{"record":{"id":"46f4136e99c5322c","repo":"shadow1ng/fscan","slug":"unsupported-oracle-authentication-service-s","errorCode":null,"errorMessage":"unsupported oracle authentication service %s","messagePattern":"unsupported oracle authentication service (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":864,"sourceCode":"\tswitch serviceType {\n\tcase 1:\n\t\tif _, err := s.readANOVersion(); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tstatus, err := s.readANOStatus()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif status == 0xfaff && subPackets > 2 {\n\t\t\tif _, err = s.readANOUB1(); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tname, err := s.readANOString()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif name != \"\" && name != \"TCPS\" {\n\t\t\t\treturn fmt.Errorf(\"unsupported oracle authentication service %s\", name)\n\t\t\t}\n\t\t} else if status != 0xfbff {\n\t\t\treturn errors.New(\"oracle advanced authentication negotiation failed\")\n\t\t}\n\tcase 2, 3:\n\t\tif _, err := s.readANOVersion(); err != nil {\n\t\t\treturn err\n\t\t}\n\t\talgo, err := s.readANOUB1()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif algo != 0 {\n\t\t\treturn fmt.Errorf(\"unsupported oracle advanced service algorithm %d\", algo)\n\t\t}\n\t\tfor i := 2; i < subPackets; i++ {\n\t\t\tif err := s.skipANOPacket(); err != nil {\n\t\t\t\treturn err","sourceCodeStart":846,"sourceCodeEnd":882,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L846-L882","documentation":"During ANO service type 1 (authentication) negotiation, the server advertises an authentication service name in the status-0xfaff sub-packet. The library only supports native password auth (no service name) and TCPS (TLS); anything else (Kerberos, RADIUS, Radius/PKI, etc.) is rejected with this message naming the unsupported service.","triggerScenarios":"advancedNegotiation -> readANOServiceData(serviceType=1) reads the authentication service string and it is neither empty nor \"TCPS\", e.g. \"KERBEROS5\", \"RADIUS\", \"PKI\".","commonSituations":"The database is configured with centralized authentication (Kerberos/Active Directory external auth, RADIUS, SSL client certs with non-TCPS naming) via sqlnet.authentication_services; connecting with plain username/password to a DB that demands Kerberos.","solutions":["Set the server to accept native password authentication: in sqlnet.ora remove or adjust SQLNET.AUTHENTICATION_SERVICES to include none/TCPS as appropriate.","Use TCPS (TLS) connection with ssl variant if certificate-based auth is required, which the library supports.","If Kerberos/RADIUS is mandated, this library cannot connect; use Oracle's official driver (godror/ODPI-C) instead."],"exampleFix":"# before (sqlnet.ora on server)\nSQLNET.AUTHENTICATION_SERVICES=(KERBEROS5)\n# after\nSQLNET.AUTHENTICATION_SERVICES=(NONE)","handlingStrategy":"validation","validationCode":"// Before connecting, ensure the DB uses native password or TCPS auth:\n// run as DBA: SELECT value FROM v$parameter WHERE name='remote_login_passwordfile';\n// and check sqlnet.ora SQLNET.AUTHENTICATION_SERVICES does not force KERBEROS5/RADIUS.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep SQLNET.AUTHENTICATION_SERVICES set to (NONE) or TCPS on servers this library connects to","Use dedicated service accounts with password authentication","Document which auth methods the library supports in deployment configs"],"tags":["oracle","authentication","negotiation","unsupported-feature"],"backgroundTag":"unsupported-enum-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}