JDK17: java.security.AccessController is deprecated about password4j HOT 2 OPEN

Hello @rprpx ,

yes I'm aware of it.
That part is identical to the implementation of SecureRandom#getInstanceStrong. If you get a look to it even in the last JDK (20) the developers just put a @SuppressWarnings("removal").

We don't have any information on how and when this should be migrated in future versions.

I'll keep this issue open as a reminder.

The only option I see is to do something like that

String property;
try
{
      property = Security.getProperty("securerandom.strongAlgorithms");
}
catch (SecurityException se)
{
      property = PropertyReader.readString("securerandom.strongAlgorithms", "", null);
}

and requires a new property to be defined in psw4j.properties with the same value in java.security

from password4j.

Hi @rprpx a fix for this issue is published under 1.7.2.
It's just a @SuppressWarnings("removal"). I will leave this issue opened until we get some official instructions.

from password4j.