Fail with TNS-12526, TNS-12527 or TNS-12528

In this Document

APPLIES TO:

SYMPTOMS

Connections via the listener to an instance that is in RESTRICTED status or in NO MOUNT status may fail with TNS-12526, TNS-12527 or TNS-12528 even when supplying the credentials for a privileged account.    The lsnrctl services output will show that the service handler for this instance is in state: BLOCKED or RESTRICTED.

The full error text is:

CHANGES

The only significant change would be that the instance has been started up in some kind of "restricted access" mode such as RESTRICTED or NO MOUNT.

Here is an example of starting up the database in restricted mode and the output for lsnrctl status:

1.Start the database with restricted mode 

SQL>startup restrict 

2.Check the status of the listener 

From the above we can see that the listener status for that instance is 
"RESTRICTED"

CAUSE

When an instance is in restricted mode, PMON updates the listener with that information and blocks new connections from being established. 

The lsnrctl services output will show the handler is blocked for new connections or lsnrctl status may show the instance is in RESTRICTED mode.

SOLUTION

The (UR=A) clause for TNS connect strings was created in response to an enhancement request.  This clause can be inserted into the "(CONNECT_DATA=" section of a TNS connect string and allow a privileged or administrative user to connect via the listener even when the service handler is blocking connections for non-privileged users. 

Here's an example of a connect string configured with (UR=A):

Please note that the (UR=A) clause is intended to work with a dynamically registered handler so the use of SERVICE_NAME versus SID is required when using dynamic registration (i.e. handler exists in lsnrctl output but is BLOCKED).  The use of SID in a TNS connect string may allow a connection if using a static handler in the listener.ora file under SID_DESC.