Bug Report: Discrepancy of JTI claim between code and spec

[tdevfeeds]

Brief Summary

The JTI claim is not required in the Oauth2 spec, nor the MP JWT Auth spec (https://github.com/eclipse/microprofile-jwt-auth/blob/main/spec/src/main/asciidoc/interoperability.asciidoc). The latter states it is "recommended". This is preventing JWT verification with Oauth2 IDPs like Microsoft Entra who does NOT send the JTI claim and instead uses a "nonce" claim. Is the desired behavior to require JTI claim, or is this a bug?

Edit
Sorry, thought GitHub would reference the line of code in question. Adding it here.

Payara/appserver/payara-appserver-modules/microprofile/jwt-auth/src/main/java/fish/payara/microprofile/jwtauth/jwt/JwtTokenParser.java

Line 94 in 7680990

private final List<Claims> requiredClaims = asList(iss, sub, exp, iat, jti);

Expected Outcome

Code matches spec.

Current Outcome

JWT fails validation due to missing JTI claim.

Reproducer

Any JWT without JTI claim.

Operating System

NA

JDK Version

NA

Payara Distribution

Payara Micro

[shub8968]

Duplicate of #5791

[github-actions]

Greetings,
It's been more than 5 days since we requested more information or an update from you on the details of this issue. Could you provide an update soon, please?
We're afraid that if we do not receive an update, we'll have to close this issue due to inactivity.

[fturizo]

Since this issue is a duplicate of #5791, which is not a valid bug report for the Payara Platform, we're marking this as closed. @tdevfeeds, please follow the suggestion on #5791 and raise this issue directly with the MicroProfile JWT Working group to get a solution.