diff --git a/.bazelrc b/.bazelrc
new file mode 100644
index 00000000000..f8725e6d9df
--- /dev/null
+++ b/.bazelrc
@@ -0,0 +1,2 @@
+test --test_output=errors
+test --test_size_filters=-large,-enormous
diff --git a/.bazelrc.travis b/.bazelrc.travis
new file mode 100644
index 00000000000..c8875e98a98
--- /dev/null
+++ b/.bazelrc.travis
@@ -0,0 +1,12 @@
+# This is from Bazel's former travis setup, to avoid blowing up the RAM usage.
+startup --host_jvm_args=-Xmx2500m
+startup --host_jvm_args=-Xms2500m
+startup --batch
+test --ram_utilization_factor=10
+
+# This is so we understand failures better
+build --verbose_failures
+
+# Below this line, .travis.yml will cat the default bazelrc.
+# This is needed so Bazel starts with the base workspace in its
+# package path.
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000000..a6ef824c1f8
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/bazel-*
diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 00000000000..8471d0d3c61
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,40 @@
+sudo: required
+dist: xenial
+
+lang: go
+
+go:
+  - 1.7.x
+
+jdk:
+  - oraclejdk8
+
+env:
+  - BAZEL_VERSION=0.4.2
+
+addons:
+  apt:
+    packages:
+      - wget
+
+cache:
+  directories:
+    - $HOME/bazel/install
+    - $HOME/bazel/outbase
+
+before_install:
+  - mkdir -p ${HOME}/bazel/install
+  - cd ${HOME}/bazel/install
+  - wget --no-clobber "https://github.com/bazelbuild/bazel/releases/download/${BAZEL_VERSION}/bazel_${BAZEL_VERSION}-linux-x86_64.deb"
+  - chmod +x bazel_${BAZEL_VERSION}-linux-x86_64.deb
+  - sudo dpkg -i bazel_${BAZEL_VERSION}-linux-x86_64.deb
+  - sudo apt-get -f install -qqy uuid-dev
+  - cd ${TRAVIS_BUILD_DIR}
+  - mv .bazelrc .bazelrc.orig
+  - cat .bazelrc.travis .bazelrc.orig > .bazelrc
+
+script:
+  - bazel --output_base=${HOME}/bazel/outbase test //...
+
+notifications:
+  slack: istio-dev:wEEEbaabdP5ieCgDOFetA9nX
diff --git a/WORKSPACE b/WORKSPACE
index ed7b1b60a7b..3f211badf0b 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -149,7 +149,7 @@ bind(
 
 new_git_repository(
     name = "googleapis_git",
-    commit = "6c1d6d4067364a21f8ffefa3401b213d652bf121",
+    commit = "db1d4547dc56a798915e0eb2c795585385922165",
     remote = "https://github.com/googleapis/googleapis.git",
     build_file = "third_party/BUILD.googleapis",
 )
diff --git a/contrib/endpoints/src/api_manager/config.cc b/contrib/endpoints/src/api_manager/config.cc
index 9c9f4d10a1a..dcd3d15dcc5 100644
--- a/contrib/endpoints/src/api_manager/config.cc
+++ b/contrib/endpoints/src/api_manager/config.cc
@@ -258,7 +258,7 @@ bool Config::LoadRpcMethods(ApiManagerEnvInterface *env,
 bool Config::LoadAuthentication(ApiManagerEnvInterface *env) {
   // Parsing auth config.
   const ::google::api::Authentication &auth = service_.authentication();
-  map<string, string> provider_id_issuer_map;
+  map<string, const ::google::api::AuthProvider*> provider_id_provider_map;
   for (const auto &provider : auth.providers()) {
     if (provider.id().empty()) {
       env->LogError("Missing id field in AuthProvider.");
@@ -274,7 +274,7 @@ bool Config::LoadAuthentication(ApiManagerEnvInterface *env) {
     } else {
       SetJwksUri(provider.issuer(), string(), true);
     }
-    provider_id_issuer_map[provider.id()] = provider.issuer();
+    provider_id_provider_map[provider.id()] = &provider;
   }
 
   for (const auto &rule : auth.rules()) {
@@ -296,12 +296,16 @@ bool Config::LoadAuthentication(ApiManagerEnvInterface *env) {
         env->LogError(error.c_str());
         continue;
       }
-      auto issuer = utils::FindOrNull(provider_id_issuer_map, provider_id);
-      if (issuer == nullptr) {
+      auto provider = utils::FindPtrOrNull(provider_id_provider_map,
+                                           provider_id);
+      if (provider == nullptr) {
         std::string error = "Undefined provider_id: " + provider_id;
         env->LogError(error.c_str());
       } else {
-        (*method)->addAudiencesForIssuer(*issuer, requirement.audiences());
+        const std::string &audiences = provider->audiences().empty()
+                              ? requirement.audiences()
+                              : provider->audiences();
+        (*method)->addAudiencesForIssuer(provider->issuer(), audiences);
       }
     }
   }
diff --git a/contrib/endpoints/src/api_manager/config_test.cc b/contrib/endpoints/src/api_manager/config_test.cc
index c072a2de3cb..ace0d2afc49 100644
--- a/contrib/endpoints/src/api_manager/config_test.cc
+++ b/contrib/endpoints/src/api_manager/config_test.cc
@@ -304,6 +304,7 @@ static const char auth_config[] =
     "    id: \"provider-id1\"\n"
     "    issuer: \"issuer1@gserviceaccount.com\"\n"
     "    jwks_uri: \"https://www.googleapis.com/jwks_uri1\"\n"
+    "    audiences: \"ok_audience1\"\n"
     "  }\n"
     "  providers {\n"
     "    id: \"provider-id2\"\n"
@@ -326,7 +327,6 @@ static const char auth_config[] =
     "    selector: \"Xyz.Method1\"\n"
     "    requirements {\n"
     "      provider_id: \"provider-id1\"\n"
-    "      audiences: \"ok_audience1\"\n"
     "    }\n"
     "  }\n"
     "  rules {\n"