quarkusio/quarkus · error · IllegalStateException

Quarkus does not support Active Directory based authenticati

Error message

Quarkus does not support Active Directory based authentication

What it means

In native mode Quarkus substitutes SQLServerConnection.getFedAuthToken with a stub that throws IllegalStateException, because the Azure Active Directory authentication flow in the Microsoft SQL Server JDBC driver relies on dynamically loaded classes that cannot be supported in a native image.

Source

Thrown at extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java:31

import com.oracle.svm.core.annotate.Substitute;
import com.oracle.svm.core.annotate.TargetClass;

@TargetClass(className = "com.microsoft.sqlserver.jdbc.SQLServerConnection", innerClass = "SqlFedAuthInfo")
final class QuarkusSqlFedAuthInfo {

}

@TargetClass(className = "com.microsoft.sqlserver.jdbc.Parameter")
final class QuarkusSqlParameter {

}

@TargetClass(className = "com.microsoft.sqlserver.jdbc.SQLServerConnection")
final class QuarkusSQLServerConnection {

    @Substitute
    private SqlAuthenticationToken getFedAuthToken(QuarkusSqlFedAuthInfo fedAuthInfo) {
        throw new IllegalStateException("Quarkus does not support Active Directory based authentication");
    }

    @Substitute
    private void setKeyVaultProvider(String keyStorePrincipalId) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support Keyvault-based column encryption");
    }

    @Substitute
    private void setKeyVaultProvider(String keyStorePrincipalId, String keyStoreSecret) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support Keyvault-based column encryption");
    }

    @Substitute
    ArrayList<byte[]> initEnclaveParameters(SQLServerStatement statement, String userSql, String preparedTypeDefinitions,
            QuarkusSqlParameter[] params, ArrayList<String> parameterNames) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support AAS Enclave");
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Switch to SQL server authentication (user=...;password=...) or integrated Kerberos-style auth that does not use fedAuth
Use a credential injected at the SQL Server level (SQL login) instead of Entra ID
Perform the AAD token acquisition yourself outside the driver if the driver version supports accessToken; verify native support before relying on it
Keep the service in JVM mode where AAD authentication works

Example fix

// before
String url = "jdbc:sqlserver://server.database.windows.net:1433;database=db;authentication=ActiveDirectoryDefault";
// after
String url = "jdbc:sqlserver://server.database.windows.net:1433;database=db;user=sqluser;password=...";

Defensive patterns

Strategy: validation

Validate before calling

if (url.contains("authentication=ActiveDirectory")) { throw new IllegalArgumentException("Active Directory auth is not supported in native mode; use SQL auth"); }

Type guard

static boolean usesAadAuth(String url) { return url != null && url.contains("authentication=ActiveDirectory"); }

Try / catch

try { conn = ds.getConnection(); } catch (IllegalStateException e) { if (e.getMessage().contains("Active Directory")) { log.error("Use SQL authentication in native mode"); } throw e; }

Prevention

Use SQL logins for native-image deployments
Avoid authentication=ActiveDirectory* in production native configs
Check Quarkus MSSQL extension docs before enabling new auth modes
Add a startup config validator that rejects fedAuth settings in native builds

When it happens

Trigger: Opening a SQL Server connection in native mode with authentication=ActiveDirectoryPassword, ActiveDirectoryIntegrated, ActiveDirectoryDefault, ActiveDirectoryManagedIdentity, ActiveDirectoryServicePrincipal, or any fedAuth-based scheme.

Common situations: Apps deployed to Azure using Entra ID (Azure AD) credentials for the DB; migrating a JVM build to native; connection strings copied from Azure portal defaults using AAD auth.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/411950f328b3a9df. Report an issue: GitHub.