We have some credentials stored in the secure store service application. Both the secure store service and the credential itself have permissions for the web app pool account.
When I try to use a webpart that reads the connection string from the secure store I get this error:
ValidateCredentialClaims - Access Denied: Claims stored in the credentials did not match with the group claim for a group app. The problem is that this was working before, it just suddenly stopped working because we have not changed the configuration on this service.