Audience matching doesn't work as intended

Describe the bug Audience matching doesn't work as intended

This rule https://github.com/panva/node-openid-client/blob/219f956cb74986439f2d41fc3cfe6fd400c38eca/lib/client.js#L1006-L1011 only matches against client_id but if audience is specified on the client and IdP is configured with that it should validate OK with that also. If no specified audience then client_id is used as default.

To Reproduce Issuer and Client configuration: (inline or gist) - Don't forget to redact your secrets.

Issuer.discover('http://localhost:48118/token/internal/anonymous/.well-known/openid-configuration')
  .then(criiptoIssuer => {
    var client = new criiptoIssuer.Client({
      client_id: '2fa-client-test',
      client_secret: '2fa-client-test',
      redirect_uris: ['http://localhost:3000/auth/callback'],
    });

    app.use(
      expressSesssion({
        secret: 'keyboard cat',
        resave: false,
        saveUninitialized: true
      })
    );

    app.use(passport.initialize());
    app.use(passport.session());

    passport.use('oidc', new Strategy({
      client,
      params: {
        scope: "openid groups profile",
        audience: "urn:myorg:camper",
      }
    }, (tokenSet, userinfo, done) => {
      return done(null, tokenSet.claims());
    })
    );
});

Getting this error: {"message":"Auth failed: aud mismatch, expected 2fa-client-test, got: urn:myorg:camper"}

Expected behaviour See description above

Environment:

openid-client version: 5.6.5
node version: v18.18.2

panva / openid-client

Audience matching doesn't work as intended #673