quarkusio/quarkus · error · IllegalArgumentException

Audiences must not be empty

Error message

Audiences must not be empty

What it means

SpiffeClientImpl.getWorkloadJsonWebToken requires a non-empty set of audiences because the SPIRE workload API needs at least one audience to include in the JWT-SVID. An empty (or null) audience set is rejected immediately with IllegalArgumentException before any gRPC call is made. This is an input-validation failure on the caller's side, not a SPIRE agent problem.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:156

                    "No default audiences configured via 'quarkus.spiffe-client.audiences'; "
                            + "either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience");
        }
        return fetchWorkloadJsonWebTokens(defaultAudiences).toUni();
    }

    @Override
    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(String audience) {
        validateAudience(audience);
        return fetchWorkloadJsonWebTokens(Set.of(audience)).toUni();
    }

    @Override
    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(Set<String> audiences) {
        if (audiences == null) {
            throw new IllegalArgumentException("Audiences must not be null");
        }
        if (audiences.isEmpty()) {
            throw new IllegalArgumentException("Audiences must not be empty");
        }
        for (String audience : audiences) {
            validateAudience(audience);
        }
        return fetchWorkloadJsonWebTokens(audiences).toUni();
    }

    @PreDestroy
    void close() {
        client.close();
    }

    private Multi<WorkloadJsonWebToken> fetchWorkloadJsonWebTokens(Set<String> audiences) {
        JWTSVIDRequest.Builder proto = JWTSVIDRequest.newBuilder();
        proto.addAllAudience(audiences);
        Buffer payload = Buffer.buffer(proto.build().toByteArray());

        return Multi.createFrom().emitter(emitter -> client.request(server)

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass at least one non-blank audience string, e.g. getWorkloadJsonWebToken(Set.of("https://my-service"))
2. Check the source of the audience set (config property, OIDC token audience config) and fix the empty value
3. Guard the call site: skip or fail fast with a clear message when the set is empty

Example fix

// before
Uni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken(Set.of());
// after
Uni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken(Set.of("https://api.example.com"));

if (audiences == null || audiences.isEmpty()) {
    throw new IllegalArgumentException("At least one audience is required");
}
if (audiences.stream().anyMatch(a -> a == null || a.isBlank())) {
    throw new IllegalArgumentException("Audiences must be non-blank strings");
}

When it happens

Trigger: Calling getWorkloadJsonWebToken(Set.of()) or getWorkloadJsonWebToken(new HashSet<>()); calling it with a dynamically built Set that was filtered down to empty (e.g. removing audiences that are null/blank beforehand).

Common situations: Config-driven audience lists that resolved to nothing (blank quarkus.spiffe config, missing OIDC audience property); iterating configured audiences where all entries were filtered out; a refactoring that changed a default audience value to empty.

Related errors

• SPIFFE ID must not be empty
• SPIFFE ID exceeds maximum length of 2048 bytes: ${length}
• SPIFFE ID must have 'spiffe://' scheme: ${spiffeId}
• SPIFFE ID must not contain percent-encoded characters: ${spi
• SPIFFE ID is not a valid URI: ${spiffeId}

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/1fc2baf10d1d54b5. Report an issue: GitHub.