-
标题
After upgrading Oracle database from 11g to 12c or higher, the verify connection no longer works -
说明
Cannot validate a connection to a 12c or higher database in the Oracle agent after upgrading from a lower version below 12c (such as 11g).
-
原因
CAUSE 1
After upgrading to 12.2, accounts may become inaccessible if a setting of FALSE for the sec_case_sensitive_logon instance initialization parameter is used, because by default in 12.2 the instance is configured to run in Exclusive Mode.
For more details on Exclusive Mode, please see the section of Network Reference Manual which describes the SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter iin the Oracle online documentation here: http://docs.oracle.com/database/121/NETRF/sqlnet.htm#NETRF2016
Such a configuration would result in the server preventing all logons with an ORA-1017 "invalid username/password" error, giving the appearance that all accounts had become inaccessible.
The server configured to use case insensitive passwords.
- Case sensitivity is disabled, i.e. the instance initialization parameter sec_case_sensitive_logon has the following setting: sec_case_sensitive_logon = FALSE
or the server configured to run in Exclusive Mode.
- The server is in Exclusive Mode if the SQLNET.ORA parameter SQLNET.ALLOWED_LOGON_VERSION_SERVER is not relaxed to a value of 11 or lower, or if SQLNET.ALLOWED_LOGON_VERSION_SERVER is not present in the SQLNET.ORA configuration file.
- In Oracle release 12.2, the default value for the SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter is "12", i.e. Exclusive Mode.
CAUSE 2
In cartridges before 5.9.7.20, the logic was prior to Enhancement FOM-983 was to always use the SID as the connection type to do the validation in enabling PI and testing the connection.
-
解决办法
RESOLUTION 1
Option 1
Remove the deprecated instance initialization parameter sec_case_sensitive_logon setting of FALSE (or set sec_case_sensitive_logon to TRUE, the default),
Option 2Relax the SQLNET.ALLOWED_LOGON_VERSION_SERVER setting in the sqlnet.ora file to a more permissive setting, e.g. SQLNET.ALLOWED_LOGON_VERSION_SERVER=11, as described in the release notes section 2.12.3.1 entitled "Bug 22031049".
With this option, you will also need to change the user password again so the DBA_USERS.PASSWORD_VERSIONS will get a 10G value, however the DES based verifier is outdated and should only be used in exceptional cases when legacy client applications still need it.
Has the password been changed after the upgrade to AFTER SQLNET.ALLOWED_LOGON_VERSION_SERVER was setting is place.
If userid/password was created PRIOR to this setting, changing it again may be necessary as this setting impacts the algorithm.
RESOLUTION 2
Upgrade the Oracle cartridge to a 5.9.7.20 or higher level for Enhancement FOM-983.
-
缺陷ID
FOM-983