Announcement

Collapse
No announcement yet.

Windows 2000 AS and ORA-01031 errors

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Windows 2000 AS and ORA-01031 errors

    I am currently troubleshooting a most elusive issue and in hopes that one of you Gurus can assist.

    Our systems are built with automated scripts that perform all software installations and has worked very well for months. Recently we hit a snag with ONE location. An automated script failed to log into Oracle using the SqlPlus “connect /@xyz as sysdba” format. Careful inspection reveals that there is NOTHING different or unusual about this install. The script is normally logs in using an account defined as a domain authenticated user account (cluster.admin). This account also has local machine administrator privileges and is in the ORA_DBA group. The login attempt results in an ORA-01031 error claiming “insufficient privileges.” Building a DC and Server-A/B cluster, duplicating the other site’s installation does NOT duplicate the error. Creating a new user with the requisite privileges also fails. Adding cluster.admin to the domain administrators group will successfully log in but this is not permissible in our environment.

    We have created a temp folder and assigned only ORA_DBA members access. Cluster.admin can access this folder as expected so it appears that the OS is properly recognizing and assigning ACLs.

    This appears to be a problem with Kerberos authentication being performed by Oracle but I can’t find anything to verify this. If I disconnect the DC from the network and log into the cluster, I can get in using cached credentials (this is before lock downs are applied in the build process). If I then try to log into SqlPlus I receive the ORA-01031 error. If I reconnect but disable Kerberos, I receive (forget the ORA#) a message from Oracle that it cannot retrieve a certificate.

    Hardware and Software setup:
    • One Dell 1850, running W2KAS SP4, configured as a Domain Controller.
    • Two Dell 2850, running W2KAS SP4, configured as Primary cluster, sharing a Dell PowerVault 220S Array.
    • Two Dell 6450, running W2KAS SP4, as a Backup cluster, sharing a Dell PowerVault 220S Array.

    The DC and the backup cluster are co-located. The primary cluster is located some distance away.

    Both primary and backup clusters are running Oracle 9i v9.2.0.5 w/ July2005 critical patch applied and Oracle Failsafe.

    I’m sure I’ve forgotten something but I’m totally lost here. Anyone have any ideas?

    swats

  • #2
    Re: Windows 2000 AS and ORA-01031 errors

    Do you change the account/user right (Logon as service, log on as batch file etc.)? Who handle the cluster? Oracle or MS Cluster?
    Best Regards,

    Yuval Sinay

    LinkedIn: https://www.linkedin.com/in/yuval14, Blog: http://blogs.microsoft.co.il/blogs/yuval14

    Comment


    • #3
      Re: Windows 2000 AS and ORA-01031 errors

      Originally posted by yuval14
      Do you change the account/user right (Logon as service, log on as batch file etc.)? Who handle the cluster? Oracle or MS Cluster?
      Yuval,

      Thanks for responding. The cluster.admin account is not modified to logon as service or as batch file. This is a normal, domain authenticated user, account which is added to the ORA_DBA group and given local machine administrator rights - nothing more.

      As for who manages the cluster, it is managed by Microsoft Cluster Manager at this point. Oracle Fail Safe v3.3.2.0.0 is installed but unconfigured at the point the script fails. In every other installation, this has worked without any problems at all. Researching the Oracle and Microsoft web sites seems to indicate that we are doing everything 'by the book.'

      One note: We did not install the W2KAS DC and have no control over it. There may be an issue there. We're trying to exhaust all other possibilities before telling the customer he or she must rebuild the DC.

      Thanks,
      swats

      Comment


      • #4
        Re: Windows 2000 AS and ORA-01031 errors

        Have you opened a support case with Oracle supplying the ORA error number?

        Comment


        • #5
          Re: Windows 2000 AS and ORA-01031 errors

          Originally posted by JamesNesbitt
          Have you opened a support case with Oracle supplying the ORA error number?
          James,

          Yes, we have. it is TAR 4950622.993. To date, Oracle hasn't really told us anything more than we already know.

          swats

          Comment


          • #6
            Re: Windows 2000 AS and ORA-01031 errors

            Thanks to all who attempted to help with this issue. The problem appears to have been a bad DC build. Rebuilding the DC corrected the issue. I'd have really liked to know the ultimate culprit (and still assume Kerberos) but will probably never know.

            swats

            Comment

            Working...
            X