quarkusio/quarkus · error · UnsupportedOperationException

Authentication strategy 'dialog' is not supported in GraalVM

Error message

Authentication strategy 'dialog' is not supported in GraalVM

What it means

The MariaDB 'dialog' authentication (PAM-based) plugin requires interactive terminal input, which GraalVM native images cannot perform. Quarkus substitutes SendPamAuthPacketFactory.initialize with a stub that throws UnsupportedOperationException, so any connection attempt that negotiates the PAM/dialog authentication strategy fails immediately in native mode.

Source

Thrown at extensions/jdbc/jdbc-mariadb/runtime/src/main/java/io/quarkus/jdbc/mariadb/runtime/graal/SendPamAuthPacketFactory_Substitutions.java:16

package io.quarkus.jdbc.mariadb.runtime.graal;

import org.mariadb.jdbc.Configuration;
import org.mariadb.jdbc.HostAddress;
import org.mariadb.jdbc.plugin.AuthenticationPlugin;

import com.oracle.svm.core.annotate.Substitute;
import com.oracle.svm.core.annotate.TargetClass;

@TargetClass(className = "org.mariadb.jdbc.plugin.authentication.standard.SendPamAuthPacketFactory")
public final class SendPamAuthPacketFactory_Substitutions {

    @Substitute
    public AuthenticationPlugin initialize(String authenticationData, byte[] seed, Configuration conf,
            HostAddress hostAddress) {
        throw new UnsupportedOperationException("Authentication strategy 'dialog' is not supported in GraalVM");
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Switch the MariaDB user/account to a non-dialog auth plugin (e.g. mysql_native_password) or use a service account without PAM.
2. Run the application in JVM mode if PAM/dialog authentication is mandatory.
3. Use certificate/mTLS-based authentication configured so the 'dialog' plugin is never negotiated.
4. Track upstream Quarkus/MariaDB driver support for native-compatible dialog authentication.

Example fix

// before
CREATE USER 'app'@'%' IDENTIFIED VIA pam USING 'mariadb'; // dialog auth

// after
CREATE USER 'app'@'%' IDENTIFIED VIA mysql_native_password USING '...'; // native-image friendly

if (ImageInfo.inImageRuntimeCode() && usesPamAuth(mariaDbUrl)) {
    throw new IllegalStateException("PAM/dialog auth not supported in native image");
}

boolean dialogSafe = !ImageInfo.inImageRuntimeCode() || !authPlugin.equals("dialog");

try { ds.getConnection(); } catch (UnsupportedOperationException e) { /* dialog/PAM auth negotiated in native image */ }

When it happens

Trigger: Connecting (native image) to a MariaDB server configured with PAM authentication so the server selects the 'dialog' auth plugin during the handshake; mariadb-java-client instantiates SendPamAuthPacketFactory and the substituted initialize throws at SendPamAuthPacketFactory_Substitutions.java:16.

Common situations: Deploying a Quarkus app as a native executable against a MariaDB instance with PAM authentication enabled (common in enterprise setups); works in JVM mode but fails at startup/first connection in native.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Cannot parse version from output: ${stringOutput}
• Not Implemented in native mode
• Unable to create new instance for ${clazz}
• .pfa font files are not supported. Use TrueType fonts, i.e.
• .pfb font files are not supported. Use TrueType fonts, i.e.

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7d74779f71e770f0. Report an issue: GitHub.