{"record":{"id":"7ffd72c78977c997","repo":"quarkusio/quarkus","slug":"quarkus-does-not-support-aas-enclave","errorCode":null,"errorMessage":"Quarkus does not support AAS Enclave","messagePattern":"Quarkus does not support AAS Enclave","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java","lineNumber":47,"sourceCode":"    @Substitute\n    private SqlAuthenticationToken getFedAuthToken(QuarkusSqlFedAuthInfo fedAuthInfo) {\n        throw new IllegalStateException(\"Quarkus does not support Active Directory based authentication\");\n    }\n\n    @Substitute\n    private void setKeyVaultProvider(String keyStorePrincipalId) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support Keyvault-based column encryption\");\n    }\n\n    @Substitute\n    private void setKeyVaultProvider(String keyStorePrincipalId, String keyStoreSecret) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support Keyvault-based column encryption\");\n    }\n\n    @Substitute\n    ArrayList<byte[]> initEnclaveParameters(SQLServerStatement statement, String userSql, String preparedTypeDefinitions,\n            QuarkusSqlParameter[] params, ArrayList<String> parameterNames) throws SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support AAS Enclave\");\n    }\n}\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.SQLServerCertificateUtils\")\nfinal class QuarkusSqlSQLServerCertificateUtils {\n    @Substitute\n    static KeyManager[] getKeyManagerFromFile(String certPath, String keyPath, String keyPassword)\n            throws IOException, GeneralSecurityException, SQLServerException {\n        throw new IllegalStateException(\"Quarkus does not support Client Certificate based authentication\");\n    }\n}\n\n@TargetClass(className = \"com.microsoft.sqlserver.jdbc.SQLServerLexer\")\n@Delete //Deleting this one explicitly, so to help with maintenance with the substitutions of SQLServerFMTQuery\nfinal class SQLServerLexerRemove {\n\n}\n","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java#L29-L65","documentation":"Quarkus substitutes initEnclaveParameters to throw IllegalStateException in native mode. Always Encrypted with secure enclaves (Azure SQL / SQL Server enclave attestation) relies on classes removed by the native build, so enclave-enabled queries cannot be executed.","triggerScenarios":"Native-mode execution of Always Encrypted queries requiring an enclave (enclaveAttestationUrl / enclaveAttestationProtocol set, or querying enclave-computed columns with randomized encryption).","commonSituations":"Apps using Azure SQL Always Encrypted with secure enclaves (VBS/SGX); enabling enclave attestation settings then building native.","solutions":["Disable enclave settings (remove enclaveAttestationUrl/enclaveAttestationProtocol) in native mode","Use deterministic encryption without enclave computations","Rewrite queries to avoid operations requiring enclaves (e.g. range comparisons on encrypted columns)","Deploy in JVM mode where enclave support works"],"exampleFix":"// before\nString url = \"jdbc:sqlserver://host;database=db;columnEncryptionSetting=Enabled;enclaveAttestationUrl=https://attest.azure.net;enclaveAttestationProtocol=AAS\";\n// after\nString url = \"jdbc:sqlserver://host;database=db\";","handlingStrategy":"validation","validationCode":"if (url.contains(\"enclaveAttestationUrl\") || url.contains(\"enclaveAttestationProtocol\")) { throw new IllegalArgumentException(\"AAS Enclave Always Encrypted is not supported in native mode\"); }","typeGuard":"static boolean usesEnclave(String url) { return url != null && (url.contains(\"enclaveAttestationUrl\") || url.contains(\"enclaveAttestationProtocol\")); }","tryCatchPattern":"try { stmt.executeQuery(sql); } catch (IllegalStateException e) { if (e.getMessage().contains(\"AAS Enclave\")) { log.error(\"Enclave queries unsupported in native mode\"); } throw e; }","preventionTips":["Do not enable enclave attestation in native deployments","Design encrypted schemas to avoid enclave-only operations","Keep secure-enclave workloads in JVM mode","Document enclave limitations for the team's native profile"],"tags":["native-image","jdbc","mssql","enclave","always-encrypted"],"backgroundTag":"native-image-unsupported-feature","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}