Azure / Azure/data-api-builder

Support for Azure SQL Always Encrypted

Open
#2,444 2 comments 1 reaction 0 assignees View on GitHub
cri known-issue
Dominant language
C#
Stars
1.5k
Forks
370
Avg merge
3d 17h
Merged PRs (30d)
8

Description

Can't find a reference in the documentation so posting the question here:

Does Data API Builder have support Azure SQL Always Encrypted?

I am running a test environment using the following connection string:
Server=tcp:blabla.database.windows.net,1433;Initial Catalog=blabla;
Persist Security Info=False;User ID=blabla;Password=blabla;MultipleActiveResultSets=False;
Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;Column Encryption Setting=enabled;

Get request:
https://{{host}}/api/HRAntwoorden

Returns an error 500, the most descriptive error in the logs of the container:
Azure.DataApiBuilder.Core.Resolvers.IQueryExecutor[0]
0f284a15-472f-4cbf-b7a5-e9b060f08c9b Query execution error due to:
'FOR JSON' clause is unsupported for encrypted columns.
Microsoft.Data.SqlClient.SqlException (0x80131904): 'FOR JSON' clause is unsupported for encrypted columns.

Environment details:
- Azure SQL Database with Always Encrypted enabled connected to Azure Keyvault
- Docker container behind an NGINX proxy:
mcr.microsoft.com/azure-databases/data-api-builder latest
- Table containing an encrypted column:
[AntwoordText] [varchar](max) COLLATE Latin1_General_BIN2 ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [KEYNAME], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NULL,

The setup is working from SSMS using the following tutorial:
https://medium.com/codex/advanced-database-encryption-with-sql-server-always-encrypted-2962e468d2ab

There seems to be some support for Always Encrypted, but DAB fails because it appends FOR JSON to the end of the SQL Query. Am I missing something? Thx in advance

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.