quarkusio/quarkus · error · IllegalStateException

Quarkus does not support Keyvault-based column encryption

Error message

Quarkus does not support Keyvault-based column encryption

What it means

Quarkus substitutes SQLServerConnection.setKeyVaultProvider(String) in native mode with a stub that throws IllegalStateException. Azure Key Vault based Always Encrypted column encryption requires Azure SDK classes not supported in the native image, so it is explicitly blocked with a clear message.

Source

Thrown at extensions/jdbc/jdbc-mssql/runtime/src/main/java/io/quarkus/jdbc/mssql/runtime/graal/com/microsoft/sqlserver/jdbc/SQLServerJDBCSubstitutions.java:36

}

@TargetClass(className = "com.microsoft.sqlserver.jdbc.Parameter")
final class QuarkusSqlParameter {

}

@TargetClass(className = "com.microsoft.sqlserver.jdbc.SQLServerConnection")
final class QuarkusSQLServerConnection {

    @Substitute
    private SqlAuthenticationToken getFedAuthToken(QuarkusSqlFedAuthInfo fedAuthInfo) {
        throw new IllegalStateException("Quarkus does not support Active Directory based authentication");
    }

    @Substitute
    private void setKeyVaultProvider(String keyStorePrincipalId) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support Keyvault-based column encryption");
    }

    @Substitute
    private void setKeyVaultProvider(String keyStorePrincipalId, String keyStoreSecret) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support Keyvault-based column encryption");
    }

    @Substitute
    ArrayList<byte[]> initEnclaveParameters(SQLServerStatement statement, String userSql, String preparedTypeDefinitions,
            QuarkusSqlParameter[] params, ArrayList<String> parameterNames) throws SQLServerException {
        throw new IllegalStateException("Quarkus does not support AAS Enclave");
    }
}

@TargetClass(className = "com.microsoft.sqlserver.jdbc.SQLServerCertificateUtils")
final class QuarkusSqlSQLServerCertificateUtils {
    @Substitute
    static KeyManager[] getKeyManagerFromFile(String certPath, String keyPath, String keyPassword)

View on GitHub (pinned to e1c734241f)

Solutions

Disable Always Encrypted / column encryption (remove columnEncryptionSetting=Enabled) in native mode
Use a Windows Certificate Store or Java keystore based column master key instead of Key Vault
Keep the workload in JVM mode where Key Vault column encryption is supported
Store sensitive data outside encrypted columns if native deployment is mandatory

Example fix

// before
String url = "jdbc:sqlserver://host;database=db;columnEncryptionSetting=Enabled;keyStorePrincipalId=...";
// after
String url = "jdbc:sqlserver://host;database=db";

Defensive patterns

Strategy: validation

Validate before calling

if (url.contains("keyStorePrincipalId") || url.contains("columnEncryptionSetting=Enabled")) { throw new IllegalArgumentException("Key Vault column encryption is not supported in native mode"); }

Type guard

static boolean usesKeyVaultEncryption(String url) { return url != null && (url.contains("keyStorePrincipalId") || url.contains("columnEncryptionSetting=Enabled")); }

Try / catch

try { conn = ds.getConnection(); } catch (IllegalStateException e) { if (e.getMessage().contains("Keyvault")) { log.error("Disable Always Encrypted with Key Vault in native mode"); } throw e; }

Prevention

Disable columnEncryptionSetting in native profiles
Use non-KeyVault column master keys if encryption is mandatory
Keep Always Encrypted workloads on JVM deployments
Review driver feature flags when migrating to native

When it happens

Trigger: Native-mode connection using Always Encrypted with a key store principal (columnEncryptionSetting=Enabled with KeyVaultProvider, or driver-side setKeyVaultProvider(String keyStorePrincipalId) call).

Common situations: Apps using Always Encrypted columns backed by Azure Key Vault; enabling columnEncryptionSetting after migrating to native image.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/67c5c918da4c78e6. Report an issue: GitHub.