oracle redirect is not supported by lightweight auth

Error message

oracle redirect is not supported by lightweight auth

What it means

The lightweight Oracle TNS client does not implement the REDIRECT packet flow of the TNS handshake. When the listener responds with a Redirect packet (typical when the listener hands the connection off to a dispatcher or a separate node), the client cannot follow it and returns this error immediately. The connection was accepted at the listener level, but the actual session must be re-established elsewhere.

Source

Thrown at plugins/services/oracle_raw.go:214

		s.sessionDataUnit = uint32(binary.BigEndian.Uint16(p.raw[12:14]))
		s.transportDataUnit = uint32(binary.BigEndian.Uint16(p.raw[14:16]))
		if s.version >= 315 {
			s.sessionDataUnit = binary.BigEndian.Uint32(p.raw[32:36])
			s.transportDataUnit = binary.BigEndian.Uint32(p.raw[36:40])
		}
		if s.transportDataUnit < s.sessionDataUnit {
			s.sessionDataUnit = s.transportDataUnit
		}
		s.acfl0 = p.raw[22]
		s.acfl1 = p.raw[23]
		if s.version >= 315 {
			s.handshakeComplete = true
		}
		return nil
	case oraclePacketRefuse:
		return oracleRefuseError(p.raw)
	case oraclePacketRedirect:
		return errors.New("oracle redirect is not supported by lightweight auth")
	default:
		return fmt.Errorf("unexpected oracle packet type %d", p.typ)
	}
}

func oracleConnectData(host string, port int, serviceName string) string {
	address := fmt.Sprintf("(ADDRESS=(PROTOCOL=tcp)(HOST=%s)(PORT=%d))", host, port)
	connectData := "(CONNECT_DATA=(SERVICE_NAME=" + serviceName + "))"
	return "(DESCRIPTION=" + address + connectData + ")"
}

type oraclePacket struct {
	typ  uint8
	flag uint8
	raw  []byte
	data []byte
}

View on GitHub (pinned to 95cc12e753)

Solutions

Connect directly to the database node VIP/hostname instead of the SCAN or redirecting listener.
Configure the connection to use DEDICATED server mode (SERVER=DEDICATED) to avoid dispatcher redirects.
Implement REDIRECT handling in the client: parse the redirect address from the packet and reconnect to it.
Ask the DBA to disable connection redirect for this listener if direct connections are acceptable.

Defensive patterns

Strategy: fallback

Validate before calling

// prefer dedicated server to avoid redirects: include in connect data
// (CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=orcl))

Type guard

func isRedirectPacket(p oraclePacket) bool {
    return p.typ == oraclePacketRedirect
}

Try / catch

if err := s.connect(p); err != nil {
    if strings.Contains(err.Error(), "oracle redirect is not supported") {
        return connectDirect(nodeVIP, port, svc) // skip SCAN/listener redirect
    }
    return err
}

Prevention

Target node VIPs or use SCAN names configured without redirects
Request DEDICATED server mode in connect data to bypass dispatchers
Ask DBAs about RAC/shared-server redirect behavior before scanning
Parse the redirect address and reconnect if you add REDIRECT support

When it happens

Trigger: connect() (via oracleRawAuth) receives a packet with typ == oraclePacketRedirect, e.g. when the database uses shared server/dispatchers or a RAC setup where the listener redirects new connections.

Common situations: Oracle RAC or SCAN listeners redirecting to node VIPs; shared-server (MTS) configurations with dispatchers; misconfigured listener with DIRECT_HANDOFF or connection load balancing enabled.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/0ad9662af7b743c7. Report an issue: GitHub.