    @Test
    public void shouldFailToAuthenticateUsingJWKIfMissingAudienceClaim() throws Exception {

        Jwk jwk = mock(Jwk.class);
        JwkProvider jwkProvider = mock(JwkProvider.class);

        KeyPair keyPair = RSAKeyPair();
        when(jwkProvider.get(eq("key-id"))).thenReturn(jwk);
        when(jwk.getPublicKey()).thenReturn(keyPair.getPublic());
        JwtAuthenticationProvider provider = new JwtAuthenticationProvider(jwkProvider, "test-issuer", "test-audience");
        Map<String, Object> keyIdHeader = Collections.singletonMap("kid", (Object) "key-id");
        String token = JWT.create()
                .withIssuer("test-issuer")
                .withHeader(keyIdHeader)
                .sign(Algorithm.RSA256(null, (RSAPrivateKey) keyPair.getPrivate()));

        Authentication authentication = PreAuthenticatedAuthenticationJsonWebToken.usingToken(token);

        exception.expect(BadCredentialsException.class);
        exception.expectMessage("Not a valid token");
        exception.expectCause(Matchers.<Throwable>instanceOf(InvalidClaimException.class));
        provider.authenticate(authentication);
    }