Oracle 11g客户端连接Oracle 12c服务器错误 ORA-28040

问题描述：

oracle服务器端版本：oracle 12.2.0.1.0
oracle客户端版本：oracle 11.2.0.1.0

在客户端访问oracle 12c提示如下错误：

sqlplus scott/scott@192.168.100.89/ocp12c
SQL*Plus: Release 11.2.0.1.0 Production on 星期三 3月 20 12:10:11 2019
Copyright (c) 1982, 2010, Oracle.  All rights reserved.
ERROR:
ORA-28040: No matching authentication protocol

问题分析

查看错详细详细：

[oracle@localhost ~]$ oerr ora 28040
28040, 0000, "No matching authentication protocol"
// *Cause:  There was no acceptable authentication protocol for
//          either client or server.
// *Action: The administrator should set the values of the
//          SQLNET.ALLOWED_LOGON_VERSION_SERVER and
//          SQLNET.ALLOWED_LOGON_VERSION_CLIENT parameters, on both the
//          client and on the server, to values that match the minimum
//          version software supported in the system.
//          This error is also raised when the client is authenticating to
//          a user account which was created without a verifier suitable for
//          the client software version. In this situation, that account's
//          password must be reset, in order for the required verifier to
//          be generated and allow authentication to proceed successfully.

在服务器端查看表：dba_users，PASSWORD_VERSIONS 列是：11G 12C

SQL> select username, account_status,password_versions from dba_users where account_status='OPEN';

USERNAME   ACCOUNT_STATUS                   PASSWORD_VERSIONS
---------- -------------------------------- -----------------
SYS        OPEN                             11G 12C
SYSTEM     OPEN                             11G 12C
SCOTT      OPEN                             11G 12C

服务器端：修改 sqlnet.ora 配置：（配置修改后，不需要重启oracle服务器）

[oracle@localhost ~]$ cd $ORACLE_HOME/network/admin
[oracle@localhost admin]$ cat sqlnet.ora
# sqlnet.ora Network Configuration File: /u01/app/oracle/product/12.2.0/dbhome_1/network/admin/sqlnet.ora
# Generated by Oracle configuration tools.
NAMES.DIRECTORY_PATH= (EZCONNECT)
# 新增如下配置
SQLNET.ALLOWED_LOGON_VERSION_SERVER=11
SQLNET.ALLOWED_LOGON_VERSION_CLIENT=11

客户端：再次尝试连接，提示用户名密码错误：

sqlplus scott/scott@192.168.100.89/ocp12c
SQL*Plus: Release 11.2.0.1.0 Production on 星期三 3月 20 12:20:32 2019
Copyright (c) 1982, 2010, Oracle.  All rights reserved.
ERROR:
ORA-01017: invalid username/password; logon denied

修改服务器端 sqlnet.ora 后，需要重新登录sqlplus，再修改用户密码，否则修改用户密码后，标记的密码版本仍然为11G 12C；
重新登录sqlplus，修改scott用户密码，并查看 PASSWORD_VERSIONS，多了一个 10G

SQL> alter user scott identified by scott;
User altered.
SQL> select username, account_status,password_versions from dba_users where account_status='OPEN';

USERNAME             ACCOUNT_STATUS                   PASSWORD_VERSIONS
-------------------- -------------------------------- -----------------
SYS                  OPEN                             11G 12C
SYSTEM               OPEN                             11G 12C
SCOTT                OPEN                             10G 11G 12C

客户端：再次尝试登录oracle 12c，成功:

sqlplus scott/scott@192.168.100.89/ocp12c
SQL*Plus: Release 11.2.0.1.0 Production on 星期三 3月 20 12:26:52 2019
Copyright (c) 1982, 2010, Oracle.  All rights reserved.
连接到:
Oracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production
SQL>

小结

综上，oracle11g 客户端连接 oracle 12c服务器，需要在服务器端配置 sqlnet.ora，并重新修改用户密码；

参考

https://community.oracle.com/message/14446765
–结束–