boolean validateAudiences(SignedJWT jwtToken) {
    boolean valid = false;
    try {
      List<String> tokenAudienceList = jwtToken.getJWTClaimsSet().getAudience();
      JwtAuthenticationProperties jwtProperties = propertiesProvider.get();
      List<String> audiences = (jwtProperties == null) ? null : jwtProperties.getAudiences();

      // if there were no expected audiences configured then just
      // consider any audience acceptable
      if (audiences == null) {
        valid = true;
      } else {
        // if any of the configured audiences is found then consider it
        // acceptable
        if (tokenAudienceList == null) {
          LOG.warn("JWT token has no audiences, validation failed.");
          return false;
        }
        LOG.info("Audience List: {}", audiences);
        for (String aud : tokenAudienceList) {
          LOG.info("Found audience: {}", aud);
          if (audiences.contains(aud)) {
            LOG.debug("JWT token audience has been successfully validated");
            valid = true;
            break;
          }
        }
        if (!valid) {
          LOG.warn("JWT audience validation failed.");
        }
      }
    } catch (ParseException pe) {
      LOG.warn("Unable to parse the JWT token.", pe);
    }
    return valid;
  }
Validate whether any of the accepted audience claims is present in the
issued token claims list for audience. Override this method in subclasses
in order to customize the audience validation behavior.

@param jwtToken the JWT token where the allowed audiences will be found
@return true if an expected audience is present, otherwise false
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/jwt/AmbariJwtAuthenticationFilter.java