From 13c5c6efb14addd4c9f45aeb124bf54044d2526d Mon Sep 17 00:00:00 2001
From: Bikash Adhikari <77648128+bikash30851@users.noreply.github.com>
Date: Thu, 4 May 2023 11:46:57 -0500
Subject: [PATCH] Document audience support in Oauth2 resource server

See gh-35286
---
 .../src/docs/asciidoc/web/spring-security.adoc    | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/spring-boot-project/spring-boot-docs/src/docs/asciidoc/web/spring-security.adoc b/spring-boot-project/spring-boot-docs/src/docs/asciidoc/web/spring-security.adoc
index c544282a03..5ec07d7b03 100644
--- a/spring-boot-project/spring-boot-docs/src/docs/asciidoc/web/spring-security.adoc
+++ b/spring-boot-project/spring-boot-docs/src/docs/asciidoc/web/spring-security.adoc
@@ -223,7 +223,22 @@ Again, the same properties are applicable for both servlet and reactive applicat
 
 Alternatively, you can define your own `OpaqueTokenIntrospector` bean for servlet applications or a `ReactiveOpaqueTokenIntrospector` for reactive applications.
 
+To enable audience validation, set the `configprop:spring.security.oauth2.resourceserver.jwt.audiences[]` property in your Spring Boot application
+configuration file. This property specifies the expected value(s) of the aud claim in JWTs.
 
+For example, to expect the JWTs to contain an aud claim with the value `my-audience`, you can add the following line to your 
+application.properties file:
+
+[source,yaml,indent=0,subs="verbatim",configprops,configblocks]
+----
+	spring:
+	  security:
+	    oauth2:
+	      resourceserver:
+	        jwt:
+	          audiences:
+	            - "my-audience"
+----
 
 [[web.security.oauth2.authorization-server]]
 ==== Authorization Server