quarkusio/quarkus · error · ConfigurationException

'credentials.jwt.source' is set to 'spiffe-jwt', but no audi

Error message

'credentials.jwt.source' is set to 'spiffe-jwt', but no audience is available. Either set 'credentials.jwt.audience' or 'auth-server-url'

What it means

When JWT client credentials use source 'spiffe-jwt', an audience is required to build the SPIFFE client assertion. Quarkus falls back to the auth-server-url as audience; if neither credentials.jwt.audience nor auth-server-url is set, it throws a ConfigurationException.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:1010

            Credentials credentialsConfig, Optional<String> authServerUrl) {
        var jwtConfig = credentialsConfig.jwt();
        if (jwtConfig.source() != Source.CLIENT && jwtConfig.tokenPath().isPresent()) {
            var clientAssertionProvider = new KubernetesServiceClientAssertionProvider(vertx, jwtConfig.tokenPath().get(),
                    jwtConfig.source());
            if (clientAssertionProvider.getAvailableClientAssertion() == null) {
                LOG.warnf("Cannot find a valid %s token at path: %s, deferring token loading to request time",
                        jwtConfig.source() == Source.SPIFFE_JWT ? "SPIFFE JWT-SVID" : "JWT bearer",
                        jwtConfig.tokenPath().get());
            }
            return clientAssertionProvider;
        } else if (jwtConfig.source() == Source.SPIFFE_JWT) {
            var audience = jwtConfig.audience().or(() -> authServerUrl).orElseThrow(
                    () -> new ConfigurationException(
                            "'credentials.jwt.source' is set to 'spiffe-jwt', but no audience is available."
                                    + " Either set 'credentials.jwt.audience' or 'auth-server-url'"));
            var clientAssertionProvider = SpiffeClientAssertionProvider.forAudience(vertx, audience);
            if (clientAssertionProvider == null) {
                throw new ConfigurationException(
                        "'credentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available."
                                + " Either set 'credentials.jwt.token-path' to a file containing the JWT-SVID,"
                                + " or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs"
                                + " from the SPIFFE Workload API");
            }
            return clientAssertionProvider;
        }
        return null;
    }

    public static Object getClientAssertionTokenType(Source source) {
        return switch (source) {
            case BEARER, CLIENT -> "JWT bearer";
            case SPIFFE_JWT -> "SPIFFE JWT-SVID";
        };
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.oidc-client.credentials.jwt.audience=<expected audience of the JWT-SVID>
Or configure quarkus.oidc-client.auth-server-url so it can be used as the audience
If neither is desired, confirm spiffe-jwt is the intended source; switch to a different jwt.source
Also verify the SPIFFE provider availability: set credentials.jwt.token-path or add the quarkus-spiffe-client extension (a related follow-up error otherwise)

Example fix

// before
quarkus.oidc-client.credentials.jwt.source=spiffe-jwt
// after
quarkus.oidc-client.credentials.jwt.source=spiffe-jwt
quarkus.oidc-client.credentials.jwt.audience=https://idp.example.com

Defensive patterns

Strategy: validation

Validate before calling

var cfg = ConfigProvider.getConfig();
if ("spiffe-jwt".equals(cfg.getOptionalValue("quarkus.oidc-client.credentials.jwt.source", String.class).orElse(""))
    && cfg.getOptionalValue("quarkus.oidc-client.credentials.jwt.audience", String.class).isEmpty()
    && cfg.getOptionalValue("quarkus.oidc-client.auth-server-url", String.class).isEmpty()) {
    throw new IllegalStateException("spiffe-jwt requires credentials.jwt.audience or auth-server-url");
}

Prevention

When enabling SPIFFE JWT sources, always set credentials.jwt.audience explicitly
Keep auth-server-url configured even with discovery disabled
Document SPIFFE prerequisites: token-path or quarkus-spiffe-client extension

When it happens

Trigger: quarkus.oidc-client.credentials.jwt.source=spiffe-jwt configured without credentials.jwt.audience and without an auth-server-url in the same configuration, evaluated when building the client assertion provider.

Common situations: Enabling SPIFFE workload identity in a service that uses manual endpoint configuration (discovery-enabled=false) without auth-server-url, forgetting the audience property; copying SPIFFE config between projects that dropped the audience.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c69a37d8426a8718. Report an issue: GitHub.