Noooo, you have to override 50% of the class methods to hard couple your filter's implementation to an event-bus-style bean with Spring in the package name to avoid NIH! What if someone needs to extend your Authentication Provider in the future but can only use a limited quota of keystrokes to implement their ticket as an inobvious side-effect? How else will they add the aud from your JWT to the MDC? Some kind of pointcut??