quarkusio/quarkus · error · IllegalStateException

Quarkus does not support AAS Enclave

Error message

Quarkus does not support AAS Enclave

What it means

Quarkus substitutes initEnclaveParameters to throw IllegalStateException in native mode. Always Encrypted with secure enclaves (Azure SQL / SQL Server enclave attestation) relies on classes removed by the native build, so enclave-enabled queries cannot be executed.

Source

Thrown at extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java:47

    @Substitute
    private SqlAuthenticationToken getFedAuthToken(QuarkusSqlFedAuthInfo fedAuthInfo) {
        throw new IllegalStateException("Quarkus does not support Active Directory based authentication");
    }

    @Substitute
    private void setKeyVaultProvider(String keyStorePrincipalId) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support Keyvault-based column encryption");
    }

    @Substitute
    private void setKeyVaultProvider(String keyStorePrincipalId, String keyStoreSecret) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support Keyvault-based column encryption");
    }

    @Substitute
    ArrayList<byte[]> initEnclaveParameters(SQLServerStatement statement, String userSql, String preparedTypeDefinitions,
            QuarkusSqlParameter[] params, ArrayList<String> parameterNames) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support AAS Enclave");
    }
}

@TargetClass(className = "com.microsoft.sqlserver.jdbc.SQLServerCertificateUtils")
final class QuarkusSqlSQLServerCertificateUtils {
    @Substitute
    static KeyManager[] getKeyManagerFromFile(String certPath, String keyPath, String keyPassword)
            throws IOException, GeneralSecurityException, SQLServerException {
        throw new IllegalStateException("Quarkus does not support Client Certificate based authentication");
    }
}

@TargetClass(className = "com.microsoft.sqlserver.jdbc.SQLServerLexer")
@Delete //Deleting this one explicitly, so to help with maintenance with the substitutions of SQLServerFMTQuery
final class SQLServerLexerRemove {

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Disable enclave settings (remove enclaveAttestationUrl/enclaveAttestationProtocol) in native mode
2. Use deterministic encryption without enclave computations
3. Rewrite queries to avoid operations requiring enclaves (e.g. range comparisons on encrypted columns)
4. Deploy in JVM mode where enclave support works

Example fix

// before
String url = "jdbc:sqlserver://host;database=db;columnEncryptionSetting=Enabled;enclaveAttestationUrl=https://attest.azure.net;enclaveAttestationProtocol=AAS";
// after
String url = "jdbc:sqlserver://host;database=db";

if (url.contains("enclaveAttestationUrl") || url.contains("enclaveAttestationProtocol")) { throw new IllegalArgumentException("AAS Enclave Always Encrypted is not supported in native mode"); }

static boolean usesEnclave(String url) { return url != null && (url.contains("enclaveAttestationUrl") || url.contains("enclaveAttestationProtocol")); }

try { stmt.executeQuery(sql); } catch (IllegalStateException e) { if (e.getMessage().contains("AAS Enclave")) { log.error("Enclave queries unsupported in native mode"); } throw e; }

When it happens

Trigger: Native-mode execution of Always Encrypted queries requiring an enclave (enclaveAttestationUrl / enclaveAttestationProtocol set, or querying enclave-computed columns with randomized encryption).

Common situations: Apps using Azure SQL Always Encrypted with secure enclaves (VBS/SGX); enabling enclave attestation settings then building native.

Related errors

• Quarkus does not support Keyvault-based column encryption
• Quarkus does not support Active Directory based authenticati
• Quarkus does not support Client Certificate based authentica
• It is not supported to connect to SQL Server versions older
• It is not possible to enable the useFmtOnly option on Quarku

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7ffd72c78977c997. Report an issue: GitHub.