{"record":{"id":"c69a37d8426a8718","repo":"quarkusio/quarkus","slug":"credentials-jwt-source-is-set-to-spiffe-jwt-b","errorCode":null,"errorMessage":"'credentials.jwt.source' is set to 'spiffe-jwt', but no audience is available. Either set 'credentials.jwt.audience' or 'auth-server-url'","messagePattern":"'credentials\\.jwt\\.source' is set to 'spiffe-jwt', but no audience is available\\. Either set 'credentials\\.jwt\\.audience' or 'auth-server-url'","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":1010,"sourceCode":"            Credentials credentialsConfig, Optional<String> authServerUrl) {\n        var jwtConfig = credentialsConfig.jwt();\n        if (jwtConfig.source() != Source.CLIENT && jwtConfig.tokenPath().isPresent()) {\n            var clientAssertionProvider = new KubernetesServiceClientAssertionProvider(vertx, jwtConfig.tokenPath().get(),\n                    jwtConfig.source());\n            if (clientAssertionProvider.getAvailableClientAssertion() == null) {\n                LOG.warnf(\"Cannot find a valid %s token at path: %s, deferring token loading to request time\",\n                        jwtConfig.source() == Source.SPIFFE_JWT ? \"SPIFFE JWT-SVID\" : \"JWT bearer\",\n                        jwtConfig.tokenPath().get());\n            }\n            return clientAssertionProvider;\n        } else if (jwtConfig.source() == Source.SPIFFE_JWT) {\n            var audience = jwtConfig.audience().or(() -> authServerUrl).orElseThrow(\n                    () -> new ConfigurationException(\n                            \"'credentials.jwt.source' is set to 'spiffe-jwt', but no audience is available.\"\n                                    + \" Either set 'credentials.jwt.audience' or 'auth-server-url'\"));\n            var clientAssertionProvider = SpiffeClientAssertionProvider.forAudience(vertx, audience);\n            if (clientAssertionProvider == null) {\n                throw new ConfigurationException(\n                        \"'credentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available.\"\n                                + \" Either set 'credentials.jwt.token-path' to a file containing the JWT-SVID,\"\n                                + \" or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs\"\n                                + \" from the SPIFFE Workload API\");\n            }\n            return clientAssertionProvider;\n        }\n        return null;\n    }\n\n    public static Object getClientAssertionTokenType(Source source) {\n        return switch (source) {\n            case BEARER, CLIENT -> \"JWT bearer\";\n            case SPIFFE_JWT -> \"SPIFFE JWT-SVID\";\n        };\n    }\n\n}","sourceCodeStart":992,"sourceCodeEnd":1028,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L992-L1028","documentation":"When JWT client credentials use source 'spiffe-jwt', an audience is required to build the SPIFFE client assertion. Quarkus falls back to the auth-server-url as audience; if neither credentials.jwt.audience nor auth-server-url is set, it throws a ConfigurationException.","triggerScenarios":"quarkus.oidc-client.credentials.jwt.source=spiffe-jwt configured without credentials.jwt.audience and without an auth-server-url in the same configuration, evaluated when building the client assertion provider.","commonSituations":"Enabling SPIFFE workload identity in a service that uses manual endpoint configuration (discovery-enabled=false) without auth-server-url, forgetting the audience property; copying SPIFFE config between projects that dropped the audience.","solutions":["Set quarkus.oidc-client.credentials.jwt.audience=<expected audience of the JWT-SVID>","Or configure quarkus.oidc-client.auth-server-url so it can be used as the audience","If neither is desired, confirm spiffe-jwt is the intended source; switch to a different jwt.source","Also verify the SPIFFE provider availability: set credentials.jwt.token-path or add the quarkus-spiffe-client extension (a related follow-up error otherwise)"],"exampleFix":"// before\nquarkus.oidc-client.credentials.jwt.source=spiffe-jwt\n// after\nquarkus.oidc-client.credentials.jwt.source=spiffe-jwt\nquarkus.oidc-client.credentials.jwt.audience=https://idp.example.com","handlingStrategy":"validation","validationCode":"var cfg = ConfigProvider.getConfig();\nif (\"spiffe-jwt\".equals(cfg.getOptionalValue(\"quarkus.oidc-client.credentials.jwt.source\", String.class).orElse(\"\"))\n    && cfg.getOptionalValue(\"quarkus.oidc-client.credentials.jwt.audience\", String.class).isEmpty()\n    && cfg.getOptionalValue(\"quarkus.oidc-client.auth-server-url\", String.class).isEmpty()) {\n    throw new IllegalStateException(\"spiffe-jwt requires credentials.jwt.audience or auth-server-url\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When enabling SPIFFE JWT sources, always set credentials.jwt.audience explicitly","Keep auth-server-url configured even with discovery disabled","Document SPIFFE prerequisites: token-path or quarkus-spiffe-client extension"],"tags":["oidc","config","spiffe","jwt"],"backgroundTag":"missing-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}