},
		{
			name: "requiredValue set when expression is set",
			in: []api.ClaimValidationRule{
				{Expression: "claims.foo == 'bar'", RequiredValue: "value"},
			},
			structuredAuthnFeatureEnabled: true,
			want:                          `issuer.claimValidationRules[0].requiredValue: Invalid value: "value": requiredValue can't be set when expression is set`,
		},
		{

      oneOf:
      - {}
      pattern: patternValue
      patternProperties:
        patternPropertiesKey: {}
      properties:
        propertiesKey: {}
      required:
      - requiredValue
      title: titleValue
      type: typeValue
      uniqueItems: true
      x-kubernetes-embedded-resource: true
      x-kubernetes-int-or-string: true
      x-kubernetes-list-map-keys:

        "uniqueItems": true,
        "multipleOf": 19.5,
        "enum": [
          "enumValue"
        ],
        "maxProperties": 21,
        "minProperties": 22,
        "required": [
          "requiredValue"
        ],
        "items": [
          {}
        ],
        "allOf": [
          {}
        ],
        "oneOf": [
          {}
        ],
        "anyOf": [
          {}
        ],

            "multipleOf": 19.5,
            "enum": [
              "enumValue"
            ],
            "maxProperties": 21,
            "minProperties": 22,
            "required": [
              "requiredValue"
            ],
            "items": [
              {}
            ],
            "allOf": [
              {}
            ],
            "oneOf": [
              {}
            ],

	Claim string `json:"claim,omitempty"`
	// requiredValue is the value of a required claim.
	// Same as --oidc-required-claim flag.
	// Only string claim values are supported.
	// If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string.
	// Mutually exclusive with expression and message.
	// +optional
	RequiredValue string `json:"requiredValue,omitempty"`

        oneOf:
        - {}
        pattern: patternValue
        patternProperties:
          patternPropertiesKey: {}
        properties:
          propertiesKey: {}
        required:
        - requiredValue
        title: titleValue
        type: typeValue
        uniqueItems: true
        x-kubernetes-embedded-resource: true
        x-kubernetes-int-or-string: true
        x-kubernetes-list-map-keys:

	Claim string `json:"claim,omitempty"`
	// requiredValue is the value of a required claim.
	// Same as --oidc-required-claim flag.
	// Only string claim values are supported.
	// If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string.
	// Mutually exclusive with expression and message.
	// +optional
	RequiredValue string `json:"requiredValue,omitempty"`

									Claim:  "sub",
									Prefix: pointer.String(""),
								},
							},
							ClaimValidationRules: []apiserver.ClaimValidationRule{
								{
									Claim:         "foo",
									RequiredValue: "bar",
								},
							},
						},
					},
				},
				OIDCSigningAlgs: []string{"RS256"},
			},
		},
		{
			name: "--oidc-username-prefix is empty, --oidc-username-claim is not email",

}

func autoConvert_v1alpha1_ClaimValidationRule_To_apiserver_ClaimValidationRule(in *ClaimValidationRule, out *apiserver.ClaimValidationRule, s conversion.Scope) error {
	out.Claim = in.Claim
	out.RequiredValue = in.RequiredValue
	out.Expression = in.Expression
	out.Message = in.Message
	return nil
}

// Convert_v1alpha1_ClaimValidationRule_To_apiserver_ClaimValidationRule is an autogenerated conversion function.

			}
			seenClaims.Insert(rule.Claim)
		case len(rule.Expression) > 0:
			if len(rule.RequiredValue) > 0 {
				allErrs = append(allErrs, field.Invalid(fldPath.Child("requiredValue"), rule.RequiredValue, "requiredValue can't be set when expression is set"))
			}
			if seenExpressions.Has(rule.Expression) {