Exception in C# code when trying to call a stored procedure with encrypted param

2 weeks ago 14
ARTICLE AD BOX

I have table with an encrypted column UserName:

enter image description here

I also have a stored procedure (in SQL Server) defined as below :

SET ANSI_NULLS ON GO SET QUOTED_IDENTIFIER ON GO ALTER PROCEDURE [dbo].[SelfServeNotes_GetReport] ( @OrderLineID INT = 0, @UserName NVARCHAR(100) = NULL, @PciAsmachta INT = 0, @CreatedFromDateValue DATETIME = NULL, @CreatedToDateValue DATETIME = NULL, @PaidDelivered INT = 99, @Barcode NVARCHAR(20) = NULL ) AS BEGIN SET NOCOUNT ON; DECLARE @Paid INT = 99; DECLARE @SendRashum INT = 99; IF @PaidDelivered = 2 BEGIN SET @Paid = 1; SET @SendRashum = 0; END ELSE IF @PaidDelivered = 1 BEGIN SET @Paid = 1; END ELSE IF @PaidDelivered = 0 BEGIN SET @Paid = 0; END IF @Barcode IS NOT NULL AND @Barcode <> '' BEGIN DECLARE @OrderLineIDTemp INT; SELECT @OrderLineIDTemp = OrderLineID FROM dbo.PCI_SelfServeNotesOrderItemData WHERE Barcode = @Barcode; IF @OrderLineIDTemp IS NULL OR @OrderLineIDTemp = 0 RETURN; IF @OrderLineID IS NULL OR @OrderLineID = 0 SET @OrderLineID = @OrderLineIDTemp; END CREATE TABLE #FilteredOrders ( OrderLineID INT PRIMARY KEY ); INSERT INTO #FilteredOrders (OrderLineID) SELECT L.OrderLineID FROM dbo.PCI_SelfServeNotesOrderLine L INNER JOIN dbo.PCI_OrderLine OL ON L.OrderLineID = OL.OrderLineID LEFT JOIN dbo.[User] U ON L.SID = U.SID LEFT JOIN dbo.PCI_OrderMasof M ON OL.OrderMasofID = M.OrderMasofID WHERE (@UserName IS NULL OR U.UserName = @UserName) AND (@OrderLineID = 0 OR L.OrderLineID = @OrderLineID) AND (@PciAsmachta = 0 OR M.OrderID = @PciAsmachta) AND (@CreatedFromDateValue IS NULL OR OL.Created_On >= @CreatedFromDateValue) AND (@CreatedToDateValue IS NULL OR OL.Created_On <= @CreatedToDateValue) AND (@Paid = 99 OR (CASE WHEN M.PaymentStatus = 1 THEN 1 ELSE 0 END) = @Paid) AND (@SendRashum = 99 OR L.RashumSent = @SendRashum); ;WITH OrderedItemData AS ( SELECT oi.OrderLineID, oi.ItemNo, oi.sendtype, oi.sendertype, oi.servicecode, oid.ExportType, ROW_NUMBER() OVER (PARTITION BY oi.OrderLineID ORDER BY oi.ItemNo) AS rn FROM dbo.PCI_SelfServeNotesOrderItem oi INNER JOIN #FilteredOrders f ON oi.OrderLineID = f.OrderLineID LEFT JOIN dbo.PCI_SelfServeNotesOrderItemData oid ON oi.OrderLineID = oid.OrderLineID AND oi.ItemNo = oid.ItemNo ), Aggregated AS ( SELECT OrderLineID, STUFF(( SELECT ',' + RTRIM(d2.sendtype) FROM OrderedItemData d2 WHERE d2.OrderLineID = d1.OrderLineID ORDER BY d2.rn FOR XML PATH(''), TYPE ).value('.', 'NVARCHAR(MAX)'), 1, 1, '') AS SendTypes, STUFF(( SELECT ',' + RTRIM(d2.servicecode) FROM OrderedItemData d2 WHERE d2.OrderLineID = d1.OrderLineID ORDER BY d2.rn FOR XML PATH(''), TYPE ).value('.', 'NVARCHAR(MAX)'), 1, 1, '') AS ServiceCodes, STUFF(( SELECT ',' + RTRIM(d2.ExportType) FROM OrderedItemData d2 WHERE d2.OrderLineID = d1.OrderLineID ORDER BY d2.rn FOR XML PATH(''), TYPE ).value('.', 'NVARCHAR(MAX)'), 1, 1, '') AS ExportTypes, STUFF(( SELECT ',' + RTRIM(d2.sendertype) FROM OrderedItemData d2 WHERE d2.OrderLineID = d1.OrderLineID ORDER BY d2.rn FOR XML PATH(''), TYPE ).value('.', 'NVARCHAR(MAX)'), 1, 1, '') AS SenderTypes FROM OrderedItemData d1 GROUP BY OrderLineID ) SELECT OM.OrderID, L.OrderLineID, U.UserName AS UserID, OM.TotalPrice AS totalprice, CASE WHEN OM.PaymentStatus = 1 THEN 1 ELSE 0 END AS PaidStatus, L.PDFDomestic, L.PDFAbroad, L.EmailSent, L.RashumSent, L.ProcessError, OL.created_on, OL.modified_on, CASE WHEN (SELECT COUNT(*) FROM PCI_SelfServeNotesOrderItemData WHERE OrderLineID = L.OrderLineID AND RefundID <> '') = 0 THEN '0' WHEN (SELECT COUNT(*) FROM PCI_SelfServeNotesOrderItemData WHERE OrderLineID = L.OrderLineID AND RefundID <> '') = (SELECT COUNT(*) FROM PCI_SelfServeNotesOrderItemData WHERE OrderLineID = L.OrderLineID) THEN '2' ELSE '1' END AS RefundID, D.DeliveryType, D.IsSendToShlihim, A.SendTypes, A.ServiceCodes, A.ExportTypes, A.SenderTypes, MAX(PCI_SelfServeNotesOrderItemData.UploadTevelStatus) AS UploadTevelStatus FROM dbo.PCI_SelfServeNotesOrderLine L INNER JOIN #FilteredOrders f ON L.OrderLineID = f.OrderLineID INNER JOIN dbo.PCI_OrderLine OL ON OL.OrderLineID = L.OrderLineID LEFT JOIN dbo.PCI_SelfServeNotesOrderItemData ON PCI_SelfServeNotesOrderItemData.OrderLineID = L.OrderLineID LEFT JOIN dbo.PCI_SelfServeNotes_Delivery D ON OL.OrderLineID = D.OrderLineID LEFT JOIN dbo.PCI_OrderMasof OM ON OL.OrderMasofID = OM.OrderMasofID LEFT JOIN dbo.[User] U ON L.SID = U.SID LEFT JOIN Aggregated A ON A.OrderLineID = L.OrderLineID GROUP BY OM.OrderID, L.OrderLineID, U.UserName, OM.PaymentStatus, OM.TotalPrice, L.PDFDomestic, L.PDFAbroad, L.EmailSent, L.RashumSent, L.ProcessError, OL.created_on, OL.modified_on, D.DeliveryType, D.IsSendToShlihim, A.SendTypes, A.ServiceCodes, A.ExportTypes, A.SenderTypes; DROP TABLE #FilteredOrders; END; GO

Here is my C# code (on .NET 4.6.2) calling this stored procedure:

string spName = string.IsNullOrEmpty(requestData.UserName) ? "GetReport" : "GetReport_WithUser"; SqlDataReader reader = null; using (var conn = new SqlConnection(connString)) using (var command = new SqlCommand(spName, conn) { CommandType = CommandType.StoredProcedure }) { // command.Parameters.Add(new SqlParameter("@OrderLineID", SqlDbType.Int)).Value = (string.IsNullOrEmpty(requestData.PciAsmachta)) ? 0 : int.Parse(requestData.PciAsmachta); if (!string.IsNullOrEmpty(requestData.UserName)) { var p = new SqlParameter("@UserName", SqlDbType.NVarChar, 100) { Value = requestData.UserName, ForceColumnEncryption = false //ONLY here }; command.Parameters.Add(p); } ... conn.Open(); reader = command.ExecuteReader(); }

When doing so, I get the following error:

On line command.ExecuteReader() - got exception : The data types nvarchar(100) encrypted with (encryption_type = 'DETERMINISTIC', encryption_algorithm_name = 'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name = 'CEK_Auto1', column_encryption_key_database_name = 'Centralinfo') and nvarchar are incompatible in the equal to operator.

I've also tried with ForceColumnEncryption = true, but I still get the exception. What can be the fix for this? In the C# part, or the stored procedure part?

Read Entire Article