Validate the aud claim in OAuth2 resource server

[ahmedmq]

Configure a new optional property for audience in resource server. Validate the audience claim in JWT if the audience property is provided.

Closes #28427

[chenrujun]

Consider the spring-cloud-gateway scenario, I suggest to use List<String> instead of String.

client -> spring-cloud-gateway -> resource-server-1
                               -> resource-server-2
                               -> etc..

When spring-cloud-gateway validate the access-token, the valid audience is a list of string.

[chenrujun]

And rename variable from audience to audiences.

[wilkinsona]

Thanks, @chenrujun. This makes sense to me. The validation should then use a predicate that checks that at least one audience in the JWT matches one of the configured audiences. Does that makes sense to you, @mbhave?

[fstorz]

The changes in this PR only apply the audience validation if decoder is configured via "jwk-set-uri". Would it make sense to also provide this feature when decoder is configured via "issuer-uri"?

[snicoll]

@ahmedmq thank you for making your first contribution to Spring Boot.

[mrodal]

This feature is not mentioned in the docs, in fact audience validation is shown as an example for custom validators:

https://docs.spring.io/spring-security/reference/servlet/oauth2/resource-server/jwt.html#oauth2resourceserver-jwt-validation-custom

This feature should be in the docs

[snicoll]

@mrodal thanks for the nudge. Going forward, rather than commenting on a closed PR, please create an issue to request a change in the documentation. I've done that in #34848.

[mrodal]

got it, thanks!