DBACOCKPIT: connect of remote database (ORA-12638)

[Former Member]

Hello Oracle-experts,

we are trying to integrate sap systems running with Oracle database centrally into Solution Manager (also running with Oracle database).

By doing so we get the error ORA-12638. We read that it should be possible to set SQLNET.AUTHENTIFICATION_SERVICES from NTS to NONE in order to avoid this error.

Unfortunately after this the ops$-user cannot be used.

Is there some workaround on the one hand to integrate sap systems running with Oracle database centrally into DBACOCKPIT into Solution manager and on the other hand still to use ops$-user?

Thank you! 

kind regards

[salome_szanto]

Hi Alex,

have you also checked the steps mentioned in the composite note 614036?
There are 7 possibilities for this issue.

Regards,
Salome

[Former Member]

Hello Salome,

yes we went trough this note. Unfortunately without any success. Please note that this note is vevy old.

kind regards

[Former Member]

Hello!

As mentioned before, we only can establish the dbacockpit connection if we change SQLNET.AUTHENTIFICATION_SERVICES from NTS to NONE.

But we search for other altertatives, because we would like to use ops$-user.

[salome_szanto]

Hello Alex,

SAP recommends SQLNET.AUTHENTICATION_SERVICES = NTS.

In the case a remote server only will be reachable if the 2 systems trust

each other otherwise the ORA-12638 will be inevitable.

If solving the problem by the the trusted connection is not possible

then parameter SQLNET.AUTHENTICATION_SERVICES = NONE will help.

But then you cannot use ops$ user.

Since OPS$ mechanism will be soon out of support you could change it to SSFS (Secure Storage in File System) instead. Note 1622837 has more info.

I also found a new note for this specific problem:
1948090 - Remote oracle database in a different not trusted windows domain

Regards,
Salome

[Former Member]

Hello Salome,

many thanks for your response!

As you allready mentioned It seems that ops$ mechanism will be out of date.

Does it also mean in future for SAP systems based on 7.40 and new Oracle version that the parameter SQLNET.AUTHENTICATION_SERVICES = NONE will be set by default instead of SQLNET.AUTHENTICATION_SERVICES = NTS?

Thank you!

[salome_szanto]

Hello Alex,

You are welcome.
The parameter should be set to NONE by yourself after the new system is installed.

Regards,
Salome

[Former Member]

Hello Salome,

we successfully implemented SSFS instead of OPS$.

We also set SQLNET.AUTHENTICATION_SERVICES = (NONE)

Now if we try to manually connect wit SAPSR3 user and e.g. restart the database we get the folowing ORA-error:

ORA-01031: insufficient privileges

Question:

How now locally to administrate the DB?

Thank you!

[salome_szanto]

Hello alex,

Great.
There should be something wrong in the SSFS configuration then.
Do you get ora-1031 when using brtools?
Could you tell me where exactly you find the error?

Regards,
Salome

[Former Member]

Hello Salome,

I did not get the error when using brtools.

The question still is how in case of SQLNET.AUTHENTICATION_SERVICES = (NONE) and SSFS implementation the oracle database will be started and stopped e.g. with MMC?

If I try to start SAP system via MMC I get the error with strdbs.cmd.

There I found the comando "sqlplus / as sysdba". This can not work...

Thank you!

[salome_szanto]

Hi Alex,
SQLNET.AUTHENTICATION_SERVICES can be set to "none" only when SAP is using SSFS completely. If even a small part is missing then authization errors occur.
Did you perform all the required steps to adopt SSFS?

1639578 - SSFS as password storage for primary database connect

1622837 - Secure connection of AS ABAP to Oracle via SSFS

Regards,
Salome

[Former Member]

Hello Salome,

I am pretty sure that we implemented all the requiered parts of SSFS.

The db start script strdbs.cmd contains comando "sqlplus / as sysdba".

In your sap notes I have not seen that this script should be adapted after the activation of SSFS.

kind regards

[Former Member]

Hello Salome/oracle-experts,

I have looked into new installed SAP system (SAP ERP with EHP7, Windows 2012 R2) and found  that SQLNET.AUTHENTICATION_SERVICES there is set to NTS.

Are there some confirmation from SAP support that the setting SQLNET.AUTHENTICATION_SERVICES = NONE will be supported for SAP systems on Windows?

Thank you!

kind regards

[divyanshu_srivastava3]

Hi,

I would suggest you to read below notes and come back if those are not helpful or working.

"1265134 - DBA Cockpit: Connecting a remote database and 1261329 - DBA Cockpit: Oracle as a remote database"

As these should be your start point in connecting remote Oracle DB to solution manager.

Regards,

[Former Member]

Hello Divyanshu,

of course we already read the notes you mentioned.

Unfortunately our problem is the ORA-12638, because we try to integrate SAP system that is reside in other domain. 

kind regards