OIDC: this user can't understand how to generate sub claim

[Cantor, Scott]

You have both the separate subject-public/pairwise *and* subject definitions enabled, you can't do that. Pick one approach. This is explained in the comments in the file and why they're different approaches.

Secondly, all evidence I can see is that the filter is probably throwing everything away, but I can't be sure. The filter is generally louder than that. My guess is none of the policies are applying, so it throws them all out.

-- Scott