{"record":{"id":"7ece7dd380bf7bc2","repo":"quarkusio/quarkus","slug":"the-org-postgresql-sspi-sspiclient-is-not-availabl","errorCode":null,"errorMessage":"The org.postgresql.sspi.SSPIClient is not available on GraalVM","messagePattern":"The org\\.postgresql\\.sspi\\.SSPIClient is not available on GraalVM","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/jdbc/jdbc-postgresql/runtime/src/main/java/io/quarkus/jdbc/postgresql/runtime/graal/DisableSSPIClient.java","lineNumber":17,"sourceCode":"package io.quarkus.jdbc.postgresql.runtime.graal;\n\nimport org.postgresql.core.PGStream;\nimport org.postgresql.core.v3.ConnectionFactoryImpl;\nimport org.postgresql.sspi.ISSPIClient;\n\nimport com.oracle.svm.core.annotate.Substitute;\nimport com.oracle.svm.core.annotate.TargetClass;\n\n@TargetClass(ConnectionFactoryImpl.class)\npublic final class DisableSSPIClient {\n\n    @Substitute\n    private static ISSPIClient createSSPI(PGStream pgStream,\n            String spnServiceClass,\n            boolean enableNegotiate) {\n        throw new IllegalStateException(\"The org.postgresql.sspi.SSPIClient is not available on GraalVM\");\n    }\n\n}\n","sourceCodeStart":1,"sourceCodeEnd":21,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/jdbc/jdbc-postgresql/runtime/src/main/java/io/quarkus/jdbc/postgresql/runtime/graal/DisableSSPIClient.java#L1-L21","documentation":"DisableSSPIClient is a GraalVM @Substitute replacing org.postgresql.jdbc.SSPIRunnable/createSSPI wiring of org.postgresql.sspi.SSPIClient. Windows SSPI (integrated GSS/SSPI authentication) is not supported in native images, so the substitute always throws IllegalStateException. It means a native-image build tried to create the SSPI client for Windows integrated authentication.","triggerScenarios":"Connecting from a Quarkus native executable to PostgreSQL on Windows with integratedSecurity-based SSPI authentication, causing PgStream to request the SSPI client via createSSPI().","commonSituations":"Windows-integrated auth setups migrated to native mode; apps running on Windows that use SSPI single sign-on against PostgreSQL; accidentally enabling SSPI-related connection parameters.","solutions":["Use standard password/GSSAPI (Kerberos) authentication instead of SSPI when running native images.","Deploy the native executable on Linux and use Kerberos (jdbc url gss lib) rather than Windows SSPI.","Run the application in JVM mode if Windows SSPI integrated authentication is mandatory.","Set explicit username/password credentials in the datasource config to avoid the SSPI authentication path."],"exampleFix":"// before (Windows SSO)\nquarkus.datasource.jdbc.url=jdbc:postgresql://host/db?integratedSecurity=true\n// after\nquarkus.datasource.jdbc.url=jdbc:postgresql://host/db\nquarkus.datasource.username=app\nquarkus.datasource.password=secret","handlingStrategy":"validation","validationCode":"boolean usingSspi = jdbcUrl.contains(\"integratedSecurity=true\");\nif (ImageInfo.inImageRuntimeCode() && usingSspi) {\n    throw new ConfigurationException(\"SSPI auth not supported in native image\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    conn = dataSource.getConnection();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"SSPIClient is not available on GraalVM\")) {\n        throw new ConfigurationException(\"Switch from SSPI to password/Kerberos auth in native mode\", e);\n    }\n    throw e;\n}","preventionTips":["Use username/password or GSSAPI Kerberos authentication instead of Windows SSPI","Avoid integratedSecurity=true on native-image deployments","Test native builds against your production auth method"],"tags":["postgresql","native-image","sspi","windows","authentication"],"backgroundTag":"not-supported-on-graalvm","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}