Search code examples
oracleoracle11goracle10gdatabase-migrationora-24247

Oracle 11g: Migrated users have ACL set but can't hit utl_http: ORA-24247/29273: network access denied by access control list (ACL)


Situation:

  • Oracle 10g database migrated to 11g - users migrated

  • Migrated users who call utl_http.request(...) fail with error:
    ORA-29273: HTTP request failed
    ORA-06512: at "SYS.UTL_HTTP", line 1722
    ORA-24247: network access denied by access control list (ACL)
    ORA-06512: at line 8

  • We've created an ACL and added the users/host permissions (connect and resolve), and the users have execute permission to utl_http

  • Newly created users have no problems with the call once their ACL and execute permissions have been set

  • At least one migrated user, dba_monitor, is able to make the call (though that user has other, elevated permissions)

The only difference we've found between the accounts is in dba_user.password_versions... the new ones say 10g 11g, while the migrated ones say 10g.

We've tried changing the password for the accounts that can't make the call... this changed the password_versions to 10g 11g, but still no dice

Dropped and re-added the ACL permissions and grants a number of times, no success.


Does anyone know of known issues with migrating existing Oracle accounts, or have any thoughts on where we can look for more clues?

Thanks!


Update:

We went to another 11g instance and created a new user with the same name, CSS_WEB, and set permissions in the ACL. That user was also unable to connect. We created a new user, CSS_WEB1, and that user was ABLE to connect.

This has gotten really, really strange... at this point I'm not expecting answers, just ideas of where we can look.


Solution

  • We resolved this as an OID-related problem.

    Somehow, there were OID entries for these accounts, even though they were db local. When we removed the OID data for them, everything worked.