6 Replies Latest reply: Sep 25, 2012 7:53 AM by athompson88 RSS

    ORA-12638 with SSO

    athompson88
      I'm trying to get SSO to work as a proof-of-concept before deciding how to implement it at our company. I have a license for the ASO so that's covered. Our oracle databases run on RHEL 5 Linux, and we use Active Directory for our authentication system. I have set up a copy of AD on Windows Server 2008 R2 in an isolated network test lab, as well as an oracle database Enterprise 11.2.0.3 running on RHEL5. I have also installed the oracle client on a separate windows machine running 2008R2 as well. I followed the directions outlined int he following 2 links:

      http://docs.oracle.com/cd/E11882_01/network.112/e10746/asokerb.htm#i1006624
      http://www.freeoraclehelp.com/2011/10/kerberos-authentication-for-oracle.html

      I skipped the okinet steps in the second link as the oracle document mentioned they were unnecessary with my configuration. When I try to connect. I get the following:

      PS C:\Users\alexdba.LOCAL> sqlplus /@testdb

      SQL*Plus: Release 11.2.0.1.0 Production on Fri Aug 31 11:24:19 2012

      Copyright (c) 1982, 2010, Oracle. All rights reserved.

      ERROR:
      ORA-12638: Credential retrieval failed

      I already tried the solutions listed on the second page but they did not work.
        • 1. Re: ORA-12638 with SSO
          929328
          Hi, athompson88,
          This is quite a common problem. Here is the description:

          If the Oracle client was installed using the domain administrator account instead of the local administrator, you will see such an error.

          And now the solution:

          1) Go to /oracle home/network/admin and open sqlnet.ora
          2) Search for  SQLNET.AUTHENTICATION_SERVICES= (NTS) and change it to
          SQLNET.AUTHENTICATION_SERVICES= (NONE)
          3) Save the file and try to connect, this should work.

          If you have any questions, ask.
          Kirill Babeyev
          • 2. Re: ORA-12638 with SSO
            athompson88
            Specifying (NONE) does not solve the issue. I still receive a error retrieving credentials.
            • 3. Re: ORA-12638 with SSO
              Harm Joris ten Napel-Oracle
              Hi,

              did you see this MOS note:

              Kerberos Authentication Fails With ORA-12638 On Windows 2008 R2 (Doc ID 1225063.1)

              it looks like a good match to your issue, try to add the DES ciphers:

              1) Run gpedit.msc
              2) Go to Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options
              3) Add the DES ciphers to “Network security: Configure encryption types allowed for Kerberos”

              Please note we are currently actively promoting the new support communities also, so if you want to get some
              feedback from your peers as well as the attention of Oracle support engineers, please go to

              https://communities.oracle.com/portal/server.pt/community/database_security_products/338

              This will put you in the Database Products Security community , but you can select others also from the left,

              Greetings,

              Harm ten Napel
              Oracle Support
              • 4. Re: ORA-12638 with SSO
                921598
                Have you resolved your issue, Krill answer should work for you.
                • 5. Re: ORA-12638 with SSO
                  921598
                  in addition , you should check the following Microsoft note
                  http://support.microsoft.com/kb/931192
                  • 6. Re: ORA-12638 with SSO
                    athompson88
                    I tried this but it did not work. I see by the note that it only applies where we're not setting SQLNET.KERBEROS5_CC_NAME = <file>, but this is the method we're using.