quarkusio/quarkus · error · IllegalArgumentException

Audiences must not be null

Error message

Audiences must not be null

What it means

SpiffeClientImpl.getWorkloadJsonWebToken(Set<String> audiences) validates its input before fetching JWT-SVIDs: a null set throws IllegalArgumentException 'Audiences must not be null' (an empty set throws a sibling error). The SPIFFE Workload API requires at least one audience per token request.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:153

    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken() {
        if (defaultAudiences == null) {
            throw new IllegalStateException(
                    "No default audiences configured via 'quarkus.spiffe-client.audiences'; "
                            + "either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience");
        }
        return fetchWorkloadJsonWebTokens(defaultAudiences).toUni();
    }

    @Override
    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(String audience) {
        validateAudience(audience);
        return fetchWorkloadJsonWebTokens(Set.of(audience)).toUni();
    }

    @Override
    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(Set<String> audiences) {
        if (audiences == null) {
            throw new IllegalArgumentException("Audiences must not be null");
        }
        if (audiences.isEmpty()) {
            throw new IllegalArgumentException("Audiences must not be empty");
        }
        for (String audience : audiences) {
            validateAudience(audience);
        }
        return fetchWorkloadJsonWebTokens(audiences).toUni();
    }

    @PreDestroy
    void close() {
        client.close();
    }

    private Multi<WorkloadJsonWebToken> fetchWorkloadJsonWebTokens(Set<String> audiences) {
        JWTSVIDRequest.Builder proto = JWTSVIDRequest.newBuilder();
        proto.addAllAudience(audiences);

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a non-null, non-empty Set of audiences; validate at the call site before invoking.
2. Use getWorkloadJsonWebToken(String) for a single known audience instead of constructing a set.
3. If the set comes from configuration, default it (Set.of(...)) when absent.

Example fix

// before
Set<String> audiences = config.getOptionalValue("my.audiences", ...).orElse(null);
spiffeClient.getWorkloadJsonWebToken(audiences); // NPE-safe but IAE

// after
Set<String> audiences = config.getOptionalValue("my.audiences", String.class)
        .map(v -> Set.of(v.split(",")))
        .orElse(Set.of("https://default.example.com"));
spiffeClient.getWorkloadJsonWebToken(audiences);

if (audiences == null || audiences.isEmpty()) {
    throw new IllegalArgumentException("audiences must be a non-null, non-empty set");
}
spiffeClient.getWorkloadJsonWebToken(audiences);

static boolean isValidAudiences(Set<String> audiences) {
    return audiences != null && !audiences.isEmpty()
        && audiences.stream().allMatch(a -> a != null && !a.isBlank());
}

try {
    return spiffeClient.getWorkloadJsonWebToken(audiences);
} catch (IllegalArgumentException e) {
    LOG.error("Invalid audiences argument: " + e.getMessage());
    throw e;
}

When it happens

Trigger: Calling getWorkloadJsonWebToken(audiences) with a null Set — e.g. a caller variable that failed to initialize, a null config-derived set, or a method chain that passes null through.

Common situations: Building the audience set from optional config and passing the null result; framework-injected values that end up null in tests; refactors changing the overload from single String (which would NPE differently) to Set and forgetting null handling.

Related errors

• No default audiences configured via 'quarkus.spiffe-client.a
• Name cannot start with '/':${name}
• Predicate already set
• Location already set
• messageStarts cannot be empty

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7dafbd3999753197. Report an issue: GitHub.