Since we don't know exactly why token verification fails, we have no way to know whether we should short-circuit the loop. After all, if the token is invalid for some reason besides a disallowed audience, it's a waste of time trying to validate against other audiences.
Knowing that the verification failed due to an invalid audience would allow us to do two things:
1) short-circuit the loop if we encounter an error unrelated to audiences
2) log only the relevant error message rather than continuing the loop and logging an unrelated error about unmatching audiences
Argo CD loops over an OIDC provider's configured allowed audiences, attempting to verify each one. If verification fails, we try more providers. https://github.com/argoproj/argo-cd/blob/0b35e2f1fe27f395e6106a7466d58911c4f7ec9c/util/oidc/provider.go#L108-L120
Since we don't know exactly why token verification fails, we have no way to know whether we should short-circuit the loop. After all, if the token is invalid for some reason besides a disallowed audience, it's a waste of time trying to validate against other audiences.
Knowing that the verification failed due to an invalid audience would allow us to do two things: 1) short-circuit the loop if we encounter an error unrelated to audiences 2) log only the relevant error message rather than continuing the loop and logging an unrelated error about unmatching audiences
Yucky workaround I'm using for now: https://github.com/argoproj/argo-cd/pull/16625