If you’re working with Oracle Databases, you might have encountered the ORA-28040: No Matching Authentication Protocol error when trying to connect a client to a database. This is a common yet confusing issue for many DBAs and developers, especially after database upgrades or when using older client software.
This article will help you understand what this error means, why it occurs, and provide practical solutions to resolve it step-by-step.
What is ORA-28040: No Matching Authentication Protocol?
The error message typically looks like this:
ORA-28040: No matching authentication protocol
This error occurs when the authentication protocols used by the Oracle client and the Oracle database server are incompatible. In simpler terms, the database is expecting a newer authentication method, while the client is trying to connect using an older protocol that the database no longer supports.
Why This Error Happens
Oracle frequently improves its security features in newer database versions. When you upgrade your database to a newer version (for example, from Oracle 11g to 19c or 21c), older and less secure authentication protocols may be disabled by default.
If your client tools—such as SQL*Plus, SQL Developer, JDBC drivers, or third-party applications—are using older versions, they may still rely on outdated authentication methods.
Here are the most common scenarios that trigger this error:
1. Database Upgrade
When upgrading the database to a newer release, Oracle often changes the default authentication protocol. For example:
- Oracle 12c and above require a minimum authentication protocol of 11 or higher.
- Older clients (like Oracle 10g or 11g) may not support this newer protocol.
2. Old Oracle Client
If you are using an old client such as:
- Oracle 10g client
- Oracle 11g client (with older patch levels)
- Older JDBC/ODBC drivers
…it may not be able to communicate with a newer database.
3. SQLNET.ORA Settings
The server’s sqlnet.ora file may have a SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter set to a high value. This parameter enforces which authentication protocols the server will accept.
For example:
SQLNET.ALLOWED_LOGON_VERSION_SERVER=12
This setting rejects connections from clients using older authentication protocols.
4. Application-Specific Drivers
Some third-party applications bundle their own Oracle drivers. If the bundled driver is outdated, it may fail to authenticate with the database.
Identifying the Root Cause
Before applying a fix, it’s important to identify what’s causing the issue. Here are some steps to troubleshoot:
Check Database Version
Use the following SQL command on the server:
SELECT * FROM v$version;
Check Client Version
Run:
sqlplus -v
or check the version of your application’s JDBC/ODBC driver.
Review SQLNET.ORA Settings
On the server side, inspect the(Database Home) $ORACLE_HOME/network/admin/sqlnet.ora file for:
SQLNET.ALLOWED_LOGON_VERSION_SERVER
SQLNET.ALLOWED_LOGON_VERSION_CLIENT
These parameters determine which authentication protocols are allowed.
Solutions to Fix ORA-28040
The best solution depends on whether you can upgrade your client, modify the database settings, or both. Below are several methods to resolve the issue.
1. Upgrade the Oracle Client (Recommended) ✅
The most secure and Oracle-recommended approach is to upgrade your client to a version compatible with the database.
For example:
- If your database is 19c or 21c, upgrade to at least an Oracle 19c client.
- For JDBC connections, download the latest ojdbc8.jar or ojdbc11.jar from Oracle.
Steps to Upgrade Client:
- Download the latest Oracle Instant Client or driver from the Oracle Technology Network (OTN).
- Install or replace the older client.
- Update environment variables (like
ORACLE_HOMEorPATH) to point to the new client.
Why this is best:
Upgrading ensures you benefit from stronger encryption, better performance, and future compatibility.
2. Adjust SQLNET.ORA Parameters (Temporary Workaround) ⚠️
If upgrading the client is not immediately possible, you can temporarily allow older authentication protocols on the database server.
Locate the sqlnet.ora file, typically found in:
$ORACLE_HOME/network/admin/
Add or modify these lines:
SQLNET.ALLOWED_LOGON_VERSION_SERVER=8
SQLNET.ALLOWED_LOGON_VERSION_CLIENT=8
Setting the value to 8 allows older clients to connect using legacy authentication.
After making changes, restart the listener:
⚠️ Important Security Note:
Lowering the allowed logon version weakens security and should be used only as a temporary measure until clients are upgraded.
3. Upgrade or Patch the Database
If you’re on a very old database version but have upgraded some client tools, the reverse may be true. Ensure your database is patched to the latest Release Update (RU) to maintain compatibility with new drivers.
4. Use Compatible JDBC/ODBC Drivers
For Java-based applications:
- Replace old
ojdbc14.jarorojdbc6.jarfiles withojdbc8.jaror higher. - Update the application’s connection string if needed.
For ODBC connections:
- Install the latest Oracle ODBC driver matching the database version.
5. Modify Application Configuration
Some applications allow you to specify the Oracle Net parameters within their configuration. You can add:
SQLNET.ALLOWED_LOGON_VERSION_SERVER=8
directly in the application’s connection properties if upgrading the driver is not immediately possible.
Example Scenario
Imagine you upgraded your database from Oracle 11g to 19c, but your legacy application still uses a 10g client.
When the application attempts to connect, you see:
ORA-28040: No matching authentication protocol
Solution Path:
- Preferred Fix: Upgrade the application’s Oracle client or driver to 19c.
- Temporary Fix: Lower
SQLNET.ALLOWED_LOGON_VERSION_SERVERto8insqlnet.orauntil the client is upgraded.
Best Practices to Prevent ORA-28040
- Plan Ahead for Upgrades: Always check the client compatibility matrix before upgrading your Oracle database.
- Keep Clients Updated: Regularly update Oracle clients, JDBC drivers, and third-party tools to match your database version.
- Use Secure Authentication: Avoid permanently lowering authentication protocols, as it exposes your database to security risks.
Conclusion
The ORA-28040: No Matching Authentication Protocol error occurs when the Oracle client and server cannot agree on an authentication protocol—most often after a database upgrade or when using outdated client software.
Quick Fixes:
- Upgrade the Oracle client or driver (best and most secure solution).
- Adjust SQLNET.ORA parameters to temporarily allow older protocols.
- Keep both database and client tools patched and up-to-date.
By understanding the root cause and applying the appropriate solution, you can resolve this issue quickly while maintaining a secure and stable Oracle environment.
