SEC_CASE_SENSITIVE_LOGON set to false? That is deprecated in 12c. This is a known issue that I encountered many times.
Case-Insensitive Passwords and ORA-1017 Invalid Username or Password
The Oracle Database 12c release 2 (12.2) default authentication
protocol is 12 (Exclusive Mode). This protocol requires case-sensitive
passwords for authentication. Review your options if you have earlier
release password versions.
Starting with Oracle Database 12c release 2 (12.2), the default value
for the SQLNET.ORA parameter ALLOWED_LOGON_VERSION_SERVER is changed
to 12. This parameter refers to the logon authentication protocol used
for the server, not the Oracle Database release.
By default, Oracle no longer supports case-insensitive password-based
authentication; only the new password versions (11G and 12C) are
allowed. The case-insensitive 10G password version is no longer
If the following conditions are true, then you may have accounts that
are prevented from logging into the database after upgrading to 12.2:
You are upgrading a server that has user accounts created in an
earlier Oracle Database release.
User accounts created in the earlier release use a case-insensitive
password version from an earlier release authentication protocol, such
as the 10G password version.
Earlier release user accounts have not reset passwords.
The server has been configured with SEC_CASE_SENSITIVE_LOGON set to
FALSE, so that it can only authenticate users who have a 10G
case-insensitive password version.
Option for Servers with Accounts Using Only 10G Password Version
After you upgrade to Oracle Database 12c release 2 (12.2), complete
the following procedure to enable accounts using the 10G password
Log in as an administrator.
Edit the SQLNET.ORA file to change the
SQLNET.ALLOWED_LOGON_VERSION_SERVER setting from the default, 12, to
11 or lower. For example:
After you change to a more permissive
SQLNET.ALLOWED_LOGON_VERSION_SERVER setting, expire users’ passwords
to require them to change their passwords. For detailed information,
refer to Oracle Database Security Guide.