Why can't I connect using Python (Thin driver)?

[naxels]

Hi team,

Using Java/Clojure (JVM based)/Go programming language and/or tooling I'm able to connect to Oracle using the Thin driver/layer without any issues, however with Python I run into issues using this driver.

We are using Oracle 19c at work and my account has readonly access to ~100 tables and various schemas.
I login to the database using the SID (Service name not supported/enabled at the moment)

First issue, I have to add the option disable_oob=True to oracledb.connect() else it returns
OSError: [Errno 22] Invalid argument

Second issue, when I make that change, I get the
oracledb.exceptions.NotSupportedError: DPY-3015: password verifier type 0x939 is not supported by python-oracledb in thin mode
error.

I don't understand how I get this error in Python, while the other programming languages work without any problems using Thin driver.

Reading up on this error, it would mean they have to make a change on our Oracle server just to facilitate Python,
which I find very strange and they are not willing to do due to security risks.

Do you know what is special/different about the Python driver vs others?

Thank you!

---

For completeness I'm trying to run this code:

with oracledb.connect(user=un,
                      password=pw,
                      dsn=dsn,
                      disable_oob=True
                      ) as connection:
    with connection.cursor() as cursor:
        sql = """select sysdate from dual"""
        for r in cursor.execute(sql):
            print(r)

[anthony-tuininga]

Password verifier type 0x939 is the 10g password verifier. Disabling it is actually a security improvement, not an increased security risk! It was deliberately not implemented for that reason! The need to use disable_oob=True is a separate matter. If you are able to provide more details on the platforms in use and the general network architecture that could prove useful in figuring out how to disable OOB automatically.

[adegler99]

Thanks for your help! I will update here if I can get the connection to work after making the adjustments to the password.

[naxels]

Thank you @anthony-tuininga & @adegler99, a colleague let me know that we have to keep the sqlnet.allowed_logon_version_server=10 setting for compatibility reasons currently.

I'm hoping that somehow the 10G version can be removed from my password_versions, but likely not unless you can
manipulate an individual user's password_versions.

Regarding OOB (out-of-band breaks, disable_oob doc) what do you need to know about the config/network?

[anthony-tuininga]

The setting sqlnet.allowed_logon_version_server is simply the minimum version that is supported and it won't cause any problems. You can simply run the alter user command I mentioned earlier which should rebuild the password verifiers for that particular user alone. You can verify by checking the contents of the password_versions column of the dba_users view.

As for the disable_oob issue, I'm not sure what I need to know. It might be sufficient to simply give the full traceback. Depending on where the exception is taking place it might be possible to simply disable OOB automatically in that location! Can you provide that first and we'll see where things go from there.

[adegler99]

To be clear, you can use the same password (so long as that is permitted by the profile associated with the user) but you have to issue the alter user your_user identified by your_password command in order to rebuild the password verifiers.

Our DB team used these directions to rebuild the password verifiers and the connection is now working; this solved the issue with the DPY-3015 error in our case.

Thanks again @anthony-tuininga!

[ogroef]

@anthony-tuininga
I'm experiencing the same issue and I read some off the issues/discussions but I cannot get my head arround.

Some datails on my EBS-instance:
OS: Oracle Linux 7
DB: 19C
Python: 3.8.19
oracledb: 2.4.1

sqlnet.ora doesn't has the parameter allowed_logon_version_server

SQL*Developer (uses simple tnsname entry to connect to DB):
Password versions for the user:

SQL*Developer (uses simple tnsname entry to connect to DB):
show parameter sec_case_sensitive_logon;

PS: On the Oracle Linux we don't have an OracleClient available.

[ogroef]

@anthony-tuininga

I asked to modifify this DB parameter and this cannot be modified as this is a required parameter setting for our EBS R12.2.10 instance.
Any idea what we could do to get this working?

[cjbj]

You will have to install Instant Client and add a call to init_oracle_client() and use Thick mode.

For reference the troubleshooting doc on DPY-3015 is here.

[ogroef]

Thanks for the reply!! Appreciated.
I asked out DBA team to do so, but it takes time.