRMWC9) [14 minutes ago](https://pomerium-io.slack.com/archives/CK92MUAES/p1634747875071000?thread_ts=1634723921.068100&cid=CK92MUAES)
FYI, I’m using Keycloak as OIDC provider. I added the groups claim in a separate scope, so any policies based on groups could be done with `claim/groups`
---
### Author:  [@calebdoxsey](https://discuss.pomerium.com/u/calebdoxsey)
#### Post date: [October 20, 2021, 6:47pm UTC](https://discuss.pomerium.com/t/using-claims-in-ppl/24/3 "2021-10-20T18:47:27Z")
Currently the `claim` criterion does not support the string matchers. It is rather used directly and only supports exact matches:
```auto
allow:
and:
- claim/family_name: Smith
```
---
### Author:  [@RonnieV](https://discuss.pomerium.com/u/RonnieV)
#### Post date: [October 20, 2021, 7:41pm UTC](https://discuss.pomerium.com/t/using-claims-in-ppl/24/4 "2021-10-20T19:41:36Z")
Works like a charm. Thanks so much! I can confirm below works:
```auto
routes:
- from: https://verify.localhost
to: http://verify
pass_identity_headers: true
policy:
- allow:
and:
# - email:
# is: john.doe@acme.local
- claim/family_name: Doe
- claim/groups: DevOps
```
---
### Author:  [@RonnieV](https://discuss.pomerium.com/u/RonnieV)
#### Post date: [October 20, 2021, 7:46pm UTC](https://discuss.pomerium.com/t/using-claims-in-ppl/24/5 "2021-10-20T19:46:18Z")
Claim example on [https://www.pomerium.com/enterprise/reference/manage.html#pomerium-policy-language](https://www.pomerium.com/enterprise/reference/manage.html#pomerium-policy-language) should be updated accordingly:
---
### Author:  [@alex](https://discuss.pomerium.com/u/alex)
#### Post date: [October 20, 2021, 9:08pm UTC](https://discuss.pomerium.com/t/using-claims-in-ppl/24/6 "2021-10-20T21:08:53Z")
Thanks, I’ve [staged a fix](https://github.com/pomerium/pomerium/pull/2689) for the docs.