{"record":{"id":"b99bf82b7fb2b2dd","repo":"quarkusio/quarkus","slug":"no-default-audiences-configured-via-quarkus-spiff","errorCode":null,"errorMessage":"No default audiences configured via 'quarkus.spiffe-client.audiences'; either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience","messagePattern":"No default audiences configured via 'quarkus\\.spiffe-client\\.audiences'; either configure default audiences or use getWorkloadJsonWebToken\\(String\\) with an explicit audience","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":137,"sourceCode":"                                        }\n                                    })\n                                    .endHandler(v -> {\n                                        GrpcStatus status = grpcResponse.status();\n                                        if (status != null && status != GrpcStatus.OK) {\n                                            emitter.fail(mapGrpcError(status, grpcResponse.statusMessage()));\n                                        } else {\n                                            // this should be NO-OP if the message arrived\n                                            emitter.fail(new SpiffeConnectionException(\n                                                    \"X.509-SVID stream ended without sending any message\"));\n                                        }\n                                    }));\n                }));\n    }\n\n    @Override\n    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken() {\n        if (defaultAudiences == null) {\n            throw new IllegalStateException(\n                    \"No default audiences configured via 'quarkus.spiffe-client.audiences'; \"\n                            + \"either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience\");\n        }\n        return fetchWorkloadJsonWebTokens(defaultAudiences).toUni();\n    }\n\n    @Override\n    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(String audience) {\n        validateAudience(audience);\n        return fetchWorkloadJsonWebTokens(Set.of(audience)).toUni();\n    }\n\n    @Override\n    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(Set<String> audiences) {\n        if (audiences == null) {\n            throw new IllegalArgumentException(\"Audiences must not be null\");\n        }\n        if (audiences.isEmpty()) {","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L119-L155","documentation":"SpiffeClientImpl.getWorkloadJsonWebToken() (no-arg) fetches a SPIFFE JWT-SVID for the audiences configured via quarkus.spiffe-client.audiences. If no default audiences were configured (defaultAudiences == null), it throws IllegalStateException: the SPIFFE Workload API requires at least one audience for JWT-SVID requests.","triggerScenarios":"Injecting/using SpiffeClient and calling getWorkloadJsonWebToken() while quarkus.spiffe-client.audiences is not set in configuration (or set empty such that defaultAudiences resolves to null).","commonSituations":"Apps that only ever call the explicit-argument overload forgetting to configure defaults; configuration keys renamed/typo'd so audiences never load; reusing a SpiffeClient bean across services where each service needs distinct audiences.","solutions":["Configure default audiences: quarkus.spiffe-client.audiences=<audience1>,<audience2> in application.properties.","Alternatively call getWorkloadJsonWebToken(String audience) or getWorkloadJsonWebToken(Set<String> audiences) with explicit audiences at each call site.","If the audiences are genuinely dynamic, guard the no-arg call with a null/config check and fall back to the explicit overload."],"exampleFix":"// before\nUni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken();\n\n// after (explicit audience)\nUni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken(\"https://vault.example.com\");\n// or configure:\n// quarkus.spiffe-client.audiences=https://vault.example.com","handlingStrategy":"validation","validationCode":"// application.properties must contain:\n// quarkus.spiffe-client.audiences=<at least one audience>\n// or guard at the call site:\nif (defaultAudiences == null) {\n    return spiffeClient.getWorkloadJsonWebToken(explicitAudience);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return spiffeClient.getWorkloadJsonWebToken();\n} catch (IllegalStateException e) {\n    LOG.warn(\"No default audiences configured; falling back to explicit audience\");\n    return spiffeClient.getWorkloadJsonWebToken(\"https://default.example.com\");\n}","preventionTips":["Always set quarkus.spiffe-client.audiences when using the no-arg API","Prefer the explicit-argument overloads when audiences vary per call site","Verify config keys are not renamed/typo'd — missing keys load as null silently"],"tags":["quarkus","spiffe","jwt-svid","configuration","audiences"],"backgroundTag":"missing-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}