quarkusio/quarkus · error · SpiffeConnectionException

JWT-SVID 'aud' claim does not contain the requested audience

Error message

JWT-SVID 'aud' claim does not contain the requested audiences; requested: ${requestedAudiences}, received: ${audience}

What it means

After parsing the token's aud claim, the client requires that it covers all requested audiences. If any audience passed to getWorkloadJsonWebToken is absent from the token's aud, the SVID cannot be used for the intended call and SpiffeConnectionException is thrown.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:257

        final Set<String> audience;
        if (aud instanceof JsonArray audienceAsArray) {
            audience = new HashSet<>(audienceAsArray.size());
            for (int i = 0; i < audienceAsArray.size(); i++) {
                if (audienceAsArray.getValue(i) instanceof String audienceAsString) {
                    audience.add(audienceAsString);
                } else {
                    throw new SpiffeConnectionException(
                            "JWT-SVID 'aud' array element at index " + i + " is not a string:" + audienceAsArray.getValue(i));
                }
            }
        } else if (aud instanceof String audienceAsString) {
            audience = Set.of(audienceAsString);
        } else {
            throw new SpiffeConnectionException(
                    "JWT-SVID 'aud' claim is not a string or array of strings");
        }
        if (!audience.containsAll(requestedAudiences)) {
            throw new SpiffeConnectionException(
                    "JWT-SVID 'aud' claim does not contain the requested audiences; requested: "
                            + requestedAudiences + ", received: " + audience);
        }
        if (audience.size() != requestedAudiences.size()) {
            throw new SpiffeConnectionException(
                    "JWT-SVID 'aud' claim contains unexpected extra audiences; requested: "
                            + requestedAudiences + ", received: " + audience);
        }

        Long exp = payload.getLong("exp");
        if (exp == null) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is missing the required 'exp' claim");
        }
        Instant expiry = Instant.ofEpochSecond(exp);
        if (expiry.isBefore(Instant.now())) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is already expired");
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Update the SPIRE registration entry (spire-server entry update) so it permits all required audiences for the workload
2. Align the audiences passed to getWorkloadJsonWebToken with the audiences actually granted by the entry
3. Check quarkus.spiffe / OIDC audience configuration so requested audiences match the target service expectations

Example fix

// before
spiffeClient.getWorkloadJsonWebToken(Set.of("https://new-api.example.com"));
// after (entry only grants the legacy audience until updated)
spiffeClient.getWorkloadJsonWebToken(Set.of("https://api.example.com"));

// ensure requested audiences are those the SPIRE entry grants
Set<String> requested = Set.of("https://api.example.com");
if (requested.isEmpty()) throw new IllegalStateException("no audiences configured");
// keep requested in sync with spire-server entry show output

try {
    return spiffeClient.getWorkloadJsonWebToken(requested).await().indefinitely();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().startsWith("JWT-SVID 'aud' claim does not contain")) {
        // update SPIRE entry or align requested audiences
    }
    throw e;
}

When it happens

Trigger: Calling getWorkloadJsonWebToken(Set.of("a","b")) while the SPIRE agent issues a token whose aud contains only "a"; requesting an audience the workload's registration entry doesn't allow.

Common situations: Audience configured in the app (e.g. OIDC token audience) differs from what the SPIRE entry issues; SPIRE agent substituting audiences when -audience isn't honored; changed upstream service audience value after a rename.

Related errors

• JWT-SVID 'aud' claim contains unexpected extra audiences; re
• JWT-SVID 'aud' array element at index ${i} is not a string:$
• JWT-SVID 'aud' claim is not a string or array of strings
• 'credentials.jwt.source' is set to 'spiffe-jwt', but no audi
• JWT-SVID from SPIRE agent has no token

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f379f2c3a8d73ead. Report an issue: GitHub.