mongodb/mongoid · error · ArgumentError

Specifying both key_id and key_name_field is not allowed

Error message

Specifying both key_id and key_name_field is not allowed

What it means

key_id_for was given both an explicit DEK id (key_id) and a key_name_field pointing at the key-alt-name field. An encrypted field's schema must reference its data encryption key one way, not both, so the combination is rejected.

Solutions

1. Provide either key_id or key_name_field in the encryption configuration, not both
2. Use a single key-resolution strategy for the encrypted field

When it happens

Trigger: Thrown at lib/mongoid/config/encryption.rb:200 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of mongodb/mongoid@0da0e23d71 (2026-08-23). Data as JSON: /api/errors/a2ee156ea29c1143. Report an issue: GitHub.

Appendix: source

Thrown at lib/mongoid/config/encryption.rb:200

          DETERMINISTIC_ALGORITHM
        when false
          RANDOM_ALGORITHM
        end
      end

      # Get the keyId encryption schema field for the base64 encrypted
      # key id.
      #
      # @param [ String | nil ] key_id_base64 The base64 encoded key id.
      # @param [ String | nil ] key_name_field The name of the key name field.
      #
      # @return [ Array<BSON::Binary> | String | nil ] The keyId encryption schema field,
      #   JSON pointer to the field that contains keyAltName,
      #   or nil if both key_id_base64 and key_name_field are nil.
      def key_id_for(key_id_base64, key_name_field)
        return nil if key_id_base64.nil? && key_name_field.nil?
        if !key_id_base64.nil? && !key_name_field.nil?
          raise ArgumentError, 'Specifying both key_id and key_name_field is not allowed'
        end

        if key_id_base64.nil?
          "/#{key_name_field}"
        else
          [ BSON::Binary.new(Base64.decode64(key_id_base64), :uuid) ]
        end
      end
    end
  end
end

View on GitHub (pinned to 0da0e23d71)