{"record":{"id":"0c866083162cdcf1","repo":"quarkusio/quarkus","slug":"failed-to-generate-key-id","errorCode":null,"errorMessage":"Failed to generate key id","messagePattern":"Failed to generate key id","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/devservices/oidc/src/main/java/io/quarkus/devservices/oidc/OidcDevServicesProcessor.java","lineNumber":486,"sourceCode":"                return Arrays.asList(\"alice\", \"bob\");\n            } else {\n                List<String> ret = new ArrayList<>(userToDefaultRoles.keySet());\n                Collections.sort(ret);\n                return ret;\n            }\n        }\n\n        private List<String> getUserRoles(String user) {\n            List<String> roles = userToDefaultRoles.get(user);\n            return roles == null ? (\"alice\".equals(user) ? List.of(\"admin\", \"user\") : List.of(\"user\"))\n                    : roles;\n        }\n\n        private String createKeyId() {\n            try {\n                return Base64Url.encode(MessageDigest.getInstance(\"SHA-256\").digest(kp.getPrivate().getEncoded()));\n            } catch (NoSuchAlgorithmException e) {\n                throw new RuntimeException(\"Failed to generate key id\", e);\n            }\n        }\n\n        private UserAndRoles decode(String encodedContent) {\n            if (encodedContent != null && !encodedContent.isEmpty()) {\n                String decodedCode = new String(Base64.getUrlDecoder().decode(encodedContent), StandardCharsets.UTF_8);\n                int separator = decodedCode.indexOf('|');\n                if (separator != -1) {\n                    String user = decodedCode.substring(0, separator);\n                    String roles = decodedCode.substring(separator + 1);\n                    if (roles.isBlank()) {\n                        roles = String.join(\",\", getUserRoles(user));\n                    }\n                    return new UserAndRoles(user, roles);\n                } else if (getUsers().contains(decodedCode)) {\n                    String roles = String.join(\",\", getUserRoles(decodedCode));\n                    return new UserAndRoles(decodedCode, roles);\n                }","sourceCodeStart":468,"sourceCodeEnd":504,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/devservices/oidc/src/main/java/io/quarkus/devservices/oidc/OidcDevServicesProcessor.java#L468-L504","documentation":"OidcDevServicesProcessor.createKeyId() derives a key identifier by SHA-256 hashing the encoded private key of the in-memory OIDC key pair and Base64URL-encoding it. If the JCE provider cannot supply the SHA-256 MessageDigest algorithm, a NoSuchAlgorithmException is thrown and wrapped in this RuntimeException. In practice this is almost impossible on a standard JVM, since SHA-256 is mandated for every compliant JDK provider.","triggerScenarios":"registerRoutes() calls createKeyId() while setting up the dev-mode OIDC provider routes, and MessageDigest.getInstance(\"SHA-256\") throws NoSuchAlgorithmException because no security provider offers SHA-256.","commonSituations":"Running on a JVM with a stripped or custom JCE provider set (e.g. heavily customized java.security file, some minimal/embdedded JDK builds); removing providers via security.provider overrides; exotic FIPS-less minimal runtimes.","solutions":["Check java.security and restore/verify the default security providers (SUN provider must be present and include MessageDigest SHA-256)","Run with a standard, unmodified JDK distribution","If a custom provider set is required, register one that implements the SHA-256 MessageDigest","Inspect the cause (NoSuchAlgorithmException) for the exact missing algorithm/provider name"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    String keyId = createKeyId();\n} catch (RuntimeException e) {\n    if (e.getCause() instanceof NoSuchAlgorithmException) {\n        throw new IllegalStateException(\"JVM security providers missing SHA-256; check java.security\", e);\n    } else throw e;\n}","preventionTips":["Use a standard JDK distribution","Do not strip SUN provider from java.security","Smoke-test MessageDigest.getInstance(\"SHA-256\") at startup in hardened environments"],"tags":["oidc","devservices","crypto","jce"],"backgroundTag":"missing-crypto-algorithm","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}