quarkusio/quarkus · error · IllegalArgumentException

Audience must not be null

Error message

Audience must not be null

What it means

Requesting a SPIFFE Workload API JWT-SVID requires an audience string that identifies the intended consumers of the token. The library validates the audience argument up front and throws IllegalArgumentException when null is passed, because a JWT without audiences cannot be meaningfully scoped. This is a caller programming error, not a runtime/network issue.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:426

            return new SpiffeAuthorizationException(detail);
        }
        return new SpiffeConnectionException(detail);
    }

    private static SocketAddress toSocketAddress(URI uri) {
        if ("unix".equals(uri.getScheme())) {
            if (OS.WINDOWS.isCurrent()) {
                throw new ConfigurationException(
                        "The SPIFFE client extension does not support unix scheme on Windows, use tcp:// instead.");
            }
            return SocketAddress.domainSocketAddress(uri.getPath());
        }
        return SocketAddress.inetSocketAddress(uri.getPort(), uri.getHost());
    }

    private static void validateAudience(String audience) {
        if (audience == null) {
            throw new IllegalArgumentException("Audience must not be null");
        }
        if (audience.isBlank()) {
            throw new IllegalArgumentException("Audience must not be blank");
        }
        if (audience.indexOf(' ') >= 0) {
            throw new IllegalArgumentException("Audience must not contain spaces: '" + audience + "'");
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a concrete audience string, e.g. getWorkloadJsonWebToken("my-service", ...) as expected by the downstream validator.
2. Add the audience to configuration and read it with a default/failure: quarkus.spiffe.jwt.audience.
3. Null-check configuration values before calling and fail fast with a clear message.
4. Use Objects.requireNonNull(audience, ...) at your own API boundary to catch regressions in tests.

Example fix

// before
String token = client.getWorkloadJsonWebToken(config.audience(), ttl);
// after
String token = client.getWorkloadJsonWebToken(Objects.requireNonNull(config.audience(), "JWT audience must be configured"), ttl);

if (audience == null) {
    throw new IllegalArgumentException("JWT audience must be configured and non-null");
}

static boolean hasAudience(String audience) {
    return audience != null && !audience.isBlank();
}

try {
    String token = client.getWorkloadJsonWebToken(audience, ttl);
} catch (IllegalArgumentException e) {
    log.error("Audience parameter invalid: " + e.getMessage());
    throw new IllegalArgumentException("Provide a valid JWT audience", e);
}

When it happens

Trigger: Calling getWorkloadJsonWebToken(null, ...) or any API where the audience parameter is null, often because the value comes from unpopulated configuration (a missing config property resolved to null).

Common situations: Forgetting to set the JWT audience in application.properties; reading a config property that is absent and passing it through unchecked; refactoring call sites and dropping the argument.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Audience must not be blank
• Audience must not contain spaces: '${audience}'
• 'credentials.jwt.source' is set to 'spiffe-jwt', but no audi
• Audiences must not be null
• JWT-SVID from SPIRE agent has no token

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/bb61fdcdde898cb0. Report an issue: GitHub.