quarkusio/quarkus · error · UnsupportedOperationException

Authentication strategy 'dialog' is not supported in GraalVM

Error message

Authentication strategy 'dialog' is not supported in GraalVM

What it means

The MariaDB 'dialog' authentication (PAM-based) plugin requires interactive terminal input, which GraalVM native images cannot perform. Quarkus substitutes SendPamAuthPacketFactory.initialize with a stub that throws UnsupportedOperationException, so any connection attempt that negotiates the PAM/dialog authentication strategy fails immediately in native mode.

Solutions

Switch the MariaDB user/account to a non-dialog auth plugin (e.g. mysql_native_password) or use a service account without PAM.
Run the application in JVM mode if PAM/dialog authentication is mandatory.
Use certificate/mTLS-based authentication configured so the 'dialog' plugin is never negotiated.
Track upstream Quarkus/MariaDB driver support for native-compatible dialog authentication.

Example fix

// before
CREATE USER 'app'@'%' IDENTIFIED VIA pam USING 'mariadb'; // dialog auth

// after
CREATE USER 'app'@'%' IDENTIFIED VIA mysql_native_password USING '...'; // native-image friendly

Defensive patterns

Strategy: validation

Validate before calling

if (ImageInfo.inImageRuntimeCode() && usesPamAuth(mariaDbUrl)) {
    throw new IllegalStateException("PAM/dialog auth not supported in native image");
}

Type guard

boolean dialogSafe = !ImageInfo.inImageRuntimeCode() || !authPlugin.equals("dialog");

Try / catch

try { ds.getConnection(); } catch (UnsupportedOperationException e) { /* dialog/PAM auth negotiated in native image */ }

Prevention

Verify the MariaDB server auth plugin for your account before shipping native builds
Add a native-mode startup test that establishes a DB connection
Prefer native-password or TLS-certificate auth for native deployments
Document JVM-only authentication strategies per deployment mode

When it happens

Trigger: Connecting (native image) to a MariaDB server configured with PAM authentication so the server selects the 'dialog' auth plugin during the handshake; mariadb-java-client instantiates SendPamAuthPacketFactory and the substituted initialize throws at SendPamAuthPacketFactory_Substitutions.java:16.

Common situations: Deploying a Quarkus app as a native executable against a MariaDB instance with PAM authentication enabled (common in enterprise setups); works in JVM mode but fails at startup/first connection in native.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7d74779f71e770f0. Report an issue: GitHub.

Appendix: source

Thrown at extensions/jdbc/jdbc-mariadb/runtime/src/main/java/io/quarkus/jdbc/mariadb/runtime/graal/SendPamAuthPacketFactory_Substitutions.java:16

package io.quarkus.jdbc.mariadb.runtime.graal;

import org.mariadb.jdbc.Configuration;
import org.mariadb.jdbc.HostAddress;
import org.mariadb.jdbc.plugin.AuthenticationPlugin;

import com.oracle.svm.core.annotate.Substitute;
import com.oracle.svm.core.annotate.TargetClass;

@TargetClass(className = "org.mariadb.jdbc.plugin.authentication.standard.SendPamAuthPacketFactory")
public final class SendPamAuthPacketFactory_Substitutions {

    @Substitute
    public AuthenticationPlugin initialize(String authenticationData, byte[] seed, Configuration conf,
            HostAddress hostAddress) {
        throw new UnsupportedOperationException("Authentication strategy 'dialog' is not supported in GraalVM");
    }

}

View on GitHub (pinned to e1c734241f)