What causes "unsupported oracle authentication service %s" in shadow1ng/fscan?

Set the server to accept native password authentication: in sqlnet.ora remove or adjust SQLNET.AUTHENTICATION_SERVICES to include none/TCPS as appropriate.

shadow1ng/fscan · error

unsupported oracle authentication service %s

Error message

unsupported oracle authentication service %s

What it means

During ANO service type 1 (authentication) negotiation, the server advertises an authentication service name in the status-0xfaff sub-packet. The library only supports native password auth (no service name) and TCPS (TLS); anything else (Kerberos, RADIUS, Radius/PKI, etc.) is rejected with this message naming the unsupported service.

Source

Thrown at plugins/services/oracle_raw.go:864

	switch serviceType {
	case 1:
		if _, err := s.readANOVersion(); err != nil {
			return err
		}
		status, err := s.readANOStatus()
		if err != nil {
			return err
		}
		if status == 0xfaff && subPackets > 2 {
			if _, err = s.readANOUB1(); err != nil {
				return err
			}
			name, err := s.readANOString()
			if err != nil {
				return err
			}
			if name != "" && name != "TCPS" {
				return fmt.Errorf("unsupported oracle authentication service %s", name)
			}
		} else if status != 0xfbff {
			return errors.New("oracle advanced authentication negotiation failed")
		}
	case 2, 3:
		if _, err := s.readANOVersion(); err != nil {
			return err
		}
		algo, err := s.readANOUB1()
		if err != nil {
			return err
		}
		if algo != 0 {
			return fmt.Errorf("unsupported oracle advanced service algorithm %d", algo)
		}
		for i := 2; i < subPackets; i++ {
			if err := s.skipANOPacket(); err != nil {
				return err

View on GitHub (pinned to 95cc12e753)

Solutions

Set the server to accept native password authentication: in sqlnet.ora remove or adjust SQLNET.AUTHENTICATION_SERVICES to include none/TCPS as appropriate.
Use TCPS (TLS) connection with ssl variant if certificate-based auth is required, which the library supports.
If Kerberos/RADIUS is mandated, this library cannot connect; use Oracle's official driver (godror/ODPI-C) instead.

Example fix

# before (sqlnet.ora on server)
SQLNET.AUTHENTICATION_SERVICES=(KERBEROS5)
# after
SQLNET.AUTHENTICATION_SERVICES=(NONE)

Defensive patterns

Strategy: validation

Validate before calling

// Before connecting, ensure the DB uses native password or TCPS auth:
// run as DBA: SELECT value FROM v$parameter WHERE name='remote_login_passwordfile';
// and check sqlnet.ora SQLNET.AUTHENTICATION_SERVICES does not force KERBEROS5/RADIUS.

Prevention

Keep SQLNET.AUTHENTICATION_SERVICES set to (NONE) or TCPS on servers this library connects to
Use dedicated service accounts with password authentication
Document which auth methods the library supports in deployment configs

When it happens

Trigger: advancedNegotiation -> readANOServiceData(serviceType=1) reads the authentication service string and it is neither empty nor "TCPS", e.g. "KERBEROS5", "RADIUS", "PKI".

Common situations: The database is configured with centralized authentication (Kerberos/Active Directory external auth, RADIUS, SSL client certs with non-TCPS naming) via sqlnet.authentication_services; connecting with plain username/password to a DB that demands Kerberos.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/46f4136e99c5322c. Report an issue: GitHub.