Connection denied from Java application

Question

I try to connect from my little Java class to Oracle11g database and connection was refused with a SQL error.

From client (SQL Developer) connection works.

This is the ERROR when I try to run java class:

java.sql.SQLException: 
ORA-00604: errore riscontrato in SQL ricorsivo livello 1
ORA-20001: Denied! You are not allowed to logon the database
ORA-06512: a line 19
 at oracle.jdbc.driver.T4CTTIo`enter code here`er.processError(T4CTTIoer.java:447)
 at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:389)
 at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:382)
 at oracle.jdbc.driver.T4CTTIfun.processError(T4CTTIfun.java:675)
 at oracle.jdbc.driver.T4CTTIoauthenticate.processError(T4CTTIoauthenticate.java:448)
 at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:513)
 at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:227)
 at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:383)
 at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:776)
 at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:432)
 at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:553)
 at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:254)
 at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32)
 at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:528)
 at java.sql.DriverManager.getConnection(DriverManager.java:664)
 at java.sql.DriverManager.getConnection(DriverManager.java:247)
 at DBConnection.setDBConnection(DBConnection.java:48)
 at Main.main(Main.java:31)

This is the code of my connection class:

String host = "xxx";
String service = "xxx";
String username = "xxx";
String password = "xxx";
 if(host != null && username != null && password != null) {
 // Establishing DB Connection
 try {
 connection = DriverManager.getConnection(
 "jdbc:oracle:thin:@" + host + ":1521/" + service , username, password);
 ...

• Michael Kutz: ORA-20001 is a custom error. Possibly caused by foolish security measures. dba.stackexchange.com/questions/93949/…

Answer 1

My guess is that there is a logon trigger that checks the application name. Apparently written by someone who doesn't understand that the name of the application can not be relied upon.

The following advice might get you in trouble, use with caution!

Oracle's JDBC driver lets you specify the application name through a connection property.

SQL Developer uses the same approach to set its own application name (otherwise it would simply show up as "JDBC Thin Driver").

To provide a non-default application name, you can use the following Java code:

String host = "xxx";
String service = "xxx";
String username = "xxx";
String password = "xxx";
Properties props = new Properties();
props.put("username", username);
props.put("password", password);
props.put("v$session.program", "SQL Developer"); // this sets the application name
try {
 connection = DriverManager.getConnection("jdbc:oracle:thin:@" + host + ":1521/" + service, props);
 ...
}
...

The JavaDocs also list several other properties that can be used to provide information for some of the columns in the v$session view.

---

Even though the logon trigger is pretty much pointless as the code above shows, you should still talk to whoever is responsible for this first.

Again: If you bypass this check, it might get you into serious trouble.

Answer 2

Seems like the DBA created a logon trigger that verifies connection on logins. ORA-20001-20999 are custom exceptions defined by the code that throws them, this is an environmental issue, ask the DBA.

If you have the necessary privilegs, you can check the trigger yourself, you can start with:

select * from dba_triggers where triggering_event like 'LOGON%';

• Federica Forte: But it's normal that if I try from sql developer from the same pc, same ip with the same credentials, login work?
• Balazs Papp: @FedericaForte It is not normal, but possible. See the comment from Michael Kutz about foolish security measures.
• Albert Godfrind: The trigger may just check the name of the incoming application against a "white list" of acceptable ones and reject all others. You need to speak with your DBA and/or system administrators ....
• Federica Forte: It's possible to block only jdbc connection?
• user168186: @FedericaForte You said it works with SQL Developer but SQL Developer uses jdbc thin client so it's not blocking based on jdbc connections