Connecting to a database using Kerberos authentication

I have a 10gR2 database for which I want to enable connection using Kerberos authenntication. I receive the following error:
ORA-12637: Packet receive failed.
In the sqlnet server trace I get the following error:
nauk5ky_rd_req_decoded: Returning 31: Decrypt integrity check failed.
Ideas anyone?

The problem appears to be that one active directory user can act as service principal for only one database server (or one RAC instance).
If more than one service principals are created (by ktpass utility) for the same AD user, only the last created one can successfully authenticate. Logins to all other servers are unsuccessful and result in ORA-12637 at the client and ORA-07445 [nauk5a3recvclientauth()+568] in the server alert log.
The workaround is to create a separate AD user account for each database server (or RAC instance) authenticated by the kerberos.
Edited by: dbr2 on 27-Feb-2009 07:18

Similar Messages

WinRM cannot process the request. The following error occured while using Kerberos authentication: The network path was not found.

I have two forests with a transitive on-way trust between them: PROD -> TEST (test trusts PROD). I had previously had kerberos authentication working with winrm from PROD to machines in TEST. I have verified the trust is healthy, I also verified users
in TEST can use WINRM with kerberos just fine. Users from PROD cannot connect via kerberos to machines in TEST with winrm.
I have verified the service has registered the appropriate SPNs. I ran dcdiag against all my PROD and TEST domain controllers and didn't find anything that would prevent kerberos from happening. I even tried disabling the firewall entirely on my TEST dcs
but that didn't gain me anything.
I've enabled kerberos logging but only see the expected errors such as it couldn't find a PROD SPN for the machine, which it shouldn't from what I understand, it should go to the TEST domain and find the SPN from there.
I'm really out of next steps before I call PSS and hope someone here has run into this and could provide me some next steps.
PowerShell Error:
Connecting to remote server failed with the following error message : WinRM cannot process the request. The following error occured while using Kerberos authentication: The network path was not found.
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does not exist.
-The client and remote computers are in different domains and there is no trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
-For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
+ CategoryInfo : OpenError: (:) [], PSRemotingTransportException
+ FullyQualifiedErrorId : PSSessionStateBroken
winrs Error:
Winrs error:
WinRM cannot process the request. The following error occured while using Kerberos authentication: The network path was not found.
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does not exist.
-The client and remote computers are in different domains and there is no trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
-For more information about WinRM configuration, run the following command: winrm help config.

Hi Adam,
I'm a little unclear about which SPNs you were looking for, in which case could you confirm you were checking that on the computer object belonging to the actual destination host it has the following SPNs registered?
WSMAN/<NetBIOS name>
WSMAN/<FQDN>
If you were actually trying to use WinRM to connect to the remote forest's domain controllers, then what you said makes sense, but I was caught between assuming this was the case or you meant another member server in that remote forest.
Also, from the client trying to connect to this remote server, are you able to telnet to port 5985? (If you've used something other than the default, try that port)
If you can't, then you've got something else like a firewall (be that the Windows firewall on the destination or a hardware firewall somewhere in between) blocking you at the port level, or the listener on the remote box just isn't working as expected. I
just replied to your other winrm post with steps for checking the latter, so I won't repeat myself here.
If you can telnet to it and the SPNs exist, then you might be up against something called selective authentication which has to do with how the trust was defined. You can have a read of
this to learn a bit more about selective trusts and whether or not it's affecting you.
Cheers,
Lain

Exchange 2010 sp2 emc initialization error using "kerberos" authentication failed

We use exchange 2010 SP2.
We have 2 management stations, both w2k8 R2 SP1.
I have one mangement station on which the emc and ems works ok.
On the other management staiton (which is also in another ad site) the emc and ems don't work.
I get the following error message : The attempt to connect to
http://fqdnCasServer/PowerShell using "Kerberos" authentication failed: Connecting to remote server failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.
I have checked the time on the management station and on the exchange server and this is ok.
It is not a permissions issue because the user functions ok on the other management station.
On the bad management station I can open the emc once and after a minute I get an error message and the message access denied. From then on I can't connect any more.
What am I doing wrong?
Anyone any tips?
Thanks,
JB

This is what I get in the eventlog of the bad management station.
Log Name:      MSExchange Management
Source:        MSExchange CmdletLogs
Date:          1/10/2012 11:39:27
Event ID:      6
Task Category: (1)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Server.domain.com
Description:
The description for Event ID 6 from source MSExchange CmdletLogs cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Get-ExchangeServer
{Identity=Servername}
Domain/ou/ou/ou/ou/username
Exchange Management Console-Local
3080
22
00:00:00.3593888
View Entire Forest: 'True', Configuration Domain Controller: 'FQDN DC', Preferred Global Catalog: 'FQDN DC', Preferred Domain Controllers: '{ FQDN DN }'
Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException: The operation couldn't be performed because object 'FQDN MGMTSTATION' couldn't be found on 'FQDN DC'.
Context
the message resource is present but the message is not found in the string/message table
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="MSExchange CmdletLogs" />
    <EventID Qualifiers="49152">6</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-10-01T09:39:27.000000000Z" />
    <EventRecordID>11</EventRecordID>
    <Channel>MSExchange Management</Channel>
    <Computer>FQDN MGMT STATION</Computer>
    <Security />
</System>
<EventData>
    <Data>Get-ExchangeServer</Data>
    <Data>{Identity=MGMT STATION}</Data>
    <Data>domain/ou/ou/ou/ou/username</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>Exchange Management Console-Local</Data>
    <Data>3080</Data>
    <Data>
    </Data>
    <Data>22</Data>
    <Data>00:00:00.3593888</Data>
    <Data>View Entire Forest: 'True', Configuration Domain Controller: 'FQDN DC', Preferred Global Catalog: 'FQDN DC', Preferred Domain Controllers: '{ FQDN DC }'</Data>
    <Data>Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException: The operation couldn't be performed because object 'FQDN MGMT STATION' couldn't be found on 'FQDN DC'.</Data>
    <Data>Context</Data>
    <Data>
    </Data>
</EventData>
</Event>

Unable to connect to Oracle Database using Oracle Sql developer 2.1.1.64

Hi Everyone,
I am searching for some help regarding my problem with Oracle connectivity. I have installed Oracle 11g release 2 on my Windows XP Professional Laptop. For a few days after installation i could connect to the Oracle database with the SYSTEM account using Oracle SQL developer ( installed on the same Laptop) but now i am unable to do so.It gives me this annoying message:
An error was encountered performing the required operation Got a minus one from read call .Vendor code 0
However i am able to connect using Sql Plus by supplying the username SYSTEM and the corresponding password.
My TNSNAMES .ora file is as follows:
ORACLE =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST =localhost)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = ORACLE)
ORACLR_CONNECTION_DATA =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
(CONNECT_DATA =
(SID = CLRExtProc)
(PRESENTATION = RO)
My Listener.ora file is as follows:
SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
(SID_NAME = CLRExtProc)
(ORACLE_HOME = D:\app\product\11.2.0\dbhome_1)
(PROGRAM = extproc)
(ENVS = "EXTPROC_DLLS=ONLY:D:\app\product\11.2.0\dbhome_1\bin\oraclr11.dll")
(SID_DESC =
(GLOBAL_DBNAME = Oracle)
(ORACLE_HOME = D:\app\product\11.2.0\dbhome_1)
(SID_NAME = Oracle)
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
(PROTOCOL_STACK =
(PRESENTATION = GIOP)
(SESSION = RAW)
ADR_BASE_LISTENER = D:\app
My Sqlnet.ora file is as follows:
SQLNET.AUTHENTICATION_SERVICES= (NTS)
NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
I am new to Oracle and so i need someone in this forum who can help me resolve this problem. Also i even tried connecting to the database using Toad 10.5.0.41. It give me the following error:
ORA 12537 : TNS Connection closed
Thanks for your patience and help in advance.
---Prashant

Hello Irian and Sue,
I can connect to the Oracle database using SQL Plus. Now when i TNSPING ORACLE from command line i get the following message :
Used parameter files:
D:\app\product\11.2.0\dbhome_1\network\admin\sqlnet.ora
Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST =localhost
*)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = ORACLE)))*
TNS-12537: TNS:connection closed
Thanks for your response to my initial post.Do u have any other methods to resolve this?

How can I connect to the database using ODBC within excel.

Hi,
How can I connect to the database using ODBC within excel and just refresh the data when needed.
Thanks,
Priyanka
Edited by: user554934 on Jun 9, 2009 2:53 AM

This is NOT an APEX relevant question, try posting it in the SQL/PL/SQL Forum..
Thank you,
Tony Miller
Webster, TX

Connection to multiple databases using a single EJB

How can I connect to multiple Databases (using @PersistenceContext) using an EJB?
Did I need to connect various Entity Managers corresponding to the each database and simply send my Queries?
I am using Glassfish Application Server
Netbeans IDE
Java Derby Database
Oracle Database
Java Persistence API
Thanks in Advance

Yes, you need a persistence context and thus entity manager per database. Depending on what you want to achieve you may also need to go to the next level in your skill set and learn all about distributed transactions.

Connect to oracle database using c program

I am using AIX environment and i want to connect to oracle database using c program.

http://download.oracle.com/docs/cd/E11882_01/appdev.112/e10825/pc_03dbc.htm#i5880

How to connect to 9i database using 8i sqlplus?

Hello,
My Oracle server is running 9.2.0.1
My Oracle client processes run on the same machine using Oracle 8i (ORACLE_HOME is set to 8i home).
I cannot connect to 9i database using 8i sqlplus.
My ORACLE_HOME for client environment is set to 8i home.
How can I access 9i database using 8i sqlplus?
Thanks in advance!

I saw this answered in another thread:
8i sqlplus not working on 9i
Please try not to cross post.
Alison

How to connect to oracle10g Database using oracle11g Enterprise Manager.

Hi,
please suggest me how to connect to oracle10g Database using oracle11g Enterprise Manager.
i did setting in tnsnames.ora file of oracle11g database but when i am trying to connect sys@testvsr and password
using oracle11g Enterprise manager its not connecting but from command prompt its connecting.
its not acccepting hostname its simply telling invalid username and password ,if i remove and try to connect its connecting.
so please suggest its very urgent my manager is nagging.
Regards,
Srinu.

you cant attach a database 10g instance with
Enterprise manager of 11g as enterprise manager is
meant for a single database only .. your problem cant be solved
enterprise manager it can be solved by using GRID CONTROL
For more details visit oracle documentation..
Hope This helps..
BI TC

How to configure the applet use Kerberos authentication

Hi all:
I know few about the java or applet security and hope someone can help me.
I have a MS IIS Web server named win2003stdbase1 and it use Kerberos authentication, and the
web server host a jar file.The client machine has jdk1.5 installed.When the client visit a html page which contains a java applet,the jre starts the applet and a dialog "Password Needed -Networking" popups.Then we input the right user name and the password,but the dialog popup again.The dialog display these message:
Server: win2003stdbase1/192.168.0.43
Scheme: ntlm
UserName:
Password:
Domain:
I suspect that the applet use the ntlm authentcation method which different from the web server,and I want it to use Kerberos authentication.How can I achieve this?
Any suggestion or idear will be appreciated.Thanks.

Are there anyone can help on this? It is a urgent issue. Also if I did not explain it clearly, please let me know.Thanks.

Using Kerberos authentication on Forms and Reports version 11.1.2

Hi
I have configured Kerberos authentication for Forms on the server and it works fine, but I cannot get it to work for Reports.
When I access the database for Forms I use a connect string that looks like this: /@tns_name The Forms server is running using a domain user and the database user is externally identified. It just works.
I have tried the same for Reports but it is not accepted. In the URL I have written userid=/@tns_name and the Reports server then asks for user id and password with a pre filled tns_name. I have tried to put the userid parameter in cgicmd.dat but the result is the same. Even enabled SSO in rwservlet.properties using singlesignon>yes</singlesignon> but it just do not work.
I have bounced the server every time I have made a change to be absolutely that the changes had taken effect.
The question is: How do I tell the Reports server that I do not want to apply user id and password but just the tns_name, like /@tns_name
I know Kerberos authentication is not an area that is well known and I have spent hours over the years to find out how to make the configuration work.

Questions regarding version compabilities come up quite often, yet the answer is still the same: have a look at the certification matrix http://www.oracle.com/technetwork/developer-tools/forms/oracle-forms-11gr2certmatrix-519680.xls
for installation instructions on your chosen platform have a look at the installation manual: http://docs.oracle.com/cd/E24269_01/doc.11120/e23960/toc.htm
What do you plan to do with SOA suite? This isn't needed for forms&reports.
cheers

ORA-12514 when trying to connect to the database using SERVICE

Hi,
Version 10204
In a single instance database i would like to create new SERVICEs in order to use them later with Resource Manager.
The instance name is DWH.
I run the following commands:
I added to the tnsnames.ora file the following input:
XYZ =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = xxx)(PORT = 1522))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = XYZ)
As SYSDBA i execute:
> exec DBMS_SERVICE.CREATE_SERVICE('xyz','xyz');
PL/SQL procedure successfully completed.
> exec DBMS_SERVICE.START_SERVICE('xyz');
PL/SQL procedure successfully completed.
But when i tried to connect to the instance:
sqlplus ac/ac@xyzSQL*Plus: Release 10.2.0.4.0 - Production on Sat Nov 1 14:44:43 2008
Copyright (c) 1982, 2007, Oracle. All Rights Reserved.
ERROR:
ORA-12514: TNS:listener does not currently know of service requested in connect
descriptor
When i am trying to connect , not via the service , its successed:
sqlplus ac/ac@dwh
SQL*Plus: Release 10.2.0.4.0 - Production on Sat Nov 1 14:45:07 2008
Copyright (c) 1982, 2007, Oracle. All Rights Reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
Could you please help to understand why its failed to connect via SERVICE ?
Thanks

You told us.
ORA-12514: TNS:listener does not currently know of service requested in connect descriptor.
I ask some questions, you set alias for listener port (no default) + local_listener parameter, don't you?
If you did....
Please check by .....
lsnrctl status
lsnrctl service
Let me show my example:
About 1522 (no default port)
SQL> show parameter local_listener
NAME TYPE VALUE
local_listener string ALIASLISTENER
- check tnsnames.ora file in the same location listener.ora file.
$ cat tnsnames.ora
ALIASLISTENER=
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost )(PORT = 1522))
- About create new service
SQL> show parameter service_names
NAME TYPE VALUE
service_names string db
SQL> exec DBMS_SERVICE.CREATE_SERVICE('xyz','xyz');
PL/SQL procedure successfully completed.
SQL> exec DBMS_SERVICE.START_SERVICE('xyz');
PL/SQL procedure successfully completed.
SQL> show parameter service_names
NAME TYPE VALUE
service_names string xyz
$ lsnrctl status
LSNRCTL for Linux: Version 11.1.0.6.0 - Production on 02-NOV-2008 03:29:21
Copyright (c) 1991, 2007, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=hostname)(PORT=1522)))
STATUS of the LISTENER
Alias LISTENER
Version TNSLSNR for Linux: Version 11.1.0.6.0 - Production
Start Date 02-NOV-2008 03:28:45
Uptime 0 days 0 hr. 0 min. 36 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File ORACLE_HOME/network/admin/listener.ora
Listener Log File ORACLE_HOME/log/diag/tnslsnr/hostname/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=hostname)(PORT=1522)))
Services Summary...
Service "db" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
Service "db2XDB" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
Service "db_XPT" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
Service "xyz" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
$ lsnrctl service
LSNRCTL for Linux: Version 11.1.0.6.0 - Production on 02-NOV-2008 03:29:40
Copyright (c) 1991, 2007, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=hostname)(PORT=1522)))
Services Summary...
Service "db" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:0 refused:0 state:ready
LOCAL SERVER
Service "db2XDB" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
Handler(s):
"D000" established:0 refused:0 current:0 max:972 state:ready
DISPATCHER <machine: hostname, pid: 30200>
(ADDRESS=(PROTOCOL=tcp)(HOST=hostname)(PORT=45572))
Service "db_XPT" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:0 refused:0 state:ready
LOCAL SERVER
Service "xyz" has 1 instance(s).
Instance "db", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:0 refused:0 state:ready
LOCAL SERVER
The command completed successfully

Remote PowerShell Connection to Lync Server With Kerberos authentication Fails

Hi everyone ,
Remote PowerShell to Lync Server With Kerberos authentication Fails .. Is there any reason for not being able to connect when authentication specified as Kerberos . But exactly same code works when Authentication is specified as "Negotiate"
E.g :
Error -
$session=New-PSSession -ConfigurationName Microsoft.Powershell -ConnectionUri https://serverName.lync.com/ocspowershell/ -Credential $cred -Authentication Kerberos
[serverName.lync.com] Connecting to remote server failed with the following error message : The WinRM client cannot process the request. The authentication mechanism requested by the client is not supported by the server or unencrypted traffic is disabled in
the service configuration. Verify the unencrypted traffic setting in the service configuration or specify one of the authentication mechanisms supported by the server. To use Kerberos, specify the computer name as the remote destination. Also verify
that the client computer and the destination computer are joined to a domain.To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password. Possible authentication mechanisms reported by
server:   Digest Negotiate For more information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportExc
   eption
    + FullyQualifiedErrorId : PSSessionOpenFailed
Works -
$session=New-PSSession -ConfigurationName Microsoft.Powershell -ConnectionUri https://serverName.lync.com/ocspowershell/ -Credential $cred -Authentication Negotiate

Hi,
Please double check if Windows Update is the latest version, if not, please update and then test again.
Please also ensure that the workstation you are using has network access to the Certificate Authority that signed the certificate.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Use PI to connect to ext system using kerberos/spnego

Hi
Is it possible to configure PI to call external web service using kerberos/spnego? If so, how is it done?
It is said to be supported, but after looking I find no sign of anyone who has implemented this with PI.
Thank you
regards Ole

Using PI you can connect to external webservice via SOAP adapter. Please check with SOAP reciever configuration. For authentication you will use Kerberos.
Soap receiver adapter [link|http://help.sap.com/saphelp_nw04/helpdata/en/29/5bd93f130f9215e10000000a155106/content.htm]
To know kerberos configuration you might want to see this...
Re: Setting up Kerberos Authentication in Trusted Domain

Connect to remote database using ODBC

I am new to TimesTen and I would like some help connecting to remote timesten database using ODBC.
I followed all the instructions in the manual to setup (like logical server and all). but, when I try to connect using "connect dsn=myRemoteDSN" command, it does not work. It gives me this error: 7001: User authentication failed
It is asking me for username and password but I dont know how to setup username and password. Looked all over the internet and I could not find any relevant posts. I have already tried "unchecking" the authentication, but it still asks me for username and password.

thanks for your help. I did not realize that that I turned on ACL. creating a user and then granting the needed permissions did the trick.
I now have another problem. I use windows platform and .NET 2.0 (C#) to connect to remote timesten database. The driver provided by timesten (as part of installation) does not seem to support ADO.NET. I get "driver does not support this function" exception when I try to insert data into a table. Ironically, it does insert the data successfully, but still generates the exception. I looked at various forums.. everyone seems to have the same problem, but have not had any solution yet?
Could you let me know if you encountered this issue before and how you might have resolved it?
Many thanks
Murthy

Connecting to a database using Kerberos authentication

Similar Messages

Maybe you are looking for