#6132 feature: add ability to match any audience via '*' Pull request opened by tvanhens ## Why are the changes needed? This change unblocks using Amazon Cognito as an external auth provider. Amazon Cognito does not include the

aud

claim in access tokens as it optional in the spec. It is possible to add an audience for user-flow tokens via a pre-token-generation lambda., however, machine-to-machine tokens generated with the

client_credentials

flow do not trigger the pre-token-generation lambda. This change allows operators to opt into making the audience claim optional by specifying

*

for the

allowedAudience

configuration. ## What changes were proposed in this pull request? The ability to specify

*

for

allowedAudience

to allow any

aud

claim or missing

aud

claim. ## How was this patch tested? Unit tests in

claims_verifier_test.go

### Summary by Bito Implementation of wildcard audience matching in authentication system, enabling '*' as a valid audience configuration. The changes enhance claims verification to support any audience claim or missing audience when '*' is configured. This update facilitates Amazon Cognito integration and includes configuration documentation updates. Unit tests added: False Estimated effort to review (1-5, lower is better): 1 flyteorg/flyte