shadow1ng/fscan · error

%w: %v

Error message

%w: %v

What it means

This is a wrapped error: when the server replies with TTC message 4 or 9 carrying an error, and the classified error type is authentication, the library wraps the server's ORA- error with errOracleAuthFailed using %w so errors.Is(err, errOracleAuthFailed) works. The final message looks like 'oracle authentication failed: ORA-01017: invalid username/password'.

Source

Thrown at plugins/services/oracle_raw.go:1523

		}
		s.putKeyValString(kv.key, kv.val, kv.flag)
	}
	if err := s.writeData(); err != nil {
		return err
	}
	for {
		msg, err := s.getByte()
		if err != nil {
			return err
		}
		if err := s.readMsg(msg); err != nil {
			return err
		}
		if msg == 4 || msg == 9 {
			if s.hasError() {
				err := s.oracleError()
				if classifyOracleErrorType(err) == ErrorTypeAuth {
					return fmt.Errorf("%w: %v", errOracleAuthFailed, err)
				}
				return err
			}
			return nil
		}
	}
}

func oracleAlterSession() string {
	_, offset := time.Now().Zone()
	hours := int8(offset / 3600)
	minutes := int8((offset / 60) % 60)
	if minutes < 0 {
		minutes = -minutes
	}
	tz := fmt.Sprintf("%+03d:%02d", hours, minutes)
	return fmt.Sprintf("ALTER SESSION SET NLS_LANGUAGE='AMERICAN' NLS_TERRITORY='AMERICA'  TIME_ZONE='%s'\x00", tz)
}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Read the wrapped ORA- error (%v part) and fix the root cause — most commonly ORA-01017: verify username/password.
2. Check account status: SELECT account_status FROM dba_users WHERE username='...'; unlock or reset if LOCKED/EXPIRED.
3. In code, use errors.Is(err, errOracleAuthFailed) to branch to credential-renewal logic (e.g. re-fetch secrets) rather than retrying blindly.

Example fix

// before
err := db.Connect(dsn) // panic/log generic
// after
if err := db.Connect(dsn); err != nil {
    if errors.Is(err, errOracleAuthFailed) {
        creds := refreshCredentials() // rotate/re-fetch
        dsn = buildDSN(creds)
    }
}

err := connectAuth(ctx, cfg)
if errors.Is(err, errOracleAuthFailed) {
    creds := rotateOrRefetchCredentials()
    return retryAuth(ctx, cfg.WithCredentials(creds))
}
if err != nil { return err }

When it happens

Trigger: oracleRawAuth processes a server response message 4 (error) or 9, s.hasError() is true, and classifyOracleErrorType maps the extracted ORA- error to ErrorTypeAuth (e.g. ORA-01017 invalid username/password, ORA-28000 account locked).

Common situations: Wrong username/password in the DSN; password expired (ORA-28001) or account locked (ORA-28000); connecting to a CDB/PDB with wrong common-user prefix; credentials rotated in a secret store but not updated in the app config.

Related errors

• oracle authentication failed
• oracle advanced authentication negotiation failed
• oracle authentication protocol internal error
• oracle session key should be either 64 or 96 bytes long
• NLA auth failed: error code %d (0x%X)

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/4b5954c39eae448f. Report an issue: GitHub.