prestodb/presto · error · ParseException

Invalid audience in /userinfo response

Error message

Invalid audience in /userinfo response

What it means

Parsing of the /userinfo response found an 'aud' (audience) claim that does not contain the expected audience value for this Presto deployment, so the response is rejected as not intended for this client. Validation runs only when an aud claim is present.

Source

Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/NimbusOAuth2Client.java:625

        // only validate aud claim if it exists
        if (audClaim != null) {
            List<String> audiences;

            if (audClaim instanceof String) {
                audiences = List.of((String) audClaim);
            }
            else if (audClaim instanceof List<?>) {
                audiences = ((List<?>) audClaim).stream()
                        .filter(String.class::isInstance)
                        .map(String.class::cast)
                        .collect(toImmutableList());
            }
            else {
                throw new ParseException("Unsupported 'aud' claim type in /userinfo response");
            }

            if (!audiences.contains(clientId.getValue()) && Collections.disjoint(audiences, accessTokenAudiences)) {
                throw new ParseException("Invalid audience in /userinfo response");
            }
        }

        return UserInfoSuccessResponse.parse(httpResponse);
    }

    private Optional<JWTClaimsSet> parseAccessToken(String accessToken)
    {
        try {
            return Optional.of(accessTokenProcessor.process(accessToken, null));
        }
        catch (java.text.ParseException | BadJOSEException | JOSEException e) {
            LOG.debug(e, "Failed to parse JWT access token");
            return Optional.empty();
        }
    }

    private static Instant determineExpiration(Optional<Instant> validUntil, Date expiration)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Configure the IdP so the UserInfo audience includes the audience expected by Presto (oauth2-client audience settings)
2. Or relax/align the expected audience configuration on the Presto side

When it happens

Trigger: Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/NimbusOAuth2Client.java:625 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/60d623be6046ac39. Report an issue: GitHub.