apache/shardingsphere · error · EncryptLogicColumnNotFoundException

Can not find logic encrypt column by '%s'.

Error message

Can not find logic encrypt column by '%s'.

What it means

Thrown by EncryptTable.getLogicColumnByCipherColumn when no logic encrypt column in the encrypt rule has a cipher column whose name equals (case-insensitively) the given column name. ShardingSphere uses this reverse lookup during SQL rewriting/decryption to map a cipher column appearing in a result set or SQL back to its logic column; if the encrypt rule never registered that cipher column, the mapping fails.

Source

Thrown at features/encrypt/core/src/main/java/org/apache/shardingsphere/encrypt/rule/table/EncryptTable.java:145

     */
    public boolean isCipherColumn(final String columnName) {
        return columns.values().stream().anyMatch(each -> each.getCipher().getName().equalsIgnoreCase(columnName));
    }
    
    /**
     * Get logic column by cipher column.
     *
     * @param cipherColumnName cipher column name
     * @return logic column name
     * @throws EncryptLogicColumnNotFoundException encrypt logic column not found exception
     */
    public String getLogicColumnByCipherColumn(final String cipherColumnName) {
        for (Entry<String, EncryptColumn> entry : columns.entrySet()) {
            if (entry.getValue().getCipher().getName().equalsIgnoreCase(cipherColumnName)) {
                return entry.getValue().getName();
            }
        }
        throw new EncryptLogicColumnNotFoundException(cipherColumnName);
    }
    
    /**
     * Get logic column by assisted query column.
     *
     * @param assistQueryColumnName assisted query column name
     * @return logic column name
     * @throws EncryptLogicColumnNotFoundException encrypt logic column not found exception
     */
    public String getLogicColumnByAssistedQueryColumn(final String assistQueryColumnName) {
        for (Entry<String, EncryptColumn> entry : columns.entrySet()) {
            if (entry.getValue().getAssistedQuery().isPresent() && entry.getValue().getAssistedQuery().get().getName().equalsIgnoreCase(assistQueryColumnName)) {
                return entry.getValue().getName();
            }
        }
        throw new EncryptLogicColumnNotFoundException(assistQueryColumnName);
    }
    

View on GitHub (pinned to e952770a21)

Solutions

1. Compare the failing column name from the message with the 'columns:<logic>:cipher:name' entry in the ENCRYPT rule for that table and make them identical
2. Add the missing column (logic + cipher + assisted query if used) to the encrypt rule's columns section
3. Reload/refresh database metadata after changing the rule (restart proxy or ALTER ... REFRESH TABLE METADATA) so stale metadata does not reference an old cipher name
4. Check other environments' config for a renamed cipher column (e.g. pwd_cipher vs pwd_enc) and align them

Example fix

# before (rule)
rules:
- !ENCRYPT
  tables:
    t_user:
      columns:
        password:
          cipher:
            name: password_enc
# SQL references password_cipher -> Can not find logic encrypt column by 'password_cipher'
# after
rules:
- !ENCRYPT
  tables:
    t_user:
      columns:
        password:
          cipher:
            name: password_cipher

// Before enabling the encrypt rule, verify every cipher column referenced by the schema/SQL exists in the rule
Map<String, String> cipherToLogic = new HashMap<>();
encryptTableConfig.getColumns().forEach((logic, col) -> cipherToLogic.put(col.getCipher().getName().toLowerCase(), logic));
if (!cipherToLogic.containsKey(columnName.toLowerCase())) throw new IllegalArgumentException("Column " + columnName + " is not a configured cipher column");

catch (EncryptLogicColumnNotFoundException ex) { log.warn("Cipher column {} not in encrypt rule; check columns config", ex.getMessage()); throw ex; }

When it happens

Trigger: Executing a SELECT/INSERT against an encrypt table where a column the engine classified as a cipher column (e.g. from the metadata or SQL projection) is not present as a 'cipher/name' entry in the encrypt rule's columns configuration for that table.

Common situations: Encrypt rule YAML defines columns with a different cipher-column name than what the SQL/metadata uses; a column was added to the table but not to the encrypt rule; rule was edited after metadata loaded; migrating config between environments where the cipher column suffix (e.g. _cipher vs _encrypted) differs.

Related errors

• Algorithm `%s` is unsupported to decrypt
• Row expression can only compare with subquery
• Can not use different encryptor for %s and %s in %s
• Failed to decrypt the ciphertext '%s' in '%s'.
• The SQL clause 'BETWEEN...AND...' is unsupported in encrypt

AI-assisted analysis of apache/shardingsphere@e952770a21 (2026-08-14). Data as JSON: /api/errors/215e82a29befdddf. Report an issue: GitHub.