{"action":"created","issue":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1006","labels_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1006/labels{/name}","comments_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1006/comments","events_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1006/events","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1006","id":128311329,"number":1006,"title":"RPT endpoint returns \"needs_info\"","user":{"login":"shihjay2","id":2372438,"avatar_url":"https://avatars.githubusercontent.com/u/2372438?v=3","gravatar_id":"","url":"https://api.github.com/users/shihjay2","html_url":"https://github.com/shihjay2","followers_url":"https://api.github.com/users/shihjay2/followers","following_url":"https://api.github.com/users/shihjay2/following{/other_user}","gists_url":"https://api.github.com/users/shihjay2/gists{/gist_id}","starred_url":"https://api.github.com/users/shihjay2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shihjay2/subscriptions","organizations_url":"https://api.github.com/users/shihjay2/orgs","repos_url":"https://api.github.com/users/shihjay2/repos","events_url":"https://api.github.com/users/shihjay2/events{/privacy}","received_events_url":"https://api.github.com/users/shihjay2/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-23T07:20:16Z","updated_at":"2016-01-23T08:19:54Z","closed_at":null,"body":"RPT endpoint returns \"needs_info\" error despite successfully getting an AAT, permissions ticket, and \"claims_submitted\" response from RQP claims endpoint (used external login).  The RPT endpoint was called with the AAT and permissions ticket immediatly after the RQP claims endpoint.  I've verified that the email address entered in the external login is identical to that which was declared as a required claim (\"email\") for various policies and scopes as shown below.\r\n\r\nBelow is the response:\r\n\r\n<code>{\"error\":\"need_info\",\"error_details\":{\"requesting_party_claims\":{\"redirect_user\":true,\"ticket\":\"16c087ed-3017-45b2-8198-2cde489d05f5\",\"required_claims\":[{\"name\":\"email_verified\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email_verified\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"sub\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"sub\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email_verified\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email_verified\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email_verified\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"sub\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"sub\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"sub\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]},{\"name\":\"email\",\"friendly_name\":null,\"claim_type\":null,\"claim_token_format\":[],\"issuer\":[]}]}}}</code>\r\n\r\nBelow is the ../api/resourceset/1 as an example:\r\n\r\n<code>{\"id\":1,\"name\":\"Patient\",\"uri\":null,\"type\":null,\"scopes\":[\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?identifier\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Medication\",\"http://uma.noshchartingsystem.com/nosh/fhir/Practitioner\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient/1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?_id\\u003d1\"],\"iconUri\":\"https://noshchartingsystem.com/i-patient.png\",\"owner\":\"noshtest\",\"clientId\":\"64945dfa-a856-4880-b9c6-e4196629ed3b\",\"policies\":[{\"id\":1,\"name\":null,\"claimsRequired\":[{\"id\":1,\"name\":\"email\",\"friendlyName\":null,\"claimType\":null,\"value\":\"shihjay2@noshchartingsystem.com\",\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":2,\"name\":\"email_verified\",\"friendlyName\":null,\"claimType\":null,\"value\":1,\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":3,\"name\":\"sub\",\"friendlyName\":null,\"claimType\":null,\"value\":\"d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35\",\"claimTokenFormat\":[],\"issuer\":[]}],\"scopes\":[\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?identifier\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Medication\",\"http://uma.noshchartingsystem.com/nosh/fhir/Practitioner\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?_id\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient/1\"]},{\"id\":2,\"name\":null,\"claimsRequired\":[{\"id\":4,\"name\":\"email\",\"friendlyName\":null,\"claimType\":null,\"value\":\"shihjay2@noshchartingsystem.com\",\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":5,\"name\":\"email_verified\",\"friendlyName\":null,\"claimType\":null,\"value\":1,\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":6,\"name\":\"sub\",\"friendlyName\":null,\"claimType\":null,\"value\":\"d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35\",\"claimTokenFormat\":[],\"issuer\":[]}],\"scopes\":[\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?identifier\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Medication\",\"http://uma.noshchartingsystem.com/nosh/fhir/Practitioner\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?_id\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient/1\"]},{\"id\":3,\"name\":null,\"claimsRequired\":[{\"id\":7,\"name\":\"email\",\"friendlyName\":null,\"claimType\":null,\"value\":\"shihjay2@noshchartingsystem.com\",\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":8,\"name\":\"email_verified\",\"friendlyName\":null,\"claimType\":null,\"value\":1,\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":9,\"name\":\"sub\",\"friendlyName\":null,\"claimType\":null,\"value\":\"d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35\",\"claimTokenFormat\":[],\"issuer\":[]}],\"scopes\":[\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?identifier\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Medication\",\"http://uma.noshchartingsystem.com/nosh/fhir/Practitioner\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?_id\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient/1\"]},{\"id\":4,\"name\":null,\"claimsRequired\":[{\"id\":10,\"name\":\"email\",\"friendlyName\":null,\"claimType\":null,\"value\":\"shihjay2@noshchartingsystem.com\",\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":11,\"name\":\"email_verified\",\"friendlyName\":null,\"claimType\":null,\"value\":1,\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":12,\"name\":\"sub\",\"friendlyName\":null,\"claimType\":null,\"value\":\"d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35\",\"claimTokenFormat\":[],\"issuer\":[]}],\"scopes\":[\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?identifier\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Medication\",\"http://uma.noshchartingsystem.com/nosh/fhir/Practitioner\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?_id\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient/1\"]},{\"id\":5,\"name\":null,\"claimsRequired\":[{\"id\":13,\"name\":\"email\",\"friendlyName\":null,\"claimType\":null,\"value\":\"shihjay2@noshchartingsystem.com\",\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":14,\"name\":\"email_verified\",\"friendlyName\":null,\"claimType\":null,\"value\":1,\"claimTokenFormat\":[],\"issuer\":[]},{\"id\":15,\"name\":\"sub\",\"friendlyName\":null,\"claimType\":null,\"value\":\"d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35\",\"claimTokenFormat\":[],\"issuer\":[]}],\"scopes\":[\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?identifier\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Medication\",\"http://uma.noshchartingsystem.com/nosh/fhir/Practitioner\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient?_id\\u003d1\",\"http://uma.noshchartingsystem.com/nosh/fhir/Patient/1\"]}]}</code>"},"comment":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/comments/174160463","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1006#issuecomment-174160463","issue_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1006","id":174160463,"user":{"login":"jricher","id":122511,"avatar_url":"https://avatars.githubusercontent.com/u/122511?v=3","gravatar_id":"","url":"https://api.github.com/users/jricher","html_url":"https://github.com/jricher","followers_url":"https://api.github.com/users/jricher/followers","following_url":"https://api.github.com/users/jricher/following{/other_user}","gists_url":"https://api.github.com/users/jricher/gists{/gist_id}","starred_url":"https://api.github.com/users/jricher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jricher/subscriptions","organizations_url":"https://api.github.com/users/jricher/orgs","repos_url":"https://api.github.com/users/jricher/repos","events_url":"https://api.github.com/users/jricher/events{/privacy}","received_events_url":"https://api.github.com/users/jricher/received_events","type":"User","site_admin":false},"created_at":"2016-01-23T08:19:54Z","updated_at":"2016-01-23T08:19:54Z","body":"Your required claims don't have an issuer, I doubt the matcher is going to work like that. Or are you using a custom matcher? \n\nHow did you get the policy set up? The ui should only allow for entering an email address on a domain that's hosting an oidc server. Did you change that? "}}