{"record":{"id":"67c5c918da4c78e6","repo":"quarkusio/quarkus","slug":"quarkus-does-not-support-keyvault-based-column-enc","errorCode":null,"errorMessage":"Quarkus does not support Keyvault-based column encryption","messagePattern":"Quarkus does not support Keyvault-based column encryption","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java","lineNumber":36,"sourceCode":"\n}\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.Parameter\")\nfinal class QuarkusSqlParameter {\n\n}\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.SQLServerConnection\")\nfinal class QuarkusSQLServerConnection {\n\n    @Substitute\n    private SqlAuthenticationToken getFedAuthToken(QuarkusSqlFedAuthInfo fedAuthInfo) {\n        throw new IllegalStateException(\"Quarkus does not support Active Directory based authentication\");\n    }\n\n    @Substitute\n    private void setKeyVaultProvider(String keyStorePrincipalId) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support Keyvault-based column encryption\");\n    }\n\n    @Substitute\n    private void setKeyVaultProvider(String keyStorePrincipalId, String keyStoreSecret) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support Keyvault-based column encryption\");\n    }\n\n    @Substitute\n    ArrayList<byte[]> initEnclaveParameters(SQLServerStatement statement, String userSql, String preparedTypeDefinitions,\n            QuarkusSqlParameter[] params, ArrayList<String> parameterNames) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support AAS Enclave\");\n    }\n}\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.SQLServerCertificateUtils\")\nfinal class QuarkusSqlSQLServerCertificateUtils {\n    @Substitute\n    static KeyManager[] getKeyManagerFromFile(String certPath, String keyPath, String keyPassword)","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java#L18-L54","documentation":"Quarkus substitutes SQLServerConnection.setKeyVaultProvider(String) in native mode with a stub that throws IllegalStateException. Azure Key Vault based Always Encrypted column encryption requires Azure SDK classes not supported in the native image, so it is explicitly blocked with a clear message.","triggerScenarios":"Native-mode connection using Always Encrypted with a key store principal (columnEncryptionSetting=Enabled with KeyVaultProvider, or driver-side setKeyVaultProvider(String keyStorePrincipalId) call).","commonSituations":"Apps using Always Encrypted columns backed by Azure Key Vault; enabling columnEncryptionSetting after migrating to native image.","solutions":["Disable Always Encrypted / column encryption (remove columnEncryptionSetting=Enabled) in native mode","Use a Windows Certificate Store or Java keystore based column master key instead of Key Vault","Keep the workload in JVM mode where Key Vault column encryption is supported","Store sensitive data outside encrypted columns if native deployment is mandatory"],"exampleFix":"// before\nString url = \"jdbc:sqlserver://host;database=db;columnEncryptionSetting=Enabled;keyStorePrincipalId=...\";\n// after\nString url = \"jdbc:sqlserver://host;database=db\";","handlingStrategy":"validation","validationCode":"if (url.contains(\"keyStorePrincipalId\") || url.contains(\"columnEncryptionSetting=Enabled\")) { throw new IllegalArgumentException(\"Key Vault column encryption is not supported in native mode\"); }","typeGuard":"static boolean usesKeyVaultEncryption(String url) { return url != null && (url.contains(\"keyStorePrincipalId\") || url.contains(\"columnEncryptionSetting=Enabled\")); }","tryCatchPattern":"try { conn = ds.getConnection(); } catch (IllegalStateException e) { if (e.getMessage().contains(\"Keyvault\")) { log.error(\"Disable Always Encrypted with Key Vault in native mode\"); } throw e; }","preventionTips":["Disable columnEncryptionSetting in native profiles","Use non-KeyVault column master keys if encryption is mandatory","Keep Always Encrypted workloads on JVM deployments","Review driver feature flags when migrating to native"],"tags":["native-image","jdbc","mssql","keyvault","always-encrypted"],"backgroundTag":"native-image-unsupported-feature","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}