{"record":{"id":"63e82eb250824adc","repo":"spring-projects/spring-security","slug":"failed-find-sha1prng-algorithm","errorCode":null,"errorMessage":"Failed find SHA1PRNG algorithm!","messagePattern":"Failed find SHA1PRNG algorithm!","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java","lineNumber":114,"sourceCode":"\t\t\tuser.addConstructorArgValue(password);\n\t\t\tuser.addConstructorArgValue(!disabled);\n\t\t\tuser.addConstructorArgValue(true);\n\t\t\tuser.addConstructorArgValue(true);\n\t\t\tuser.addConstructorArgValue(!locked);\n\t\t\tuser.addConstructorArgValue(authorities.getBeanDefinition());\n\t\t\tusers.add(user.getBeanDefinition());\n\t\t}\n\t\tbuilder.addConstructorArgValue(users);\n\t}\n\n\tprivate String generateRandomPassword() {\n\t\tif (this.random == null) {\n\t\t\ttry {\n\t\t\t\tthis.random = SecureRandom.getInstance(\"SHA1PRNG\");\n\t\t\t}\n\t\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\t\t// Shouldn't happen...\n\t\t\t\tthrow new RuntimeException(\"Failed find SHA1PRNG algorithm!\");\n\t\t\t}\n\t\t}\n\t\treturn Long.toString(this.random.nextLong());\n\t}\n\n}\n","sourceCodeStart":96,"sourceCodeEnd":121,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java#L96-L121","documentation":"generateRandomPassword lazily initializes a SecureRandom using the SHA1PRNG algorithm and wraps any NoSuchAlgorithmException in a plain RuntimeException. SHA1PRNG is a Sun-provider-specific algorithm name guaranteed on stock JDKs but not on hardened/non-Sun JVMs (some IBM JDKs, FIPS-mode JCE, Android-style runtimes), where the default provider lacks it.","triggerScenarios":"doParse parses <user-service> without a 'properties' attribute, so generateRandomPassword is called to make placeholder passwords for <user> elements that omit a password; SecureRandom.getInstance(\"SHA1PRNG\") throws NoSuchAlgorithmException because no provider offers that algorithm.","commonSituations":"Running on a FIPS-enabled JVM or a JDK without the SunJCE/Sun provider; restricted security provider lists set via security.provider entries in java.security; custom JCE configurations that remove SUN provider algorithms.","solutions":["Ensure the SUN security provider is registered in the JVM's java.security file (security.provider.1=sun.security.provider.Sun)","Run on a standard OpenJDK/Oracle JDK instead of a FIPS-restricted or stripped-down JVM","Supply explicit passwords for every <user> element so random generation is never invoked","If modifying library code, use new SecureRandom() (default algorithm) instead of hardcoding SHA1PRNG"],"exampleFix":"// before (library code)\nthis.random = SecureRandom.getInstance(\"SHA1PRNG\");\n// after\nthis.random = new SecureRandom();","handlingStrategy":"try-catch","validationCode":"try { javax.crypto.SecretKey k = null; java.security.SecureRandom.getInstance(\"SHA1PRNG\"); } catch (java.security.NoSuchAlgorithmException e) { /* SHA1PRNG unavailable on this JVM */ }","typeGuard":null,"tryCatchPattern":"try {\n    applicationContext.start();\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"SHA1PRNG\")) {\n        logger.error(\"JVM lacks SHA1PRNG; register SUN provider or supply explicit user passwords\");\n    }\n}","preventionTips":["Always give <user> elements explicit passwords","Check provider availability on non-standard JVMs (FIPS, IBM JDK) before deploying","Verify java.security provider list includes the SUN provider"],"tags":["spring-security","secure-random","jvm","algorithm-not-found"],"backgroundTag":"unsupported-platform","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}