How to check for specific audience occurence?

[pietzschke]

With auth_jwt_validate_aud you can validate for a specific value in the aud claim. But how to match against a set of audiences? E.g.: aud in token: aud1@example.com. Configured allowed audiences: aud1@example.com,aud2@example.com

It's false because aud2@example.com does not occur in the string. Any chance to delimit the string and check against one of the values?

[kjdev]

Multiple permit values are not supported and will be corrected

[pietzschke]

Can the function "auth_jwt_require_claim" used to verify the audience?

[kjdev]

auth_jwt_require_claim could handle this.

set $expected '"test1.audience.example.com"';
auth_jwt_require_claim aud eq $expected;

for arrays

set $expected '["test10.audience.example.com"]';
auth_jwt_require_claim aud intersect $expected;

# PAYLOAD:DATA
#  "aud": [
#    "test10.audience.example.com",
#    "test10.audience.test.com"
#  ]

[pietzschke]

Thanks!