{"record":{"id":"e5ef404a38f8275a","repo":"quarkusio/quarkus","slug":"unable-to-register-password-for-user-user-make","errorCode":null,"errorMessage":"Unable to register password for user:${user} make sure it is a valid hex encoded ${algorithm} hash","messagePattern":"Unable to register password for user:(.+?) make sure it is a valid hex encoded (.+?) hash","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/elytron-security-properties-file/runtime/src/main/java/io/quarkus/elytron/security/properties/runtime/ElytronPropertiesFileRecorder.java","lineNumber":157,"sourceCode":"                log.debugf(\"RoleInfoMap: %s%n\", roleInfo);\n                for (Map.Entry<String, String> userPasswordEntry : userInfo.entrySet()) {\n                    Password password;\n                    String user = userPasswordEntry.getKey();\n\n                    if (runtimeConfig.plainText()) {\n                        password = ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR,\n                                userPasswordEntry.getValue().toCharArray());\n                    } else {\n                        try {\n                            byte[] hashed = ByteIterator.ofBytes(userPasswordEntry.getValue().getBytes(StandardCharsets.UTF_8))\n                                    .asUtf8String().hexDecode().drain();\n\n                            password = PasswordFactory\n                                    .getInstance(runtimeConfig.algorithm().getName(),\n                                            new WildFlyElytronPasswordProvider())\n                                    .generatePassword(new DigestPasswordSpec(user, config.realmName(), hashed));\n                        } catch (Exception e) {\n                            throw new RuntimeException(\"Unable to register password for user:\" + user\n                                    + \" make sure it is a valid hex encoded \"\n                                    + runtimeConfig.algorithm().getName().toUpperCase() + \" hash\", e);\n                        }\n                    }\n\n                    PasswordCredential passwordCred = new PasswordCredential(password);\n                    List<Credential> credentials = new ArrayList<>();\n                    credentials.add(passwordCred);\n                    String rawRoles = roleInfo.get(user);\n                    String[] roles = rawRoles != null ? rawRoles.split(\",\") : new String[0];\n                    Attributes attributes = new MapAttributes();\n                    for (String role : roles) {\n                        attributes.addLast(\"groups\", role);\n                    }\n                    SimpleRealmEntry entry = new SimpleRealmEntry(credentials, attributes);\n                    identityMap.put(user, entry);\n                    log.debugf(\"Added user(%s), roles=%s%n\", user, attributes.get(\"groups\"));\n                }","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/elytron-security-properties-file/runtime/src/main/java/io/quarkus/elytron/security/properties/runtime/ElytronPropertiesFileRecorder.java#L139-L175","documentation":"When a properties-file realm user password is stored as a hex-encoded hash, the recorder attempts to reconstruct the password with the configured WildFly Elytron PasswordFactory algorithm. If the stored value is not a valid hex string for that algorithm (or the algorithm name is wrong), it wraps the failure in this RuntimeException.","triggerScenarios":"A user entry in users.properties contains a password value that fails PasswordFactory.generatePassword — e.g. not valid hex, wrong digest length for the configured algorithm, or mismatched realm-name in the DigestPasswordSpec.","commonSituations":"Hand-edited hashed passwords with typos; hash generated for a different algorithm than quarkus.elytron.security.properties-file.plain-or-encrypted/algorithm config; wrong realm name so the digest doesn't validate; uppercase/lowercase or whitespace issues in hex.","solutions":["Re-generate the hash for the configured algorithm (e.g. with Elytron's tooling) and paste the exact hex output","Confirm the configured algorithm name matches the hash format (e.g. simple-digest-md5 vs digest-*)","Ensure the password line format is correct: user=<hex-hash> without whitespace/BOM","Verify the realm name used to compute the hash matches the configured realm name"],"exampleFix":"// before (users.properties)\nadmin=zz91 NotHex\n// after\nadmin=5f4dcc3b5aa765d61d8327deb882cf99","handlingStrategy":"validation","validationCode":"try {\n    Hex.decodeHex(storedHash.toCharArray());\n} catch (IllegalArgumentException e) {\n    throw new IllegalStateException(\"user password is not valid hex for configured algorithm\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    realm.registerUser(user, hash);\n} catch (RuntimeException e) {\n    throw new IllegalStateException(\"Invalid password hash for \" + user + \": regenerate with the configured algorithm\", e);\n}","preventionTips":["Generate hashes with the same Elytron algorithm configured in Quarkus","Never hand-edit hash values; script their generation","Keep realm name consistent between hash generation and config"],"tags":["security","password-hash","properties-file","elytron"],"backgroundTag":"invalid-password-hash","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}