oracle advanced authentication negotiation failed

Error message

oracle advanced authentication negotiation failed

What it means

During advanced authentication negotiation, the server reports a status for the chosen authentication service. Status 0xfbff is treated as an acceptable 'no native encryption' result; any other non-zero, non-service-list status means the server refused the advanced authentication negotiation and this library cannot proceed with the auth handshake.

Source

Thrown at plugins/services/oracle_raw.go:867

			return err
		}
		status, err := s.readANOStatus()
		if err != nil {
			return err
		}
		if status == 0xfaff && subPackets > 2 {
			if _, err = s.readANOUB1(); err != nil {
				return err
			}
			name, err := s.readANOString()
			if err != nil {
				return err
			}
			if name != "" && name != "TCPS" {
				return fmt.Errorf("unsupported oracle authentication service %s", name)
			}
		} else if status != 0xfbff {
			return errors.New("oracle advanced authentication negotiation failed")
		}
	case 2, 3:
		if _, err := s.readANOVersion(); err != nil {
			return err
		}
		algo, err := s.readANOUB1()
		if err != nil {
			return err
		}
		if algo != 0 {
			return fmt.Errorf("unsupported oracle advanced service algorithm %d", algo)
		}
		for i := 2; i < subPackets; i++ {
			if err := s.skipANOPacket(); err != nil {
				return err
			}
		}
	case 4:

View on GitHub (pinned to 95cc12e753)

Solutions

Review server sqlnet.ora (SQLNET.ENCRYPTION_SERVER / SQLNET.CRYPTO_CHECKSUM_SERVER) and relax to 'accepted'/'requested' so negotiation can succeed
Ensure client-requested crypto services in the plugin match what the server permits (AES variants, SHA digests)
Test from sqlplus with the same wallet/settings to isolate server policy vs client bug
Upgrade the plugin to a version supporting the server's chosen ANO services

Example fix

// server sqlnet.ora, before
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
// after
SQLNET.ENCRYPTION_SERVER = REQUESTED
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUESTED

Defensive patterns

Strategy: fallback

Validate before calling

// verify server-side encryption policy before connecting
// SQLNET.ENCRYPTION_SERVER should not be REQUIRED for this client
checkServerSqlnetPolicy(connInfo)

Try / catch

if err != nil && strings.Contains(err.Error(), "advanced authentication negotiation failed") {
	return fmt.Errorf("server rejected ANO auth (status != 0xfbff); check server sqlnet.ora encryption/checksum settings: %w", err)
}

Prevention

Set SQLNET.ENCRYPTION_SERVER / CRYPTO_CHECKSUM_SERVER to REQUESTED/ACCEPTED, not REQUIRED
Match client-requested crypto services (AES, SHA) to what the server allows
Validate the full auth path with sqlplus from the same host first

When it happens

Trigger: readANOServiceData processes ANO service data where status is neither 0 (accepted) nor 0xfbff, and the entry is not an authentication-service name list (e.g. 'TCPS'), during advancedNegotiation().

Common situations: Server-side sqlnet.ora enforcing encryption/data integrity settings the client cannot satisfy; mismatched Oracle Native Network Encryption configuration; server version negotiating services this client doesn't implement.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/9904242fd463283a. Report an issue: GitHub.