Source:
private ConfigurableJWTProcessor<SecurityContext> getValidator(JWSAlgorithm jwsAlgorithm) { final ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>(); final JWSKeySelector<SecurityContext> keySelector = new JWSVerificationKeySelector<>(jwsAlgorithm, keySource); jwtProcessor.setJWSKeySelector(keySelector); jwtProcessor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<SecurityContext>() { @Override public void verify(JWTClaimsSet claimsSet, SecurityContext ctx) throws BadJWTException{ super.verify(claimsSet, ctx); final String issuer = claimsSet.getIssuer(); final String tenant = (String)claimsSet.getClaim(AADTokenClaim.TID); if (!isAADIssuer(issuer)) { throw new BadJWTException("Invalid token issuer"); } if (explicitAudienceCheck) { Optional<String> matchedAudience = claimsSet.getAudience() .stream() .filter(validAudiences::contains) .findFirst(); if (matchedAudience.isPresent()) { LOGGER.debug("Matched audience: [{}]", matchedAudience.get()); } else { throw new BadJWTException( "Invalid token audience. Provided value " + claimsSet.getAudience() + "does not match neither client-id nor AppIdUri."); } } if (aadAuthenticationProperties.getAllowedTenantIds().isEmpty() && !StringUtils.isEmpty(aadAuthenticationProperties.getTenantId()) && !isAADTenant(tenant)) { throw new BadJWTException("Invalid token tenant. Provided value " + tenant + " does not match neither tenant."); } if(!aadAuthenticationProperties.getAllowedTenantIds().isEmpty() && !isAllowedTenantId(tenant)){ throw new BadJWTException("Invalid token tenantId. Provided value " + tenant + " does not allow multi-tenant id."); } } }); return jwtProcessor; }

Target:
private ConfigurableJWTProcessor<SecurityContext> getValidator(JWSAlgorithm jwsAlgorithm) { final ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>(); final JWSKeySelector<SecurityContext> keySelector = new JWSVerificationKeySelector<>(jwsAlgorithm, keySource); jwtProcessor.setJWSKeySelector(keySelector); jwtProcessor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<SecurityContext>() { @Override public void verify(JWTClaimsSet claimsSet, SecurityContext ctx) throws BadJWTException { super.verify(claimsSet, ctx); final String issuer = claimsSet.getIssuer(); final String tenant = (String) claimsSet.getClaim(AADTokenClaim.TID); if (!isAADIssuer(issuer)) { throw new BadJWTException("Invalid token issuer"); } if (explicitAudienceCheck) { Optional<String> matchedAudience = claimsSet.getAudience() .stream() .filter(validAudiences::contains) .findFirst(); if (matchedAudience.isPresent()) { LOGGER.debug("Matched audience: [{}]", matchedAudience.get()); } else { throw new BadJWTException( "Invalid token audience. Provided value " + claimsSet.getAudience() + "does not match neither client-id nor AppIdUri."); } } if (aadAuthenticationProperties != null) { if (isEmptyAllowTenantIds() && !StringUtils .isEmpty(aadAuthenticationProperties.getTenantId()) && !isAllowedTenantId(tenant)) { throw new BadJWTException("Invalid token tenant. Provided value " + tenant + " does not match neither tenant."); } if (!isEmptyAllowTenantIds() && !isAllowedTenantId(tenant)) { throw new BadJWTException("Invalid token tenantId. Provided value " + tenant + " does not allow multi-tenant id."); } } } }); return jwtProcessor; }