Provide ability to customize claims in Jwt Client Assertion

[christophejan]

Currently spring security OAuth 2.0 client use provider details token uri as value for JWT aud claim of the assertion in OAuth 2.0 Client Authentication.

rfc 7523 say :

The token endpoint URL of the authorization server MAY be used as a value for an "aud" element to identify the authorization server as an intended audience of the JWT.

Rfc say may, not must. I would like to be able to use another value (I have to call a oauth 2 server that require a value different from the token url).

Current spring security behavior is provided by NimbusJwtClientAuthenticationParametersConverter. Overriding it’s behavior requires to copy/paste hundreds of lines as it’s a final class and it use many package-private classes.

Related gh-9208

[jgrandja]

@christophejan We are looking to merge gh-9208 for 5.6, which is needed before we can allow customization of the Jwt client assertion.