parts := strings.Split(sa.Sub, ":")
	ns := parts[2]
	ksa := parts[3]
	if !checkAudience(sa.Aud, j.audiences) {
		return nil, fmt.Errorf("invalid audiences %v", sa.Aud)
	}
	return &security.Caller{
		AuthSource: security.AuthSourceIDToken,
		Identities: []string{spiffe.MustGenSpiffeURI(j.meshHolder.Mesh(), ns, ksa)},
	}, nil
}

// checkAudience() returns true if the audiences to check are in

			expectRet:   true,
			audToCheck:  []string{"aud1", "aud3"},
			audExpected: []string{"aud1", "aud2"},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			ret := checkAudience(tt.audToCheck, tt.audExpected)
			if ret != tt.expectRet {
				t.Errorf("expected return is %v while actual return is %v", tt.expectRet, ret)
			}
		})
	}
}

func TestOIDCAuthenticate(t *testing.T) {