{"record":{"id":"2670fb0bdb58955c","repo":"shadow1ng/fscan","slug":"oracle-authentication-failed","errorCode":null,"errorMessage":"oracle authentication failed","messagePattern":"oracle authentication failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":62,"sourceCode":")\n\nconst (\n\toraclePacketConnect  = 1\n\toraclePacketAccept   = 2\n\toraclePacketRefuse   = 4\n\toraclePacketRedirect = 5\n\toraclePacketData     = 6\n\toraclePacketResend   = 11\n\n\toracleNoNewPass   = 0x1\n\toracleUserAndPass = 0x100\n\n\toracleTypeRepNative    int16 = 0\n\toracleTypeRepUniversal int16 = 1\n\toracleTypeRepOracle    int16 = 10\n)\n\nvar errOracleAuthFailed = errors.New(\"oracle authentication failed\")\n\ntype oracleSession struct {\n\tconn              net.Conn\n\tin                []byte\n\tout               bytes.Buffer\n\tindex             int\n\tversion           uint16\n\tnegotiatedOptions uint16\n\tsessionDataUnit   uint32\n\ttransportDataUnit uint32\n\tacfl0             uint8\n\tacfl1             uint8\n\thandshakeComplete bool\n\tttcVersion        uint8\n\thasEOSCapability  bool\n\thasFSAPCapability bool\n\tuseBigClrChunks   bool\n\tclrChunkSize      int","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L44-L80","documentation":"errOracleAuthFailed is the sentinel the raw Oracle TNS client returns when the server rejects the credentials during the lightweight authentication handshake. When the session-level oracleError() is classified as ErrorTypeAuth, the code wraps it with %w so callers can match errors.Is(err, errOracleAuthFailed) while retaining the underlying TNS error text.","triggerScenarios":"oracleRawAuth completes the TNS handshake, the server replies with an error packet classified by classifyOracleErrorType as ErrorTypeAuth (e.g. ORA-01017 invalid username/password), and the code returns fmt.Errorf(\"%w: %v\", errOracleAuthFailed, err).","commonSituations":"Wrong password in the credential list; account locked or expired (sometimes classified as auth); connecting to a service where the schema does not exist; password file/AD integration servers rejecting simple auth.","solutions":["Verify the username/password pair manually with sqlplus or another client to confirm the credential is valid.","Match with errors.Is(err, errOracleAuthFailed) to distinguish auth failures from network/protocol failures in your scanner logic.","Unwrap the error to read the underlying ORA-code and handle specific cases (locked account vs invalid password).","Check for account lockout policies if scanning multiple credentials — repeated failures lock the account."],"exampleFix":"// before\nif err != nil {\n    log.Println(err)\n}\n// after\nif err != nil {\n    if errors.Is(err, errOracleAuthFailed) {\n        log.Println(\"bad credentials:\", err)\n    } else {\n        log.Println(\"oracle connect failed:\", err)\n    }\n}","handlingStrategy":"try-catch","validationCode":"// validate credentials shape before attempting TNS auth\nif user == \"\" || pass == \"\" {\n    return errors.New(\"oracle credentials must not be empty\")\n}","typeGuard":null,"tryCatchPattern":"err := oracleRawAuth(conn, user, pass, svc)\nif errors.Is(err, errOracleAuthFailed) {\n    // credential rejected; do not retry same creds\n    return classifyCredentialFailure(err)\n}","preventionTips":["Test each credential pair with sqlplus before bulk scanning","Use errors.Is against errOracleAuthFailed to branch auth vs network failures","Watch for account lockout when trying multiple passwords","Unwrap to inspect the specific ORA- error code"],"tags":["oracle","database","authentication","tns"],"backgroundTag":"authentication-required","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}