Minor Description
knoxsso.token.audiences can be set to a comma-separated list of values. Those values can end up containing spaces, depending on how the list is configured. For example:
<param> <name>knoxsso.token.audiences</name> <value>foo,bar, baz</value> </param>
With that config, the token seen by the receiving service will see three audiences, "foo", "bar", and " baz". Notice the space in front of baz.
If the list is parsed and the values are trimmed, it might avoid confusion for services that need to parse that list and match values. Other areas within Knox (such as federation filters) should also trim the values in the list for matching purposes.