quarkusio/quarkus · error · SpiffeConnectionException

SPIFFE ID must have a non-empty trust domain:

Error message

SPIFFE ID must have a non-empty trust domain:

What it means

A SPIFFE ID must have a non-empty trust domain immediately after 'spiffe://'. SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when URI.getHost() is null or empty (e.g. 'spiffe://' or 'spiffe:///path').

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java:104

            throw new SpiffeConnectionException("SPIFFE ID is not a valid URI: " + spiffeId, e);
        }

        if (uri.getUserInfo() != null) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain userinfo: " + spiffeId);
        }
        if (uri.getPort() != -1) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain a port: " + spiffeId);
        }
        if (uri.getQuery() != null) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain a query: " + spiffeId);
        }
        if (uri.getFragment() != null) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain a fragment: " + spiffeId);
        }

        String trustDomain = uri.getHost();
        if (trustDomain == null || trustDomain.isEmpty()) {
            throw new SpiffeConnectionException("SPIFFE ID must have a non-empty trust domain: " + spiffeId);
        }
        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {
            throw new SpiffeConnectionException("SPIFFE ID trust domain exceeds maximum length of "
                    + MAX_TRUST_DOMAIN_LENGTH + " bytes: " + spiffeId);
        }
        for (int i = 0; i < trustDomain.length(); i++) {
            char c = trustDomain.charAt(i);
            if (!isValidTrustDomainChar(c)) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID trust domain contains invalid character '" + c + "': " + spiffeId);
            }
        }

        String path = uri.getPath();
        if (path == null || path.isEmpty() || "/".equals(path)) {
            throw new SpiffeConnectionException("SPIFFE ID must have a non-root path: " + spiffeId);
        }
        if (path.endsWith("/")) {

View on GitHub (pinned to e1c734241f)

Solutions

  1. Set a valid trust domain, e.g. spiffe://example.org/ns/default/sa/app
  2. Check the quarkus SPIFFE config for an empty/unset trust-domain property
  3. Guard string-built IDs so a missing trust domain fails before validation

Example fix

// before
String spiffeId = "spiffe:///ns/default/sa/app"; // trust domain missing
// after
String spiffeId = "spiffe://example.org/ns/default/sa/app";
Defensive patterns

Strategy: validation

Validate before calling

static boolean hasTrustDomain(String id) {
    try {
        URI u = URI.create(id);
        return u.getHost() != null && !u.getHost().isEmpty();
    } catch (IllegalArgumentException e) { return false; }
}

Try / catch

try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { throw new IllegalStateException("Trust domain missing in SPIFFE ID config", e); }

Prevention

When it happens

Trigger: Calling validateSpiffeId with 'spiffe://' alone, 'spiffe:///ns/default', or an ID where the host portion failed to parse due to invalid characters.

Common situations: Empty or placeholder trust-domain config values; string concatenation like "spiffe://" + trustDomain where trustDomain is blank/unset; IDs assembled after a config migration where the trust domain property was dropped.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/21b03b1abfc29a91. Report an issue: GitHub.