ORA-12638: Credential retrieval failed
I’m hunting down more or less a sporadic error that sometimes our users get during initial attempt to connect to Oracle server.
– this error was never raised on NT4 domain; it was first noticed shortly after we migrated all our clients to Active Directory
– we don’t use OS authentication, all users are using classic Oracle accounts
– we do have
SQLNET.AUTHENTICATION_SERVICES = (NTS) in the sqlnet.ora on all client machines
– so far, the only workaround is to remove
SQLNET.AUTHENTICATION_SERVICES = (NTS) from sqlnet.ora on all worstations
– another observation is that we usually get several trace files generated in UDUMP, such as:
Dump file d:\oracle\admin\ora\udump\orcl_ora_3920.trc Tue Aug 21 08:18:17 2007 ORACLE V10.2.0.2.0 - Production vsnsta=0 vsnsql=14 vsnxtr=3 Oracle Database 10g Enterprise Edition Release 10.2.0.2.0 - Production With the Partitioning, OLAP and Data Mining options Windows Server 2003 Version V5.2 Service Pack 1 CPU : 4 - type 586, 4 Physical Cores Process Affinity : 0x00000000 Memory (Avail/Total): Ph:2488M/8190M, Ph+PgF:4528M/10044M, VA:1411M/3071M Instance name: orcl Redo thread mounted by this instance: 1 Oracle process number: 36 Windows thread id: 3920, image: ORACLE.EXE (SHAD) opiino: Attach failed! error=-1 ifvp=00000000
– Metalink Note:399727.1 “Opiino: Attach Failed! Error=-1 Ifvp=0″ Written Many Times Per Minute In Udump File And ORA-12500 In Listener.log” doesn’t apply to our situation, because there is only one database running on the server. Also, we do not observe ORA-12500 in the listener.log – this is weird.
Based on Event Log message at the client:
Warning - LsaSrv - SPNEGO (Negotiator) - Event 40961 The Security System could not establish a secured connection with the server email@example.com. No authentication protocol was available.
…I would say that this is an OS issue, not an Oracle Net bug. Google search revealed that Event 40961 is usually a consequence of miss-configured DNS (missing reverse lookup entry for the server), but not in our case. If I’ll ever find the culprit for the error I’ll update this thread with a solution.