{"record":{"id":"e9df55d2ea99284f","repo":"quarkusio/quarkus","slug":"security-provider-s-can-not-be-added","errorCode":null,"errorMessage":"Security provider %s can not be added","messagePattern":"Security provider (.+?) can not be added","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderUtils.java","lineNumber":39,"sourceCode":"\n    public static final Map<String, String> SUN_PROVIDERS = Map.of(\"SunPKCS11\", \"sun.security.pkcs11.SunPKCS11\");\n\n    private SecurityProviderUtils() {\n\n    }\n\n    public static void addProvider(String provider) {\n        addProvider(loadProvider(provider));\n    }\n\n    public static void addProvider(Provider provider) {\n        try {\n            if (Security.getProvider(provider.getName()) == null) {\n                Security.addProvider(provider);\n            }\n        } catch (Exception t) {\n            final String errorMessage = String.format(\"Security provider %s can not be added\", provider.getName());\n            throw new ConfigurationException(errorMessage, t);\n        }\n    }\n\n    public static void insertProvider(Provider provider, int index) {\n        try {\n            if (Security.getProvider(provider.getName()) == null) {\n                Security.insertProviderAt(provider, index);\n            }\n        } catch (Exception t) {\n            final String errorMessage = String.format(\"Security provider %s can not be inserted\", provider.getName());\n            throw new ConfigurationException(errorMessage, t);\n        }\n    }\n\n    public static Provider loadProvider(String providerClassName) {\n        try {\n            return (Provider) Thread.currentThread().getContextClassLoader().loadClass(providerClassName)\n                    .getDeclaredConstructor().newInstance();","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderUtils.java#L21-L57","documentation":"SecurityProviderUtils.addProvider() registers a Provider with the JVM via Security.addProvider(), but only if a provider with the same name is not already present. If Security.addProvider() (or the preceding check) throws, the exception is wrapped in a ConfigurationException saying the provider cannot be added, failing startup.","triggerScenarios":"Runtime registration of a configured security provider where Security.addProvider() throws — e.g. a SecurityManager denies insertion, the provider name collides and the check throws, or the Provider is in a broken state.","commonSituations":"Native-image or restricted environments where Security provider registration is limited; duplicate provider registration race from two startup paths; provider class loaded by the wrong classloader so its internals fail during registration; running under a SecurityManager policy that blocks Security.addProvider.","solutions":["Read the wrapped cause t in the ConfigurationException stack trace.","Check whether a provider with the same name is already registered (Security.getProviders()) — the utility intentionally skips duplicates; an exception means a different problem.","Ensure the provider is loaded by the correct (application) classloader.","Remove any SecurityManager / grant the required SecurityPermission(\"insertProvider.\") if a policy blocks registration.","Upgrade the provider library if registration fails due to a bug in the Provider implementation."],"exampleFix":"// before: registering manually then letting Quarkus register too\nSecurity.addProvider(new BouncyCastleProvider()); // duplicate/conflict\n// after: let Quarkus manage it\nquarkus.security.security-providers=BC","handlingStrategy":"try-catch","validationCode":"// avoid duplicate registration and check environment first\nif (Security.getProvider(provider.getName()) == null) {\n    SecurityManager sm = System.getSecurityManager();\n    if (sm != null) sm.checkSecurityAccess(\"insertProvider.\" + provider.getName());\n}","typeGuard":null,"tryCatchPattern":"try {\n    SecurityProviderUtils.addProvider(provider);\n} catch (ConfigurationException e) {\n    log.warnf(e, \"Provider %s not registered; falling back to existing providers\", provider.getName());\n}","preventionTips":["Register each provider exactly once (Quarkus already skips same-name duplicates)","Avoid running with a SecurityManager unless the policy grants insertProvider permission","Load providers through the application classloader","Test provider registration in the target environment (including native builds)"],"tags":["security","jca","provider","startup"],"backgroundTag":"security-provider-registration-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}