quarkusio/quarkus · error · RuntimeException

Failed to generate key id

Error message

Failed to generate key id

What it means

OidcDevServicesProcessor.createKeyId() derives a key identifier by SHA-256 hashing the encoded private key of the in-memory OIDC key pair and Base64URL-encoding it. If the JCE provider cannot supply the SHA-256 MessageDigest algorithm, a NoSuchAlgorithmException is thrown and wrapped in this RuntimeException. In practice this is almost impossible on a standard JVM, since SHA-256 is mandated for every compliant JDK provider.

Source

Thrown at extensions/devservices/oidc/src/main/java/io/quarkus/devservices/oidc/OidcDevServicesProcessor.java:486

                return Arrays.asList("alice", "bob");
            } else {
                List<String> ret = new ArrayList<>(userToDefaultRoles.keySet());
                Collections.sort(ret);
                return ret;
            }
        }

        private List<String> getUserRoles(String user) {
            List<String> roles = userToDefaultRoles.get(user);
            return roles == null ? ("alice".equals(user) ? List.of("admin", "user") : List.of("user"))
                    : roles;
        }

        private String createKeyId() {
            try {
                return Base64Url.encode(MessageDigest.getInstance("SHA-256").digest(kp.getPrivate().getEncoded()));
            } catch (NoSuchAlgorithmException e) {
                throw new RuntimeException("Failed to generate key id", e);
            }
        }

        private UserAndRoles decode(String encodedContent) {
            if (encodedContent != null && !encodedContent.isEmpty()) {
                String decodedCode = new String(Base64.getUrlDecoder().decode(encodedContent), StandardCharsets.UTF_8);
                int separator = decodedCode.indexOf('|');
                if (separator != -1) {
                    String user = decodedCode.substring(0, separator);
                    String roles = decodedCode.substring(separator + 1);
                    if (roles.isBlank()) {
                        roles = String.join(",", getUserRoles(user));
                    }
                    return new UserAndRoles(user, roles);
                } else if (getUsers().contains(decodedCode)) {
                    String roles = String.join(",", getUserRoles(decodedCode));
                    return new UserAndRoles(decodedCode, roles);
                }

View on GitHub (pinned to e1c734241f)

Solutions

1. Check java.security and restore/verify the default security providers (SUN provider must be present and include MessageDigest SHA-256)
2. Run with a standard, unmodified JDK distribution
3. If a custom provider set is required, register one that implements the SHA-256 MessageDigest
4. Inspect the cause (NoSuchAlgorithmException) for the exact missing algorithm/provider name

try {
    String keyId = createKeyId();
} catch (RuntimeException e) {
    if (e.getCause() instanceof NoSuchAlgorithmException) {
        throw new IllegalStateException("JVM security providers missing SHA-256; check java.security", e);
    } else throw e;
}

When it happens

Trigger: registerRoutes() calls createKeyId() while setting up the dev-mode OIDC provider routes, and MessageDigest.getInstance("SHA-256") throws NoSuchAlgorithmException because no security provider offers SHA-256.

Common situations: Running on a JVM with a stripped or custom JCE provider set (e.g. heavily customized java.security file, some minimal/embdedded JDK builds); removing providers via security.provider overrides; exotic FIPS-less minimal runtimes.

Related errors

• Key can not be loaded
• Services have not been started yet
• Services named ${servicesToWaitFor} do not exist, but wait c
• Docker Compose not found. Is ${composeExecutable} on the PAT
• Unsupported port format: ${port}

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0c866083162cdcf1. Report an issue: GitHub.