matchSub = matchAny
			}
		default:
			matchSub = matcher.StringMatcherExact(sub, false)
			matchIss = matcher.StringMatcherExact(iss, false)
		}
		im := MetadataStringMatcherForJWTClaim("iss", matchIss)
		sm := MetadataStringMatcherForJWTClaim("sub", matchSub)
		or = append(or, principalAnd([]*rbacpb.Principal{principalMetadata(im), principalMetadata(sm)}))
	}
	if len(or) == 1 {
		return or[0], nil