SecurityTokenDescriptor Audience is a string, but is should be an array of strings.

[nikosft]

The Audience property of the SecurityTokenDescriptor is of type String. However it should by an array.

Copying pasting from rfc7519 section-4.1

in the general case, the "aud" value is an array of case sensitive strings, each containing a StringOrURI value. In the special case when the JWT has one audience, the "aud" value MAY be a single case-sensitive string containing a StringOrURI value

[brentschmaltz]

@nikosft yep, we will have to add an API similar to TokenValidationParameters.ValidAudiences as we want to avoid breaking changes.

[jmprieur]

Design:

• Add a new property named "Audiences" of type IList
• process it in the token creation.