Runtime: GDPR + Always Encrypted

[MSRiganti]

Hi,

please read this EU regulation GDPR.

We will need functional support for SQL Always Encrypted before 25. may 2018 .

When it will be implemented in EF Core?
(Please, give it priority. It will be before 25 may 2018?)

Thanks

[shaggygi]

Probably need to move this issue to: https://github.com/aspnet/EntityFramework

[danmosemsft]

@MSRiganti please open the issue in the EF repo linked above. Thanks

[richlander]

Naive question ... will this feature require any change to System.Data? It's not an EF-only thing.

[divega]

@richlander @danmosemsft It needs support in SqlClient for it to work in .NET Core first. This support it is not in place yet, and I am not sure when it is planned but it is the gap list we have been discussing.

There is an issue tracking it for SqlClient: https://github.com/dotnet/corefx/issues/18276. We don’t have an issue tracking it for EF Core yet because we don’t consider it actionable yet.

[richlander]

We are aware of GDPR and it is something we have been investigating. Please contact me at rlander@ms if you have use-cases that you believe are important for GDPR. We want to understand them better.

[MSRiganti]

OK, done, issue is moved: github.com/aspnet/EntityFramework/issues/9193

(I have seen: 18276 and 9142 and many more.)

Thanks

(Creating a new project, and I need to correctly decide which framework to use.)

[karelz]

Duplicate of https://github.com/aspnet/EntityFramework/issues/9193

[richlander]

Can you stop closing this @karelz?

I found this resource: https://blogs.msdn.microsoft.com/sqlsecurity/2017/05/24/now-available-guide-for-enhancing-privacy-and-addressing-gdpr-requirements-with-the-microsoft-sql-platform/.

We are still talking about this and I am following up with @MSRiganti on mail to learn more.

[karelz]

@richlander I closed it based on the text above. If you think it tracks something different it would help if you can clarify what the issue actually tracks ;)
If you are following up, please assign it to yourself to express that -- see triage rules

[MSRiganti]

Hi @karelz, nice presentation yesterday in Prague at Microsoft, I was there.
In this case, I think @richlander is right.

When I run the application, and an exception occurs, which says: "Keyword not supported: 'column encryption setting'."
Because I add Column Encryption Setting=Enabled; in the Connection String.

The stack trace includes:

at System.Data.Common.DbConnectionOptions.ParseInternal(Dictionary2 parsetable, String connectionString, Boolean buildChain, Dictionary2 synonyms)
at System.Data.Common.DbConnectionOptions..ctor(String connectionString, Dictionary2 synonyms)
at System.Data.SqlClient.SqlConnectionString..ctor(String connectionString)
at System.Data.SqlClient.SqlConnectionFactory.CreateConnectionOptions(String connectionString, DbConnectionOptions previous)
at System.Data.ProviderBase.DbConnectionFactory.GetConnectionPoolGroup(DbConnectionPoolKey key, DbConnectionPoolGroupOptions poolOptions, DbConnectionOptions& userConnectionOptions)
at System.Data.SqlClient.SqlConnection.ConnectionString_Set(DbConnectionPoolKey key)
at System.Data.SqlClient.SqlConnection.set_ConnectionString(String value)
at System.Data.SqlClient.SqlConnection..ctor(String connectionString)
at Microsoft.EntityFrameworkCore.Storage.Internal.SqlServerConnection.CreateDbConnection()
at Microsoft.EntityFrameworkCore.Internal.LazyRef1.get_Value()
at Microsoft.EntityFrameworkCore.Storage.RelationalConnection.Open(Boolean errorsExpected)
at Microsoft.EntityFrameworkCore.Storage.Internal.SqlServerDatabaseCreator.<>c__DisplayClass18_0.b__0(DateTime giveUp)
at Microsoft.EntityFrameworkCore.ExecutionStrategyExtensions.<>c__DisplayClass12_02.b__0(DbContext c, TState s)
at Microsoft.EntityFrameworkCore.Storage.Internal.SqlServerExecutionStrategy.ExecuteTState,TResult
at Microsoft.EntityFrameworkCore.ExecutionStrategyExtensions.ExecuteTState,TResult
at Microsoft.EntityFrameworkCore.ExecutionStrategyExtensions.ExecuteTState,TResult
at Microsoft.EntityFrameworkCore.Storage.Internal.SqlServerDatabaseCreator.Exists(Boolean retryOnNotExists)
at Microsoft.EntityFrameworkCore.Storage.Internal.SqlServerDatabaseCreator.Exists()
at Microsoft.EntityFrameworkCore.Storage.RelationalDatabaseCreator.EnsureCreated()
at Microsoft.EntityFrameworkCore.Infrastructure.DatabaseFacade.EnsureCreated()

If you search in the dotnet/corefx for "ColumnEncryptionSetting" you will find: DbConnectionStringCommon.cs.
There is a commented out line:

//internal static readonly SqlConnectionColumnEncryptionSetting ColumnEncryptionSetting = SqlConnectionColumnEncryptionSetting.Disabled;
and the line:
internal const string ColumnEncryptionSetting = "Column Encryption Setting";

If you search: "Keyword not supported" you can find the definition:

<value>Keyword not supported: '{0}'.</value>

in file Strings.resx
and the file where it throws the exception DbConnectionOptions.Common.cs line 572

throw ADP.KeywordNotSupported(keyname);

in method

private static NameValuePair ParseInternal(Dictionary<string, string> parsetable, string connectionString, bool buildChain, Dictionary<string, string> synonyms, bool firstKey)

Am I wrong if I think that the right place for this issue is here? (dotnet/corefx)
Please explain it to me, thank you.

[karelz]

Thanks for explanation @MSRiganti ... I was confused by previous replies.

@richlander can you please mark the bug according to our triage? Is it about new API? Which area? (System.Data or all over)
I let @tarekgh push it further in Meta area ...

[tarekgh]

I moved it to System.Data.SqlClient area as it is the only stack affected here. and assigned it to @richlander as he is already following up,

[richlander]

@MSRiganti Does https://github.com/dotnet/corefx/issues/18276 cover this scenario?

[MSRiganti]

No.
Because dotnet/SqlClient#11 cover the funkcionality, not the answer, when it will be done.
My (and not just my :-) ) question is: When?
Will it be released before 25 may 2018?
According to the answers we can, or we cannot build new projects with this framework.
I found, that this funkcionality is not in plan yet.
Stackowerflow: 41027953 and 41175489
Both are from December 2016.
I guess, nothing changed. :-(

@richlander @karelz @divega @tarekgh @danmosemsft @shaggygi @corivera @stephentoub
Can someone at least tell if this functionality was included in a future version of .Net Core? What number?
Thank you very much :-)

Source GDPR

Source GDPR with description
(česky) and in other languages, if you change the url.

[tarekgh]

CC @saurabh500 @corivera

[MSRiganti]

Thank you.

[saurabh500]

Moving to future, because the owning team, won't be addressing this in 2.1

[rudiv]

With the push for GDPR updates on ASP.NET Core (yes I realise that's not .NET Core), it's sad that this hasn't made the cut for inclusion.

I'd say that it's almost critical in this current climate for data breaches and such, ensuring data integrity at rest and seamlessly for developers is quite key. Unless I'm mistaken there isn't particularly a suitable workaround at this time either, unless we moved our DB Layer to a Full Framework library?

[kevbry]

With the announcement that asp.net core 3.0 won't support full framework, lack of always encrypted support in .net core is going to block our further development using the platform. Would be good to have some feedback on when/if this is going to be available so that we can start making plans.

[karelz]

@divega can you please help here to bubble it up?

[divega]

@karelz This is duplicate of https://github.com/dotnet/corefx/issues/18276, which we are discussing already with the SQL Server team, or at least I don't see anything in this issue that makes it different.

There is an EF Core-level issue at https://github.com/aspnet/EntityFrameworkCore/issues/3380.

[karelz]

Duplicate of dotnet/SqlClient#11

[divega]

Ok, based on the title and most of the discussion this is definitively a duplicate of dotnet/SqlClient#11.

But @richlander asked before for this issue not to be closed, presumably because there was something that he wanted to follow up on?... Rich, is that still the case?