That’s a very common one:

public static IClaimsPrincipal ToClaimsPrincipal(
  this SecurityToken token, X509Certificate2 signingCertificate)
{
    var configuration = CreateStandardConfiguration(signingCertificate);
    return token.ToClaimsPrincipal(configuration.CreateDefaultHandlerCollection());
}

public static IClaimsPrincipal ToClaimsPrincipal(this SecurityToken token, 
  X509Certificate2 signingCertificate, string audienceUri)
{
    var configuration = CreateStandardConfiguration(signingCertificate);
 
    configuration.AudienceRestriction.AudienceMode = AudienceUriMode.Always;
    configuration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(audienceUri));
 
    return token.ToClaimsPrincipal(configuration.CreateDefaultHandlerCollection());
}

public static IClaimsPrincipal ToClaimsPrincipal(
  this SecurityToken token, SecurityTokenHandlerCollection handler)
{
    var ids = handler.ValidateToken(token);
    return ClaimsPrincipal.CreateFromIdentities(ids);
}

private static SecurityTokenHandlerConfiguration CreateStandardConfiguration(
  X509Certificate2 signingCertificate)

    configuration.AudienceRestriction.AudienceMode = AudienceUriMode.Never;
    configuration.IssuerNameRegistry = signingCertificate.CreateIssuerNameRegistry();
    configuration.IssuerTokenResolver = signingCertificate.CreateSecurityTokenResolver();
    configuration.SaveBootstrapTokens = true;

    return configuration;
}

private static IssuerNameRegistry CreateIssuerNameRegistry(this X509Certificate2 certificate)
{
    var registry = new ConfigurationBasedIssuerNameRegistry();
    registry.AddTrustedIssuer(certificate.Thumbprint, certificate.Subject);
 
    return registry;
}

private static SecurityTokenResolver CreateSecurityTokenResolver(
  this X509Certificate2 certificate)
{
    var tokens = new List<SecurityToken>
    {
        new X509SecurityToken(certificate)
    };
 
    return SecurityTokenResolver.CreateDefaultSecurityTokenResolver(tokens.AsReadOnly(), true);
}

private static SecurityTokenHandlerCollection CreateDefaultHandlerCollection(
  this SecurityTokenHandlerConfiguration configuration)
{
    return 
      SecurityTokenHandlerCollection.CreateDefaultSecurityTokenHandlerCollection(configuration);
}