Safe to use SQLNET.ALLOWED_LOGON_VERSION_SERVER in 11g sqlnet.ora file?

Question

I have a mixed environment running both 11g and 12c databases on the same server. One of our databases was recently upgraded to 12c, and the older Oracle clients have started throwing ORA-28040 errors on connection attempts due to the use of older authentication protocols.

On the database server, each instance is installed in a separate Oracle Home with it's own Oracle software. The sqlnet.ora files in each ORACLE_HOME/network/admin directory have been created as a symbolic link to a central sqlnet.ora file on a shared NFS disk.

I would like to use the SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter in the central sqlnet.ora file to allow connections from the older clients until they can be upgraded. The concern I have is this: If the parameter is only supported by 12c, I need to be sure that including it won't cause problems for connections to the 11g databases. Is it safe to include this parameter in the sqlnet.ora file of an 11g database? Will it simply be ignored?

Answer 1

The parameter exists in 11g as well. This is the 11g documentation:

SQLNET.ALLOWED_LOGON_VERSION

Allowed Values

• 12 for the critical patch updates CPUOct2012 and later Oracle Database 11g authentication protocols (recommended)

• 11 for Oracle Database 11g authentication protocols

• 10 for Oracle Database 10g authentication protocols

• 9 for Oracle9i Database authentication protocols

• 8 for Oracle8i Database authentication protocols (default)

Answer 2

This parameter also relates to format how passwords are saved. And also what types of password hashes are generated when you change the password. IMHO You should avoid storing passwords in original 10g format, like this:

SQL> select username, PASSWORD_VERSIONS from dba_users;

USERNAME                       PASSWORD_VERSIONS
------------------------------ -----------------
SYS                            10G 11G 12C