quarkusio/quarkus · error · SpiffeConnectionException

JWT-SVID from SPIRE agent has no token

Error message

JWT-SVID from SPIRE agent has no token

What it means

The JWT-SVID returned by the SPIRE Workload API (JWTSVID proto) contained a null/blank svid string. The client parses the token to verify its claims, so an empty token is unusable and SpiffeConnectionException is thrown. This indicates the SPIRE agent returned a malformed or empty JWT-SVID entry.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:220

                                                    emitter.emit(toWorkloadJsonWebToken(svid, audiences));
                                                }
                                                emitter.complete();
                                            } catch (SpiffeConnectionException e) {
                                                emitter.fail(e);
                                            } catch (Exception e) {
                                                emitter.fail(new SpiffeConnectionException(
                                                        "Failed to parse response from SPIRE agent", e));
                                            }
                                        });
                            });
                }));
    }

    private static WorkloadJsonWebToken toWorkloadJsonWebToken(JWTSVID svid,
            Set<String> requestedAudiences) throws SpiffeConnectionException {
        String token = svid.getSvid();
        if (token.isBlank()) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent has no token");
        }
        String[] parts = token.split("\\.");
        if (parts.length != 3) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is not a valid JWS Compact Serialization");
        }
        JsonObject payload = new JsonObject(new String(Base64.getUrlDecoder().decode(parts[1])));

        String sub = payload.getString("sub");
        SpiffeValidator.validateSpiffeId(sub);
        if (!sub.equals(svid.getSpiffeId())) {
            throw new SpiffeConnectionException(
                    "JWT-SVID proto SPIFFE ID does not match the 'sub' claim; proto: " + svid.getSpiffeId() + ", sub: " + sub);
        }

        Object aud = payload.getValue("aud");
        if (aud == null) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is missing the required 'aud' claim");
        }

View on GitHub (pinned to e1c734241f)

Solutions

  1. Verify the SPIRE workload registration entry exists and is valid (spire-server entry show) and restart/re-fetch the SVID
  2. Check the SPIRE agent logs for JWT-SVID issuance errors; upgrade the agent if it returns empty svid fields
  3. Retry fetching the token; if persistent, check socket/path config (quarkus.spiffe.* trust/agent socket) points at the correct agent
Defensive patterns

Strategy: try-catch

Try / catch

try {
    WorkloadJsonWebToken t = spiffeClient.getWorkloadJsonWebToken(audiences)
        .await().indefinitely();
} catch (SpiffeConnectionException e) {
    // log token-issuance failure, check SPIRE agent health, optionally retry once
}

Prevention

When it happens

Trigger: fetchWorkloadJsonWebTokens receives a JWTSVID whose getSvid() is null or whitespace; a SPIRE agent version returning an entry with only spiffe_id populated (e.g. during registration issues).

Common situations: Misregistered workload entry in SPIRE that has no JWT-SVID capable of being issued; SPIRE agent proxy/mesh returning placeholder entries; stale connection to an agent after restart.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e36f0b9268ce2944. Report an issue: GitHub.