{"record":{"id":"411950f328b3a9df","repo":"quarkusio/quarkus","slug":"quarkus-does-not-support-active-directory-based-au","errorCode":null,"errorMessage":"Quarkus does not support Active Directory based authentication","messagePattern":"Quarkus does not support Active Directory based authentication","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java","lineNumber":31,"sourceCode":"import com.oracle.svm.core.annotate.Substitute;\nimport com.oracle.svm.core.annotate.TargetClass;\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.SQLServerConnection\", innerClass = \"SqlFedAuthInfo\")\nfinal class QuarkusSqlFedAuthInfo {\n\n}\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.Parameter\")\nfinal class QuarkusSqlParameter {\n\n}\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.SQLServerConnection\")\nfinal class QuarkusSQLServerConnection {\n\n    @Substitute\n    private SqlAuthenticationToken getFedAuthToken(QuarkusSqlFedAuthInfo fedAuthInfo) {\n        throw new IllegalStateException(\"Quarkus does not support Active Directory based authentication\");\n    }\n\n    @Substitute\n    private void setKeyVaultProvider(String keyStorePrincipalId) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support Keyvault-based column encryption\");\n    }\n\n    @Substitute\n    private void setKeyVaultProvider(String keyStorePrincipalId, String keyStoreSecret) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support Keyvault-based column encryption\");\n    }\n\n    @Substitute\n    ArrayList<byte[]> initEnclaveParameters(SQLServerStatement statement, String userSql, String preparedTypeDefinitions,\n            QuarkusSqlParameter[] params, ArrayList<String> parameterNames) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support AAS Enclave\");\n    }\n}","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java#L13-L49","documentation":"In native mode Quarkus substitutes SQLServerConnection.getFedAuthToken with a stub that throws IllegalStateException, because the Azure Active Directory authentication flow in the Microsoft SQL Server JDBC driver relies on dynamically loaded classes that cannot be supported in a native image.","triggerScenarios":"Opening a SQL Server connection in native mode with authentication=ActiveDirectoryPassword, ActiveDirectoryIntegrated, ActiveDirectoryDefault, ActiveDirectoryManagedIdentity, ActiveDirectoryServicePrincipal, or any fedAuth-based scheme.","commonSituations":"Apps deployed to Azure using Entra ID (Azure AD) credentials for the DB; migrating a JVM build to native; connection strings copied from Azure portal defaults using AAD auth.","solutions":["Switch to SQL server authentication (user=...;password=...) or integrated Kerberos-style auth that does not use fedAuth","Use a credential injected at the SQL Server level (SQL login) instead of Entra ID","Perform the AAD token acquisition yourself outside the driver if the driver version supports accessToken; verify native support before relying on it","Keep the service in JVM mode where AAD authentication works"],"exampleFix":"// before\nString url = \"jdbc:sqlserver://server.database.windows.net:1433;database=db;authentication=ActiveDirectoryDefault\";\n// after\nString url = \"jdbc:sqlserver://server.database.windows.net:1433;database=db;user=sqluser;password=...\";","handlingStrategy":"validation","validationCode":"if (url.contains(\"authentication=ActiveDirectory\")) { throw new IllegalArgumentException(\"Active Directory auth is not supported in native mode; use SQL auth\"); }","typeGuard":"static boolean usesAadAuth(String url) { return url != null && url.contains(\"authentication=ActiveDirectory\"); }","tryCatchPattern":"try { conn = ds.getConnection(); } catch (IllegalStateException e) { if (e.getMessage().contains(\"Active Directory\")) { log.error(\"Use SQL authentication in native mode\"); } throw e; }","preventionTips":["Use SQL logins for native-image deployments","Avoid authentication=ActiveDirectory* in production native configs","Check Quarkus MSSQL extension docs before enabling new auth modes","Add a startup config validator that rejects fedAuth settings in native builds"],"tags":["native-image","jdbc","mssql","azure-ad","authentication"],"backgroundTag":"native-image-unsupported-feature","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}