What causes "Failed find SHA1PRNG algorithm!" in spring-projects/spring-security?

Ensure the SUN security provider is registered in the JVM's java.security file (security.provider.1=sun.security.provider.Sun)

spring-projects/spring-security · error · RuntimeException

Failed find SHA1PRNG algorithm!

Error message

Failed find SHA1PRNG algorithm!

What it means

generateRandomPassword lazily initializes a SecureRandom using the SHA1PRNG algorithm and wraps any NoSuchAlgorithmException in a plain RuntimeException. SHA1PRNG is a Sun-provider-specific algorithm name guaranteed on stock JDKs but not on hardened/non-Sun JVMs (some IBM JDKs, FIPS-mode JCE, Android-style runtimes), where the default provider lacks it.

Source

Thrown at config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java:114

			user.addConstructorArgValue(password);
			user.addConstructorArgValue(!disabled);
			user.addConstructorArgValue(true);
			user.addConstructorArgValue(true);
			user.addConstructorArgValue(!locked);
			user.addConstructorArgValue(authorities.getBeanDefinition());
			users.add(user.getBeanDefinition());
		}
		builder.addConstructorArgValue(users);
	}

	private String generateRandomPassword() {
		if (this.random == null) {
			try {
				this.random = SecureRandom.getInstance("SHA1PRNG");
			}
			catch (NoSuchAlgorithmException ex) {
				// Shouldn't happen...
				throw new RuntimeException("Failed find SHA1PRNG algorithm!");
			}
		}
		return Long.toString(this.random.nextLong());
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

Ensure the SUN security provider is registered in the JVM's java.security file (security.provider.1=sun.security.provider.Sun)
Run on a standard OpenJDK/Oracle JDK instead of a FIPS-restricted or stripped-down JVM
Supply explicit passwords for every <user> element so random generation is never invoked
If modifying library code, use new SecureRandom() (default algorithm) instead of hardcoding SHA1PRNG

Example fix

// before (library code)
this.random = SecureRandom.getInstance("SHA1PRNG");
// after
this.random = new SecureRandom();

Defensive patterns

Strategy: try-catch

Validate before calling

try { javax.crypto.SecretKey k = null; java.security.SecureRandom.getInstance("SHA1PRNG"); } catch (java.security.NoSuchAlgorithmException e) { /* SHA1PRNG unavailable on this JVM */ }

Try / catch

try {
    applicationContext.start();
} catch (RuntimeException e) {
    if (e.getMessage() != null && e.getMessage().contains("SHA1PRNG")) {
        logger.error("JVM lacks SHA1PRNG; register SUN provider or supply explicit user passwords");
    }
}

Prevention

Always give <user> elements explicit passwords
Check provider availability on non-standard JVMs (FIPS, IBM JDK) before deploying
Verify java.security provider list includes the SUN provider

When it happens

Trigger: doParse parses <user-service> without a 'properties' attribute, so generateRandomPassword is called to make placeholder passwords for <user> elements that omit a password; SecureRandom.getInstance("SHA1PRNG") throws NoSuchAlgorithmException because no provider offers that algorithm.

Common situations: Running on a FIPS-enabled JVM or a JDK without the SunJCE/Sun provider; restricted security provider lists set via security.provider entries in java.security; custom JCE configurations that remove SUN provider algorithms.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/63e82eb250824adc. Report an issue: GitHub.