quarkusio/quarkus · error · SpiffeConnectionException

SPIFFE ID trust domain exceeds maximum length of + MAX_TRUS

Error message

SPIFFE ID trust domain exceeds maximum length of  + MAX_TRUST_DOMAIN_LENGTH +  bytes: 

What it means

Thrown by SpiffeValidator.validateSpiffeId when the trust domain portion of a parsed SPIFFE ID URI (spiffe://trust-domain/...) exceeds MAX_TRUST_DOMAIN_LENGTH bytes. SPIFFE IDs are length-limited by specification; a longer trust domain would produce non-compliant SVIDs/workload identities, so the syntactic validation chain (which also rejects userinfo, ports, queries and fragments) rejects it with the offending id appended.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java:107

        if (uri.getUserInfo() != null) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain userinfo: " + spiffeId);
        }
        if (uri.getPort() != -1) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain a port: " + spiffeId);
        }
        if (uri.getQuery() != null) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain a query: " + spiffeId);
        }
        if (uri.getFragment() != null) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain a fragment: " + spiffeId);
        }

        String trustDomain = uri.getHost();
        if (trustDomain == null || trustDomain.isEmpty()) {
            throw new SpiffeConnectionException("SPIFFE ID must have a non-empty trust domain: " + spiffeId);
        }
        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {
            throw new SpiffeConnectionException("SPIFFE ID trust domain exceeds maximum length of "
                    + MAX_TRUST_DOMAIN_LENGTH + " bytes: " + spiffeId);
        }
        for (int i = 0; i < trustDomain.length(); i++) {
            char c = trustDomain.charAt(i);
            if (!isValidTrustDomainChar(c)) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID trust domain contains invalid character '" + c + "': " + spiffeId);
            }
        }

        String path = uri.getPath();
        if (path == null || path.isEmpty() || "/".equals(path)) {
            throw new SpiffeConnectionException("SPIFFE ID must have a non-root path: " + spiffeId);
        }
        if (path.endsWith("/")) {
            throw new SpiffeConnectionException("SPIFFE ID path must not have a trailing slash: " + spiffeId);
        }
        String[] segments = path.split("/", -1);

View on GitHub (pinned to e1c734241f)

Solutions

1. Shorten the trust domain to 255 characters or fewer
2. Move extra identifying detail into the path (e.g. /tenant/x/sa/app)
3. Check for string-concatenation bugs duplicating the domain in the ID builder

Example fix

// before
String id = "spiffe://" + org + "." + env + "." + region + ".very-long-..." + "/sa/app"; // >255 chars
// after
String id = "spiffe://org-env." + region + "/tenant/" + org + "/sa/app";

static boolean trustDomainWithinLimit(String id) {
    try {
        String host = URI.create(id).getHost();
        return host != null && host.length() <= 255;
    } catch (IllegalArgumentException e) { return false; }
}

try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { log.errorf("Trust domain too long: %s", e.getMessage()); }

When it happens

Trigger: validateSpiffeId invoked with an ID whose trust domain is longer than 255 chars, e.g. an over-long DNS-like domain or an accidentally concatenated domain string.

Common situations: Test/dev environments using machine-generated ultra-long domains; string-building bugs that duplicate or append suffixes to the domain; multi-tenancy setups encoding tenant info into very long domain names.

Related errors

• SPIFFE ID must have a non-empty trust domain:
• SPIFFE ID trust domain contains invalid character '' + c + '
• Audiences must not be empty
• SPIFFE ID must not be empty
• SPIFFE ID exceeds maximum length of 2048 bytes: ${length}

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/80d00bb1a5704a20. Report an issue: GitHub.