To fix password security issues we need to set
SQLNET.ALLOWED_LOGON_VERSION=12. According to the Oracle Database Net Services Reference:
Note the following implications of setting the value to 12: ... Releases of OCI clients before Oracle Database 10g and all versions of JDBC thin clients cannot authenticate to the Oracle database using password-based authentication.
That statement looks really bad to me. I don't want to choose between decent password security and the recommended JDBC driver.
The good news is that the manual might be wrong. I can connect with
SQLNET.ALLOWED_LOGON_VERSION=12 and a JDBC thin client. I did have to upgrade ojdbc.jar from 188.8.131.52.0 to Oracle 184.108.40.206.0, but that is expected and also proves that the setting is truly taking affect on my server.
What's going on here:
- Is the manual wrong?
- Am I reading the manual wrong?
- Is it only working in my simple test case as some undocumented feature, but will fail with other configurations?
We have thousands of users with many different configurations, I cannot rely on just my simple test. Does anyone else have experience with both
SQLNET.ALLOWED_LOGON_VERSION=12 and JDBC thin clients?