连接Oracle 12c R2 PDB报错ORA-28040/ORA-01017

郑全

客户环境中有大量低版本客户端的要注意了,如果想使用oracle 12c r2,必须把客户端升级到11.2.0.3及以上版本,否则,就无法正常登陆,报口令不对的错误:
以下是转贴的一个文章:

测试环境安装了一套Oracle 12c R2的数据库，想要通过PL/SQL developer连接上数据库，但是报错

ORA-28040: No matching authentication protocol



上网查了原因：Oracle 12c的参数SQLNET.ALLOWED_LOGON_VERSION默认等于11。当我们使用11g JDBC之前版本的thin驱动连接的时候，就会报错。

于是按网上的方法解决方法来做：

在数据库服务器上的oracle/network/admin/sqlnet.ora文件添加一行SQLNET.ALLOWED_LOGON_VERSION=8

修改之后再次连接却又报错ORA-01017: invalid username/password; logon denied



确认用户名和密码是没问题的，但就是连接不上，在服务器端就可以连接

[oracle@t13s ~]$ sqlplus pdbadmin@pdb1

SQL*Plus: Release 12.2.0.1.0 Production on Fri Mar 17 10:25:22 2017

Copyright (c) 1982, 2016, Oracle.  All rights reserved.

Enter password:
Last Successful login time: Thu Mar 16 2017 20:28:26 +08:00

Connected to:
Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production

PDBADMIN@pdb1>

于是在MOS上搜索相关文档，查到这样一篇文章Client / Server Interoperability Support Matrix for Different Oracle Versions (文档 ID 207303.1)

从文章中可以看出只有11.2.0.3及以上的版本的客户端才能连接12.2版本的服务端。再检查本地的Oracle客户端的版本是11.2.0.1，原来是客户端版本太低了，安装12.1版本的客户端，顺利登录。

MOS文章大致内容如下：

Client
Version Server Version
12.2.0#10 12.1.0 11.2.0 11.1.0 10.2.0 10.1.0 9.2.0
12.2.0 Yes Yes Yes No No No#3 No#3
12.1.0 Yes Yes Yes Was MDS #7 No#3 No#3
11.2.0 Yes#9 Yes Yes Was MDS #7 No Was #5
11.1.0 No Was Was Was Was #7 Was #6 Was #5
10.2.0 No MDS #7 MDS #7 Was #7 MDS Was Was #5
10.1.0#4 No No Was #6 Was #6 Was Was Was
9.2.0 No No#8 Was #5 Was #5 Was #5 Was Was


Key:


Yes Supported
ES Supported but fixes only possible for customers with Extended Support .
LES or MDS Supported but fixes only possible for customer with a valid Limited Extended Support or Market-Driven Support contract respectively.
Was Was a supported combination but one of the releases is no longer covered by any of Premier Support, Primary Error Correct support, Extended Support, nor Extended Maintenance Support. Fixes are no longer possible.
No Has never been Supported

Specific Notes:

#1 - See Note:207319.1#2 - An ORA-3134 error is incorrectly reported if a 10g client tries to connect to an 8.1.7.3 or lower server. See Note:3437884.8 .#3 - An ORA-3134 error is correctly reported when attempting to connect to this version.#4 - There are problems connecting from a 10g client to 8i/9i where one is EBCDIC based. See Note:3564573.8#5 - For connections between 10.2 (or higher) and 9.2 the 9.2 end MUST be at 9.2.0.4 or higher. Connections between 10.2 (or higher) and 9.2.0.1, 9.2.0.2 or 9.2.0.3 have never been supported.#6 - For connections between 11.1 (or higher) database server and 10.1 / 10.2 database server across a database link the 10g end MUST be at 10.1.0.5 / 10.2.0.2 (or higher) respectively in order to use PLSQL between those versions. (This does not apply to normal 11g clients to 10g database server only server to server and a few very specific client products, such as Oracle Forms). See Note:4511371.8 for more details.#7 - For database link connections between 11.1 (or higher) and 10.2 the 10g end MUST be at 10.2.0.2 (or higher) in order to use PLSQL between those versions. See Note:4511371.8 for more details.#8 - Attempting to connect from 9.2 to 12.1 will fail with an "ORA-28040: No matching authentication protocol" error.#9 - 11.2.0.3 or 11.2.0.4 only. We do not support any 11.2 client interoperability with Oracle Database Exadata Express Cloud Service#10 - Includes Oracle Database Exadata Express Cloud Service - see Note:2183770.1 for additional details

General Notes:

1.For database links between different Oracle versions connections must be supported in BOTH directions in the matrix above.
eg: As 11.2 -> 10.1 is not supported then database links between these version are not supported in either direction.


2.Unsupported combinations may appear to work but can encounter errors for particular operations. The fact that they appear to work should not be relied upon - issues on unsupported combinations will not be investigated.


3.Since new database servers are compatible with a limited set of older OCI clients, it may not be necessary to upgrade the client software when upgrading the database. However, some new features may not work without upgrading the client software. For example, an Oracle 10.2 client is able to connect to an 11.2 database, but is not able to take advantage of newer features such as Client Result Cache (introduced in 11.1).


4.Oracle Applications , or other Oracle products, may have supported configurations not listed in the matrix above.


5.The matrix above also applies between different platforms and between 32/64 bit releases of Oracle client / server except where any Oracle platform desupport notice indicates otherwise .


6.Unix BEQUEATH (BEQ) connections are NOT supported between different releases. eg: Client 10.2 is not supported to make an Oracle Net connection to a 11.2 server using the BEQ protocol adapter regardless of the interoperability support listed above. See Note:364252.1 for more details.

郑全

注意，如果是 12c rac，需要在服务器端的 oracle用户下添加 sqlnet.ora。不是grid 用户下，添加后，不需要重启监听，立即生效。

郑全

注意，如果是 12c rac，需要在服务器端的 oracle用户下添加 sqlnet.ora。不是grid 用户下，添加后，不需要重启监听，立即生效。

这个很重要。
具体参见：12c and Later Releases: ORA-28040 After Upgrade: No Matching Authentication Protocol (Doc ID 1957995.1)