Oracle ORA-01017 tips Oracle Database Tips by Donald Burleson

Question:  I get the following ORA-01017 error when attempting to connect using a database link:

ORA-01017: invalid username/password; logon denied

How do I resolve the ORA-01017 error?

Answer: The docs note that the ORA-01017 can have a variety of causes most relating to permissions (grant), tnsnames.ora, sqlnet.ora configuration, or improper connect string syntax.

In Oracle 12c, see bug 16385258 for the ORA-01017 error on multi-tenant databases.

An oerr search yields the following information.  Also, see my notes on diagnosing Oracle network connection issues:

ORA-01017: invalid username/password; logon denied

Cause: An invalid username or password was entered in an attempt to log on to Oracle. The username and password must be the same as was specified in a GRANT CONNECT statement. If the username and password are entered together, the format is: username/password.

Action: Enter a valid username and password combination in the correct format.

Checklist for ORA-01017 errors:

The core issue with an ORA-01017 error is an invalid user ID and passwords combination, but other than an incorrect password, there are user ID issues that may contribute to the ORA-01017 error:

• It may be that the user ID is invalid for the target system - The user ID exists as the username column in the dba_users view. 
  
  select username from dba_users;
  

• Check your $ORACLE_SID environmental parameter.  If your $ORACLE_SID is set to the wrong system ID then you may get a ORA-01017 error because you are connecting to the wrong database.
  

• If using external OS user authentication (ops$ or remote_os_authent) you need to verify that the user ID is valid.  You can tell if you are using external authentication because you connect without providing a user/password combination, and only provide a forward slash to the connect string, (e.g. connect / as sysdba;).   

• Check your tnsnames.ora to ensure that the TNS service name points to the correct server and instance name.  If you specify an incorrect tnsnames.ora service name, then the user ID and password may not exist in that database.

Reader Comments:

Thomas writes:

Your oracle dba pages offer plenty of useful informations for us, so first:
Thank you for this service.

While digging for a solution for one of our daily problems, I got to the pages for ORA-01017.

Now I want to propose a little addition to it:

Since Oracle 11 (or was it even 10?), user names and passwords are case sensitive. If you don't respect that in scripts or other sql statements, this can also lead to ORA-01017, simply because there is a mismatch in case for a user "demo" or "DEMO". And depending on tools (sql developer or others), things might still work, or not.

So you could add a little note about that new "feature" in the causes of ORA-01017, because these cases are even harder to resolve than the others. If a user doesn't exist at all or you try to connect to the wrong db, you might find out quickly. But if the user exists, just not in the right case, but scripts don't work anymore, you might end head-banging in frustration.

Matt writes:

I wanted to let you know about another instance where I got an ORA-01017 error and banged my head against the wall for a little bit before figuring it out. 

A vendor product had shipped with ojdbc14.jar.  The product needed to run a small java main against the DB to set up some tables.  I was using a 1.6 JRE. 

The error I got was an ORA-01017. 

Only after I replaced the jar with ojdbc6.jar and fix the vendor wrapper script to reference this new jar did it work. 

Odd getting an "invalid password" because of an incompatible java version, but thought it might help someone.

 

 

If you like Oracle tuning, see the book "Oracle Tuning: The Definitive Reference", with 950 pages of tuning tips and scripts.  You can buy it direct from the publisher for 30%-off and get instant access to the code depot of Oracle tuning scripts.