title: Using always encrypted on a entity framework [code first] database
body: <p>I have an MVC application that uses entity framework / code first. I'm trying to set up always encrypted in order to encrypt a column (social security number / SSN). I'm running everything in Azure, including using Azure vault to store keys.</p>
  
  <p>I have two models, SystemUser and Person. SystemUser is essentially an account / login which can administer 1 or more People.</p>
  
  <p>The definitions look a bit like:</p>
  
  <pre><code>public class Person
  {
          [StringLength(30)]
          [Column(TypeName = "varchar")]
          public string SSN { get; set; } // Social Security Number
          ...
          [Required, MaxLength(128)]
          public string SystemUserID { get; set; }
          [ForeignKey("SystemUserID")]
          public virtual SystemUser SystemUser { get; set; }
          ...
  }
  
  public class SystemUser
  {
          ...
          [ForeignKey("SystemUserID")]
          public virtual HashSet&lt;Person&gt; People { get; set; }
          ...
  }
  </code></pre>
  
  <p>I have a very basic page set up that just looks up a user and prints out their SSN. This works. I then adapted the page to update SSN and this also works. This to me implies that the Always Encrypted configuration and Azure Vault is set up correctly. I've got "Column Encryption Setting=Enabled" in the connection string and I encrypted the column SSN using SSMS (I'm using deterministic).</p>
  
  <p>In my SystemUser class I have the following method as an implementation for Identity:</p>
  
  <pre><code>public async Task&lt;ClaimsIdentity&gt; GenerateUserIdentityAsync(UserManager&lt;SystemUser&gt; manager)
  {
          ...
          if (this.People.Any())
          {
                  ...
          }
          ...
  }
  </code></pre>
  
  <p>This is used for user logins. Running the code results in a:</p>
  
  <blockquote>
    <p>System.Data.Entity.Core.EntityCommandExecutionException: An error
    occurred while executing the command definition. See the inner
    exception for details. ---> System.Data.SqlClient.SqlException:
    Operand type clash: varchar is incompatible with varchar(30) encrypted
    with (encryption_type = 'DETERMINISTIC', encryption_algorithm_name =
    'AEAD_AES_256_CBC_HMAC_SHA_256', column_encryption_key_name =
    'CEK_Auto11', column_encryption_key_database_name = 'xxx')
    collation_name = 'Latin1_General_BIN2'</p>
  </blockquote>
  
  <p>It seems to fail on the line above "if (this.People.Any())". Putting a break point just before that line reveals the following about this.People:</p>
  
  <blockquote>
    <p>'((System.Data.Entity.DynamicProxies.SystemUser_9F939A0933F4A8A3724213CF7A287258E76B1C6775B69BD1823C0D0DB6A88360)this).People'
    threw an exception of type
    'System.Data.Entity.Core.EntityCommandExecutionException' System.Collections.Generic.HashSet
    {System.Data.Entity.Core.EntityCommandExecutionException}</p>
  </blockquote>
  
  <p>Any ideas here? Am I doing something that Always Encrypted does not support?</p>