JWT with multiple aud values causes authentication error

[milesokeefe]

I have configured a virtual proxy in my Qlik Sense Enterprise for Windows instance with JWT authentication.

The JWT I am providing in the Authorization header is generated by Auth0, and as such has two values for audience:

"aud": [
  "https://myapp.com",
  "https://anna-development.auth0.com/userinfo"
],

I have the expected aud value in the virtual proxy set to "https://myapp.com".

When attempting to authenticate with this JWT, Qlik logs this error:

Audit.Proxy.Proxy.SessionEstablishment.Authentication.JWT.JwtAuthenticationHandler [...] JWT contains aud claim with invalid value: System.Collections.ArrayList [..]

An array is a valid value for the aud field in a JWT.

Qlik's documentation even references this here (note that recipients is plural):

• Audience (aud😞 Identifies the recipients of the token.