Getting ClassNotFoundException on com.ibm.ws.security.jaspi.ProviderRegistry on Spring Boot application

Question

I am using Spring Boot application with tomcat as a container.

on some machine it is working, and on other mochine im getting:

java.lang.SecurityException: AuthConfigFactory error: java.lang.ClassNotFoundException: com.ibm.ws.security.jaspi.ProviderRegistry
        at javax.security.auth.message.config.AuthConfigFactory.getFactory(AuthConfigFactory.java:85) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.catalina.authenticator.AuthenticatorBase.findJaspicProvider(AuthenticatorBase.java:1205) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.catalina.authenticator.AuthenticatorBase.getJaspicProvider(AuthenticatorBase.java:1195) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:469) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1457) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1176) [na:1.7.0]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) [na:1.7.0]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at java.lang.Thread.run(Thread.java:795) [na:1.7.0]
Caused by: java.lang.ClassNotFoundException: com.ibm.ws.security.jaspi.ProviderRegistry
        at java.lang.Class.forNameImpl(Native Method) ~[na:1.7.0]
        at java.lang.Class.forName(Class.java:186) ~[na:1.7.0]
        at javax.security.auth.message.config.AuthConfigFactory$1.run(AuthConfigFactory.java:75) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at javax.security.auth.message.config.AuthConfigFactory$1.run(AuthConfigFactory.java:66) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        at java.security.AccessController.doPrivileged(AccessController.java:330) ~[na:1.7.0]
        at javax.security.auth.message.config.AuthConfigFactory.getFactory(AuthConfigFactory.java:65) ~[tomcat-embed-core-8.5.20.jar!/:8.5.20]
        ... 16 common frames omitted

The class com.ibm.ws.security.jaspi.ProviderRegistry look like a WebSphere class, and it is not related to my application as I am using tomcat.

Answer 1

The issue is that java security trying to create AuthConfigFactory in AuthConfigFactory::getFactory() . It first check if the security property authconfigprovider.factory exist.

If the property authconfigprovider.factory not exist, it will create as default instance of the class org.apache.catalina.authenticator.jaspic.AuthConfigFactoryImpl , that it will be probably ok.

The issue is when you are trying to run on machine that have defined that security property authconfigprovider.factory as com.ibm.ws.security.jaspi.ProviderRegistry in java.security file (might be that machine is used for WebSphere).

So of course you dont have the class com.ibm.ws.security.jaspi.ProviderRegistry and you will get ClassNotFoundException .

To solve it, try to create your own java.security file and locate it under your application, inside that file - override the property like authconfigprovider.factory=org.apache.catalina.authenticator.jaspic.AuthConfigFactoryImpl .

And to make your new java.security file active, add the jvm argument -Djava.security.properties=java.security .