{"record":{"id":"9904242fd463283a","repo":"shadow1ng/fscan","slug":"oracle-advanced-authentication-negotiation-failed","errorCode":null,"errorMessage":"oracle advanced authentication negotiation failed","messagePattern":"oracle advanced authentication negotiation failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":867,"sourceCode":"\t\t\treturn err\n\t\t}\n\t\tstatus, err := s.readANOStatus()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif status == 0xfaff && subPackets > 2 {\n\t\t\tif _, err = s.readANOUB1(); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tname, err := s.readANOString()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif name != \"\" && name != \"TCPS\" {\n\t\t\t\treturn fmt.Errorf(\"unsupported oracle authentication service %s\", name)\n\t\t\t}\n\t\t} else if status != 0xfbff {\n\t\t\treturn errors.New(\"oracle advanced authentication negotiation failed\")\n\t\t}\n\tcase 2, 3:\n\t\tif _, err := s.readANOVersion(); err != nil {\n\t\t\treturn err\n\t\t}\n\t\talgo, err := s.readANOUB1()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif algo != 0 {\n\t\t\treturn fmt.Errorf(\"unsupported oracle advanced service algorithm %d\", algo)\n\t\t}\n\t\tfor i := 2; i < subPackets; i++ {\n\t\t\tif err := s.skipANOPacket(); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\tcase 4:","sourceCodeStart":849,"sourceCodeEnd":885,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L849-L885","documentation":"During advanced authentication negotiation, the server reports a status for the chosen authentication service. Status 0xfbff is treated as an acceptable 'no native encryption' result; any other non-zero, non-service-list status means the server refused the advanced authentication negotiation and this library cannot proceed with the auth handshake.","triggerScenarios":"readANOServiceData processes ANO service data where status is neither 0 (accepted) nor 0xfbff, and the entry is not an authentication-service name list (e.g. 'TCPS'), during advancedNegotiation().","commonSituations":"Server-side sqlnet.ora enforcing encryption/data integrity settings the client cannot satisfy; mismatched Oracle Native Network Encryption configuration; server version negotiating services this client doesn't implement.","solutions":["Review server sqlnet.ora (SQLNET.ENCRYPTION_SERVER / SQLNET.CRYPTO_CHECKSUM_SERVER) and relax to 'accepted'/'requested' so negotiation can succeed","Ensure client-requested crypto services in the plugin match what the server permits (AES variants, SHA digests)","Test from sqlplus with the same wallet/settings to isolate server policy vs client bug","Upgrade the plugin to a version supporting the server's chosen ANO services"],"exampleFix":"// server sqlnet.ora, before\nSQLNET.ENCRYPTION_SERVER = REQUIRED\nSQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED\n// after\nSQLNET.ENCRYPTION_SERVER = REQUESTED\nSQLNET.CRYPTO_CHECKSUM_SERVER = REQUESTED","handlingStrategy":"fallback","validationCode":"// verify server-side encryption policy before connecting\n// SQLNET.ENCRYPTION_SERVER should not be REQUIRED for this client\ncheckServerSqlnetPolicy(connInfo)","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"advanced authentication negotiation failed\") {\n\treturn fmt.Errorf(\"server rejected ANO auth (status != 0xfbff); check server sqlnet.ora encryption/checksum settings: %w\", err)\n}","preventionTips":["Set SQLNET.ENCRYPTION_SERVER / CRYPTO_CHECKSUM_SERVER to REQUESTED/ACCEPTED, not REQUIRED","Match client-requested crypto services (AES, SHA) to what the server allows","Validate the full auth path with sqlplus from the same host first"],"tags":["oracle","authentication","negotiation","encryption"],"backgroundTag":"authentication-required","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}