{"record":{"id":"7d74779f71e770f0","repo":"quarkusio/quarkus","slug":"authentication-strategy-dialog-is-not-supported","errorCode":null,"errorMessage":"Authentication strategy 'dialog' is not supported in GraalVM","messagePattern":"Authentication strategy 'dialog' is not supported in GraalVM","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"extensions/jdbc/jdbc-mariadb/runtime/src/main/java/io/quarkus/jdbc/mariadb/runtime/graal/SendPamAuthPacketFactory_Substitutions.java","lineNumber":16,"sourceCode":"package io.quarkus.jdbc.mariadb.runtime.graal;\n\nimport org.mariadb.jdbc.Configuration;\nimport org.mariadb.jdbc.HostAddress;\nimport org.mariadb.jdbc.plugin.AuthenticationPlugin;\n\nimport com.oracle.svm.core.annotate.Substitute;\nimport com.oracle.svm.core.annotate.TargetClass;\n\n@TargetClass(className = \"org.mariadb.jdbc.plugin.authentication.standard.SendPamAuthPacketFactory\")\npublic final class SendPamAuthPacketFactory_Substitutions {\n\n    @Substitute\n    public AuthenticationPlugin initialize(String authenticationData, byte[] seed, Configuration conf,\n            HostAddress hostAddress) {\n        throw new UnsupportedOperationException(\"Authentication strategy 'dialog' is not supported in GraalVM\");\n    }\n\n}\n","sourceCodeStart":1,"sourceCodeEnd":20,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/jdbc/jdbc-mariadb/runtime/src/main/java/io/quarkus/jdbc/mariadb/runtime/graal/SendPamAuthPacketFactory_Substitutions.java#L1-L20","documentation":"The MariaDB 'dialog' authentication (PAM-based) plugin requires interactive terminal input, which GraalVM native images cannot perform. Quarkus substitutes SendPamAuthPacketFactory.initialize with a stub that throws UnsupportedOperationException, so any connection attempt that negotiates the PAM/dialog authentication strategy fails immediately in native mode.","triggerScenarios":"Connecting (native image) to a MariaDB server configured with PAM authentication so the server selects the 'dialog' auth plugin during the handshake; mariadb-java-client instantiates SendPamAuthPacketFactory and the substituted initialize throws at SendPamAuthPacketFactory_Substitutions.java:16.","commonSituations":"Deploying a Quarkus app as a native executable against a MariaDB instance with PAM authentication enabled (common in enterprise setups); works in JVM mode but fails at startup/first connection in native.","solutions":["Switch the MariaDB user/account to a non-dialog auth plugin (e.g. mysql_native_password) or use a service account without PAM.","Run the application in JVM mode if PAM/dialog authentication is mandatory.","Use certificate/mTLS-based authentication configured so the 'dialog' plugin is never negotiated.","Track upstream Quarkus/MariaDB driver support for native-compatible dialog authentication."],"exampleFix":"// before\nCREATE USER 'app'@'%' IDENTIFIED VIA pam USING 'mariadb'; // dialog auth\n\n// after\nCREATE USER 'app'@'%' IDENTIFIED VIA mysql_native_password USING '...'; // native-image friendly","handlingStrategy":"validation","validationCode":"if (ImageInfo.inImageRuntimeCode() && usesPamAuth(mariaDbUrl)) {\n    throw new IllegalStateException(\"PAM/dialog auth not supported in native image\");\n}","typeGuard":"boolean dialogSafe = !ImageInfo.inImageRuntimeCode() || !authPlugin.equals(\"dialog\");","tryCatchPattern":"try { ds.getConnection(); } catch (UnsupportedOperationException e) { /* dialog/PAM auth negotiated in native image */ }","preventionTips":["Verify the MariaDB server auth plugin for your account before shipping native builds","Add a native-mode startup test that establishes a DB connection","Prefer native-password or TLS-certificate auth for native deployments","Document JVM-only authentication strategies per deployment mode"],"tags":["graalvm","native-image","mariadb","authentication"],"backgroundTag":"unsupported-in-native-image","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}