Restricted PDBIssue

Introduction

Recently we were seeing a “credentials supplied are wrong” error when trying to start our Applications Tier. For example:


unix> $ADMIN_SCRIPTS_HOME/adstrtal.sh
You are running adstrtal.sh version 120.24.12020000.11
Enter the APPS username: apps
Enter the APPS password:
Enter the WebLogic Server password:
adstrtal.sh: Database connection could not be established. Either the database is down or the APPS credentials supplied are wrong.


Of course, we assumed the password was entered incorrectly but,after several attempts, we continued getting the same error.

We then tried to log in directly to our PDB as the APPS user by doing the following:


unix> source $ORACLE_HOME/DEVL_beejartha.env
unix>sqlplusapps@DEVL


And saw the following error:

ORA-01035 ORACLE only available to users with RESTRICTED SESSION privilege

Cause and Solution

In restricted mode, users without the necessary privileges cannot log in to the database (including the APPS user). Based on the error above, it appears our PDB had been started in restricted mode. This would explain the login issues we were experiencing.

We can confirm this by connecting to the PDB as SYSDBA and querying the V$INSTANCE view:


unix> source $ORACLE_HOME/DEVL_beejartha.env
unix> sqlplus sys@DEVL as sysdba
SQL> select logins from v$instance;


If the PDB is in restricted mode, you will see the following:


LOGINS
----------
RESTRICTED


To fix, simply disable by running the following statement:


SQL> alter system disable restricted session;


To confirm restricted session is disabled, you should see logins are “ALLOWED” when running the above query again:


SQL> select logins from v$instance;

LOGINS
----------
ALLOWED


After disabling restricted session, we were able to log in to the database as the APPS user as well as successfully starting the Applications Tier.

Note

It is possible for the PDB to be in restricted mode while the CDB is not. In other words, you can query the V$INSTANCE view in the CDB and see logins are “ALLOWED” but, when you query the PDB, logins are shown as “RESTRICTED”. Even though the CDB is open, you will still need to disable the restricted session in the PDB (as shown above).