Oracle Database Error Solutions & DBA Knowledge Base

Welcome to Oracle Database Error Solutions, a professional technical knowledge base dedicated to helping Oracle Database Administrators, Oracle E-Business Suite administrators, developers, and IT professionals troubleshoot Oracle Database and Oracle Linux issues with confidence.

This website provides practical, real-world troubleshooting guides based on hands-on Oracle administration experience. You'll find detailed solutions for Oracle Database errors, RMAN backup and recovery, Data Guard, ASM, RAC, Oracle Linux administration, Oracle E-Business Suite (EBS), cloning, performance tuning, patching, installation, and day-to-day DBA tasks.

Whether you're resolving ORA-27101, ORA-28040, ORA-01555, ORA-12154, ORA-01017, or other Oracle errors, our step-by-step articles are designed to save you time and help you solve problems efficiently.

ORA-01017: Invalid Username/Password; Logon Denied – Complete Troubleshooting Guide

Published: April 2026

Last Updated: July 2026

Reading Time: 12–15 Minutes

Applies To: Oracle Database 11g, 12c, 18c, 19c, 21c and Oracle Database 23ai

The ORA-01017: Invalid Username/Password; Logon Denied error is one of the most frequently encountered Oracle Database authentication errors. It occurs when Oracle cannot authenticate a user during the login process because the supplied credentials or authentication configuration are incorrect.

Although the error message appears straightforward, the underlying cause is not always an incorrect password. ORA-01017 can also result from password case sensitivity, expired passwords, locked accounts, authentication protocol mismatches, incorrect service names, or application configuration issues.

This guide explains the Oracle authentication process, common causes of ORA-01017, step-by-step troubleshooting techniques, real-world production scenarios, and best practices to prevent future login failures.

Quick Solution

If you receive ORA-01017, verify the following:

Username is spelled correctly.
Password is entered correctly.
Password case matches exactly.
The account is not locked.
The password has not expired.
You are connecting to the correct database service.
The application is using the correct credentials.

Most ORA-01017 errors are resolved by correcting authentication credentials or identifying account status issues.

What is ORA-01017?
How Oracle Authentication Works
Error Message
Common Symptoms
Common Causes
Authentication Workflow
Step-by-Step Solutions
Real Production Scenario
Best Practices
Frequently Asked Questions
Related Oracle Articles

What is ORA-01017?

ORA-01017 indicates that Oracle Database rejected the supplied authentication credentials during the login process.

Whenever a client attempts to establish a database session, Oracle validates:

The username.
The password.
The authentication protocol.
The account status.
Password expiration.
Password profile restrictions.

If any authentication check fails, Oracle immediately terminates the login attempt and returns ORA-01017.

How Oracle Authentication Works

Understanding Oracle's authentication process helps identify the true source of ORA-01017.

Application / SQL*Plus

        │

        ▼

Send Username

        │

        ▼

Send Password

        │

        ▼

Oracle Authentication

        │

        ▼

Check Account Status

        │

        ▼

Validate Password

        │

        ▼

Create Database Session

If any validation step fails, Oracle denies access and returns ORA-01017 before creating the user session.

DBA Tip

Many administrators assume ORA-01017 always means an incorrect password. In production environments, it can also indicate expired passwords, incorrect service connections, authentication protocol mismatches, or applications using outdated stored credentials.

Error Message

ORA-01017:
invalid username/password; logon denied

The error may occur while connecting through:

SQL*Plus
Oracle SQL Developer
RMAN
Oracle Data Pump
Oracle E-Business Suite
JDBC Applications
Oracle Instant Client
Enterprise applications

Common Symptoms

SQL*Plus login fails immediately.
Applications cannot connect to Oracle.
RMAN authentication fails.
Data Pump Import or Export cannot authenticate.
Oracle E-Business Suite login errors.
Scheduled jobs stop connecting after a password change.
Applications work on one server but fail on another.

Common Causes

ORA-01017 can be caused by one or more of the following:

Incorrect username.
Incorrect password.
Password case sensitivity.
Expired password.
Locked database account.
Connecting to the wrong database.
Incorrect service name.
Application using old credentials.
Password changed but configuration not updated.
Authentication protocol mismatch.
Incorrect Oracle Wallet configuration.
Username created with quoted identifiers.

Authentication Workflow

ORA-01017

      │

      ▼

Verify Username

      │

      ▼

Verify Password

      │

      ▼

Check Password Case

      │

      ▼

Check Account Status

      │

      ▼

Verify Service Name

      │

      ▼

Review Application Configuration

      │

      ▼

Login Successful

Following this structured approach allows administrators to isolate authentication problems quickly and avoid unnecessary database changes.

Step-by-Step Solutions

Successfully resolving ORA-01017 requires identifying where the authentication process fails. Follow the steps below in order to diagnose and resolve the problem efficiently.

Solution 1 – Verify Username and Password

The first step is to ensure that both the username and password are correct.

Example:

sqlplus system/MyPassword@ORCL

Check the following:

Username spelling is correct.
Password spelling is correct.
No leading or trailing spaces.
Correct database service is being used.
Password has not recently been changed.

DBA Recommendation

If authentication suddenly starts failing, verify whether the password was recently changed by another DBA or through an automated password rotation policy.

Solution 2 – Check Password Case Sensitivity

Since Oracle Database 11g, passwords are case-sensitive by default.

For example:

Oracle123

is different from:

oracle123

Verify that:

Caps Lock is not enabled.
The application stores the correct password.
No automatic conversion to uppercase or lowercase occurs.

Solution 3 – Check Whether the Account is Locked

Even when credentials are correct, Oracle may reject authentication if the account is locked.

Query the account status:

SELECT username,
       account_status
FROM dba_users
WHERE username='SCOTT';

If the account is locked, unlock it:

ALTER USER scott ACCOUNT UNLOCK;

Important

Repeated failed login attempts can automatically lock accounts depending on the assigned password profile.

Solution 4 – Check Whether the Password Has Expired

Expired passwords also prevent successful authentication.

Check account status:

SELECT username,
       account_status
FROM dba_users
WHERE username='SCOTT';

If the account shows EXPIRED, reset the password:

ALTER USER scott
IDENTIFIED BY NewPassword123;

Solution 5 – Verify Password Profile

Password profiles may enforce:

Password lifetime
Password reuse restrictions
Failed login limits
Account lock duration

View the assigned profile:

SELECT username,
       profile
FROM dba_users
WHERE username='SCOTT';

Display profile limits:

SELECT resource_name,
       limit
FROM dba_profiles
WHERE profile='DEFAULT';

Solution 6 – Verify the Correct Database

Many environments contain Development, Test, UAT, and Production databases with identical usernames but different passwords.

Verify that the application is connecting to the intended database.

Check the database name:

SELECT name
FROM v$database;

Solution 7 – Verify the Service Name

An incorrect service name may direct the connection to a different database where the supplied credentials are invalid.

Check the configured service:

SHOW PARAMETER service_names;

Compare this value with the SERVICE_NAME configured in your client connection.

Solution 8 – Verify Application Configuration

Applications frequently store database credentials in configuration files.

Examples include:

WebLogic Data Sources
Oracle E-Business Suite Context Files
Spring Boot configuration
JDBC property files
Application servers
Connection pools

After changing a database password, ensure every application configuration has been updated.

Solution 9 – Verify Oracle Wallet Configuration

When Oracle Wallet is used for passwordless authentication, verify that:

Wallet files exist.
Wallet location is correct.
Credentials stored inside the wallet are current.
Wallet permissions are valid.

Solution 10 – Check Quoted Usernames

Oracle usernames created with double quotes become case-sensitive.

Example:

CREATE USER "Scott"
IDENTIFIED BY Oracle123;

This account is different from:

SCOTT

Quoted identifiers should generally be avoided unless specifically required.

Real Production Case Study

A production Oracle E-Business Suite environment suddenly began reporting ORA-01017 after a scheduled password change for the APPS schema.

Initial investigation confirmed that:

The database was open.
The listener was running.
The APPS account was unlocked.
The password worked successfully through SQL*Plus.

Further investigation revealed that the WebLogic datasource continued using the previous password.

Corrective action:

Updated datasource credentials.
Restarted managed servers.
Validated application connectivity.

The application resumed normal operation immediately without any database restart.

Common Authentication Problems

Problem	Result
Wrong Username	ORA-01017
Wrong Password	ORA-01017
Password Expired	ORA-01017
Locked Account	Login Failure
Wrong Service Name	ORA-01017
Old Application Password	ORA-01017
Case-Sensitive Password	ORA-01017
Quoted Username	Authentication Failure

Oracle RAC Considerations

In Oracle Real Application Clusters (RAC), authentication is performed by the database service regardless of which node accepts the client connection. ORA-01017 may occur when applications connect to the wrong service, use outdated credentials, or reference an incorrect connect descriptor.

When troubleshooting ORA-01017 in RAC environments, verify the following:

The application connects using the correct RAC service.
SCAN listeners are resolving correctly.
The service is registered with the listener.
The application uses the latest credentials after password changes.
All connection pools have been refreshed.

RAC Best Practice

Avoid connecting directly to individual RAC nodes. Use SCAN listeners and database services for better availability and simplified administration.

Oracle Cloud Infrastructure (OCI) Considerations

When connecting to Oracle databases hosted on Oracle Cloud Infrastructure (OCI), authentication failures may also be caused by wallet configuration or outdated client connection settings.

Verify:

Oracle Wallet is correctly configured.
Wallet credentials are current.
Network connectivity to the database is available.
The correct service name is selected.
The database user exists in the target database.

Oracle DBA Authentication Checklist

Before resetting passwords or modifying database users, review this checklist:

Verification Item	Status
Correct Username	☐
Correct Password	☐
Password Case Verified	☐
Correct Database	☐
Correct SERVICE_NAME	☐
Account Unlocked	☐
Password Not Expired	☐
Application Configuration Updated	☐
Connection Pool Restarted	☐
Wallet Configuration Verified	☐

Common Mistakes

Typing the password incorrectly.
Ignoring password case sensitivity.
Connecting to the wrong database.
Using an incorrect SERVICE_NAME.
Not updating application passwords after a password reset.
Ignoring account lock or password expiration.
Using old Oracle Wallet credentials.
Creating usernames with quoted identifiers.

Best Practices

Use strong passwords that comply with your organization's security policy.
Document password rotation procedures.
Update application credentials immediately after password changes.
Monitor failed login attempts.
Review password profiles regularly.
Use Oracle Wallet where appropriate for secure credential management.
Avoid sharing privileged database accounts.
Enable auditing for important database users.

Frequently Asked Questions

Does ORA-01017 always mean the password is incorrect?

No. While incorrect passwords are the most common cause, ORA-01017 can also result from expired passwords, locked accounts, incorrect service names, application configuration issues, or authentication protocol mismatches.

Can password case sensitivity cause ORA-01017?

Yes. Oracle Database 11g and later versions use case-sensitive passwords by default. Ensure that the password is entered with the correct capitalization.

How can I check whether an account is locked?

SELECT username,
       account_status
FROM dba_users
WHERE username='SCOTT';

Can Oracle E-Business Suite generate ORA-01017?

Yes. If the APPS password changes but application configuration files or WebLogic data sources are not updated, Oracle E-Business Suite components may return ORA-01017.

Can JDBC applications return ORA-01017?

Yes. Incorrect usernames, passwords, JDBC URLs, or outdated connection pool credentials can all trigger authentication failures.

About the Author

Rana Abdul Wahid is a seasoned Oracle Database Consultant with over 15 years of professional experience in Oracle Database Administration, Oracle E-Business Suite Application DBA, Oracle Cloud Infrastructure (OCI), Oracle RAC, Oracle Data Guard, RMAN Backup & Recovery, Performance Tuning, Linux/Unix Administration, MySQL, Microsoft SQL Server, PostgreSQL, and enterprise database management.

Through this blog, he shares practical Oracle troubleshooting guides, production-tested solutions, and real-world DBA experience to help database administrators, developers, and IT professionals solve complex Oracle issues.

Learn more about the author →

Conclusion

The ORA-01017: Invalid Username/Password; Logon Denied error is one of the most common Oracle authentication problems. Although incorrect credentials are the primary cause, many production environments experience ORA-01017 because of expired passwords, locked accounts, incorrect service names, outdated application credentials, or configuration mismatches.

By following a structured troubleshooting approach—verifying usernames and passwords, checking account status, reviewing password profiles, validating service names, and ensuring application configurations are up to date—you can resolve authentication failures quickly while minimizing downtime.

Final DBA Advice

Before resetting a user's password, identify the actual cause of the authentication failure. In many cases, the problem lies in application configuration, expired credentials, or environment-specific settings rather than the database account itself.

Did this guide help you resolve ORA-01017? Bookmark this article and explore our complete Oracle Error Codes Guide for more production-tested Oracle DBA solutions.

Oracle Database Error Solutions & DBA Knowledge Base