{"record":{"id":"00e9bd136b34a3b4","repo":"quarkusio/quarkus","slug":"security-provider-s-can-not-be-inserted","errorCode":null,"errorMessage":"Security provider %s can not be inserted","messagePattern":"Security provider (.+?) can not be inserted","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderUtils.java","lineNumber":50,"sourceCode":"    public static void addProvider(Provider provider) {\n        try {\n            if (Security.getProvider(provider.getName()) == null) {\n                Security.addProvider(provider);\n            }\n        } catch (Exception t) {\n            final String errorMessage = String.format(\"Security provider %s can not be added\", provider.getName());\n            throw new ConfigurationException(errorMessage, t);\n        }\n    }\n\n    public static void insertProvider(Provider provider, int index) {\n        try {\n            if (Security.getProvider(provider.getName()) == null) {\n                Security.insertProviderAt(provider, index);\n            }\n        } catch (Exception t) {\n            final String errorMessage = String.format(\"Security provider %s can not be inserted\", provider.getName());\n            throw new ConfigurationException(errorMessage, t);\n        }\n    }\n\n    public static Provider loadProvider(String providerClassName) {\n        try {\n            return (Provider) Thread.currentThread().getContextClassLoader().loadClass(providerClassName)\n                    .getDeclaredConstructor().newInstance();\n        } catch (Exception t) {\n            final String errorMessage = String.format(\"Security provider %s can not be registered\", providerClassName);\n            throw new ConfigurationException(errorMessage, t);\n        }\n    }\n\n    public static Provider loadProviderWithParams(String providerClassName, Class<?>[] paramClasses, Object[] params) {\n        try {\n            Constructor<?> c = Thread.currentThread().getContextClassLoader().loadClass(providerClassName)\n                    .getConstructor(paramClasses);\n            return (Provider) c.newInstance(params);","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderUtils.java#L32-L68","documentation":"SecurityProviderUtils.insertProvider() inserts a Provider at a specific position in the JVM's provider list via Security.insertProviderAt(), skipping insertion if a provider of the same name already exists. If insertion throws, the exception is wrapped in a ConfigurationException stating the provider cannot be inserted, failing startup.","triggerScenarios":"Quarkus attempting to place a configured provider at a specific priority index where Security.insertProviderAt() throws — SecurityManager denial, invalid state, or classloader-related failure inside the provider.","commonSituations":"Running under a SecurityManager policy lacking SecurityPermission(\"insertProvider.*\"); provider name collision combined with a throwing state check; native-image environments where the JDK provider registry behaves differently; broken provider initialization triggered during registration.","solutions":["Check the wrapped cause t for the real reason insertion failed.","Grant the process SecurityPermission(\"insertProvider.<name>\") or remove the SecurityManager if one is active.","Confirm no earlier startup step already registered a provider with the same name in a failing state.","Verify the requested index is valid (>= 1) in whatever code calls insertProvider.","Test provider insertion in a plain JVM main() to isolate Quarkus-specific classloading effects."],"exampleFix":"// before: manual insertion with wrong index ordering\nSecurity.insertProviderAt(new BouncyCastleProvider(), -1);\n// after: valid position\nSecurity.insertProviderAt(new BouncyCastleProvider(), 2);\n// or delegate to Quarkus config: quarkus.security.security-providers=BC","handlingStrategy":"try-catch","validationCode":"SecurityManager sm = System.getSecurityManager();\nif (sm != null) {\n    sm.checkSecurityAccess(\"insertProvider.\" + provider.getName());\n}\nassert provider.getName() != null && !provider.getName().isBlank();","typeGuard":null,"tryCatchPattern":"try {\n    SecurityProviderUtils.insertProvider(provider, index);\n} catch (ConfigurationException e) {\n    log.warnf(e, \"Could not insert provider at %d; using addProvider instead\", index);\n    SecurityProviderUtils.addProvider(provider); // fallback\n}","preventionTips":["Grant SecurityPermission(\"insertProvider.*\") if a SecurityManager is present","Use valid insertion positions (index >= 1)","Prefer addProvider or Quarkus-managed registration unless ordering is required","Verify insertion behavior on the target platform (JVM vs native) early"],"tags":["security","jca","provider","startup"],"backgroundTag":"security-provider-registration-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}