Why java.lang.ClassNotFoundException: org.bouncycastle.crypto.params.Argon2Parameters$Builder when using Argon2PasswordEncoder

Question

I have this exception when calling the following code:

val encoder=Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8()
val ok=encoder.matches("password","$argon2id$v=19$m=65536,t=4,p=1$fhPPCUS3Yo9snJkF.....")

Here is my build.gradle.kts:

import org.jetbrains.kotlin.gradle.tasks.KotlinCompile

plugins {
    //val kotlinVersion="1.7.22"
    val kotlinVersion="1.8.10"
    id("org.springframework.boot") version "3.1.3"
    id("io.spring.dependency-management") version "1.1.3"
    kotlin("jvm") version kotlinVersion
    kotlin("plugin.spring") version kotlinVersion
    kotlin("plugin.jpa") version kotlinVersion
    kotlin("kapt") version kotlinVersion
}


group = "deegixl.framework"
version = "0.0.1-SNAPSHOT"
java.sourceCompatibility = JavaVersion.VERSION_17

configurations {
    compileOnly {
        extendsFrom(configurations.annotationProcessor.get())
    }
}

repositories {
    mavenCentral()
}

dependencies {
    implementation("org.springframework.boot:spring-boot-starter-data-jdbc")
    implementation("org.springframework.boot:spring-boot-starter-data-jpa")
    implementation("org.springframework.boot:spring-boot-starter-jdbc")
    implementation("org.springframework.boot:spring-boot-starter-thymeleaf")
    implementation("org.springframework.boot:spring-boot-starter-security")
    implementation("org.springframework.boot:spring-boot-starter-web")
    implementation("org.springframework.boot:spring-boot-starter-validation")
    implementation("com.fasterxml.jackson.module:jackson-module-kotlin")

    implementation("org.jetbrains.kotlin:kotlin-reflect")
    implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
    implementation("org.springframework.session:spring-session-jdbc")

    implementation("commons-validator:commons-validator:1.7")

    //implementation("jakarta.validation:jakarta.validation-api")
    //implementation("org.hibernate.validator:hibernate-validator")
    implementation("com.querydsl:querydsl-jpa:5.0.0:jakarta")

    val openHtmlToPdfVersion="1.0.10"
    implementation("com.openhtmltopdf:openhtmltopdf-core:$openHtmlToPdfVersion")
    implementation("com.openhtmltopdf:openhtmltopdf-pdfbox:$openHtmlToPdfVersion")

    developmentOnly("org.springframework.boot:spring-boot-devtools")

    runtimeOnly("com.mysql:mysql-connector-j")
    //implementation("mysql:mysql-connector-java:8.0.32")

    kapt("org.springframework.boot:spring-boot-configuration-processor")
    kapt("com.querydsl:querydsl-apt:5.0.0:jakarta")

    testImplementation("org.springframework.boot:spring-boot-starter-test")
    testImplementation("org.springframework.security:spring-security-test")
    annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")

    implementation("org.springframework.security:spring-security-crypto:6.1.4")

    implementation("org.bouncycastle:bcprov-jdk18on:1.76")
}

tasks.withType<KotlinCompile> {
    kotlinOptions {
        freeCompilerArgs = listOf("-Xjsr305=strict","-Xcontext-receivers")
        jvmTarget = "17"
    }
}

tasks.withType<Test> {
    useJUnitPlatform()
}

The bouncycastle lib ("org.bouncycastle:bcprov-jdk18on:1.76") is included in the build.gradle.kts. I checked into the corresponding jar and the class org.bouncycastle.crypto.params.Argon2Parameters$Builder.class is present so I don't understand why I have this problem.

Answer 1

You are using bcprov-jdk18on:1.76, but spring-security-crypto:6.1.4" depends on bcprov-jdk15on:1.70 - see https://github.com/spring-projects/spring-security/blob/6.1.x/dependencies/spring-security-dependencies.gradle#L52 - which results in incorrect lib at runtime.

If you don't strictly need the version you've specified, I would suggest using one provided by spring.

If you do need, you can try applying resolution strategy as suggested in https://stackoverflow.com/a/77160986/3636639