Github user jtstorck commented on the issue:
https://github.com/apache/nifi/pull/2177
I just ran a test with audiences set in Knox, and if there's a space after
one of the commas in the KnoxSSO config, it will end up sending that space as
part of the audience value. For example,
```xml
<param>
<name>knoxsso.token.audiences</name>
<value>foo,bar, baz</value>
</param>
```
With that config, NiFi will see three audiences, "foo", "bar", and " baz".
Notice the space in front of baz.---
