What causes "Security provider %s can not be inserted" in quarkusio/quarkus?

Check the wrapped cause t for the real reason insertion failed.

quarkusio/quarkus · error · ConfigurationException

Security provider %s can not be inserted

Error message

Security provider %s can not be inserted

What it means

SecurityProviderUtils.insertProvider() inserts a Provider at a specific position in the JVM's provider list via Security.insertProviderAt(), skipping insertion if a provider of the same name already exists. If insertion throws, the exception is wrapped in a ConfigurationException stating the provider cannot be inserted, failing startup.

Source

Thrown at extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderUtils.java:50

    public static void addProvider(Provider provider) {
        try {
            if (Security.getProvider(provider.getName()) == null) {
                Security.addProvider(provider);
            }
        } catch (Exception t) {
            final String errorMessage = String.format("Security provider %s can not be added", provider.getName());
            throw new ConfigurationException(errorMessage, t);
        }
    }

    public static void insertProvider(Provider provider, int index) {
        try {
            if (Security.getProvider(provider.getName()) == null) {
                Security.insertProviderAt(provider, index);
            }
        } catch (Exception t) {
            final String errorMessage = String.format("Security provider %s can not be inserted", provider.getName());
            throw new ConfigurationException(errorMessage, t);
        }
    }

    public static Provider loadProvider(String providerClassName) {
        try {
            return (Provider) Thread.currentThread().getContextClassLoader().loadClass(providerClassName)
                    .getDeclaredConstructor().newInstance();
        } catch (Exception t) {
            final String errorMessage = String.format("Security provider %s can not be registered", providerClassName);
            throw new ConfigurationException(errorMessage, t);
        }
    }

    public static Provider loadProviderWithParams(String providerClassName, Class<?>[] paramClasses, Object[] params) {
        try {
            Constructor<?> c = Thread.currentThread().getContextClassLoader().loadClass(providerClassName)
                    .getConstructor(paramClasses);
            return (Provider) c.newInstance(params);

View on GitHub (pinned to e1c734241f)

Solutions

Check the wrapped cause t for the real reason insertion failed.
Grant the process SecurityPermission("insertProvider.<name>") or remove the SecurityManager if one is active.
Confirm no earlier startup step already registered a provider with the same name in a failing state.
Verify the requested index is valid (>= 1) in whatever code calls insertProvider.
Test provider insertion in a plain JVM main() to isolate Quarkus-specific classloading effects.

Example fix

// before: manual insertion with wrong index ordering
Security.insertProviderAt(new BouncyCastleProvider(), -1);
// after: valid position
Security.insertProviderAt(new BouncyCastleProvider(), 2);
// or delegate to Quarkus config: quarkus.security.security-providers=BC

Defensive patterns

Strategy: try-catch

Validate before calling

SecurityManager sm = System.getSecurityManager();
if (sm != null) {
    sm.checkSecurityAccess("insertProvider." + provider.getName());
}
assert provider.getName() != null && !provider.getName().isBlank();

Try / catch

try {
    SecurityProviderUtils.insertProvider(provider, index);
} catch (ConfigurationException e) {
    log.warnf(e, "Could not insert provider at %d; using addProvider instead", index);
    SecurityProviderUtils.addProvider(provider); // fallback
}

Prevention

Grant SecurityPermission("insertProvider.*") if a SecurityManager is present
Use valid insertion positions (index >= 1)
Prefer addProvider or Quarkus-managed registration unless ordering is required
Verify insertion behavior on the target platform (JVM vs native) early

When it happens

Trigger: Quarkus attempting to place a configured provider at a specific priority index where Security.insertProviderAt() throws — SecurityManager denial, invalid state, or classloader-related failure inside the provider.

Common situations: Running under a SecurityManager policy lacking SecurityPermission("insertProvider.*"); provider name collision combined with a throwing state check; native-image environments where the JDK provider registry behaves differently; broken provider initialization triggered during registration.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/00e9bd136b34a3b4. Report an issue: GitHub.