DEV Community

umzzil nng
umzzil nng

Posted on Originally published at oraerror.com

Oracle ORA-12168 Error: Causes and Solutions Complete Guide

#oracle #database #dba #sql

ORA-12168: TNS: Unable to Contact LDAP Directory Server

ORA-12168 occurs when Oracle Net Services attempts to resolve a connection identifier using LDAP (Lightweight Directory Access Protocol) but cannot reach the configured LDAP Directory Server. This typically happens when sqlnet.ora includes LDAP in its NAMES.DIRECTORY_PATH, but no valid LDAP server (such as Oracle Internet Directory) is available or reachable. The error blocks client connections entirely if LDAP is the primary or only naming method configured.

Top 3 Causes

Cause 1: LDAP Unnecessarily Listed in sqlnet.ora

The most common cause is having LDAP in NAMES.DIRECTORY_PATH when no LDAP server is actually deployed or needed.

-- Check current listener and naming-related parameters
SELECT NAME, VALUE 
FROM V$PARAMETER 
WHERE NAME IN ('local_listener', 'remote_listener')
ORDER BY NAME;

-- Verify your service name resolution (EZConnect workaround)
-- Use direct host:port/service if LDAP fails:
-- CONNECT username/password@hostname:1521/ORCL

-- Check active sessions to confirm connectivity after fix
SELECT USERNAME, MACHINE, PROGRAM, STATUS 
FROM V$SESSION 
WHERE TYPE = 'USER'
ORDER BY LOGON_TIME DESC;
Enter fullscreen mode Exit fullscreen mode

Fix: Edit $ORACLE_HOME/network/admin/sqlnet.ora and remove LDAP:

# Before (problematic)
NAMES.DIRECTORY_PATH = (LDAP, TNSNAMES, EZCONNECT)

# After (corrected)
NAMES.DIRECTORY_PATH = (TNSNAMES, EZCONNECT)
Enter fullscreen mode Exit fullscreen mode

Cause 2: Incorrect ldap.ora Configuration

If LDAP is required, a misconfigured ldap.ora file (wrong host, port, or domain) will trigger ORA-12168.

-- Verify DB identity and environment context
SELECT SYS_CONTEXT('USERENV', 'DB_NAME') AS DB_NAME,
       SYS_CONTEXT('USERENV', 'SERVER_HOST') AS SERVER_HOST,
       SYS_CONTEXT('USERENV', 'SERVICE_NAME') AS SERVICE_NAME
FROM DUAL;

-- Check any database links that may rely on LDAP resolution
SELECT DB_LINK, HOST, USERNAME 
FROM DBA_DB_LINKS 
ORDER BY DB_LINK;

-- Review alert log for LDAP-related errors
SELECT ORIGINATING_TIMESTAMP, MESSAGE_TEXT 
FROM V$DIAG_ALERT_EXT 
WHERE MESSAGE_TEXT LIKE '%LDAP%' 
   OR MESSAGE_TEXT LIKE '%ORA-12168%'
ORDER BY ORIGINATING_TIMESTAMP DESC
FETCH FIRST 10 ROWS ONLY;
Enter fullscreen mode Exit fullscreen mode

Fix: Correct ldap.ora with valid server details:

DIRECTORY_SERVERS = (ldap.yourcompany.com:389:636)
DEFAULT_ADMIN_CONTEXT = "dc=yourcompany,dc=com"
DIRECTORY_SERVER_TYPE = OID
Enter fullscreen mode Exit fullscreen mode

Cause 3: Network/Firewall Blocking LDAP Port

Even with correct configuration, firewalls blocking port 389 (LDAP) or 636 (LDAPS) will cause this error.

-- Temporarily bypass LDAP using EZConnect to confirm DB is reachable
-- CONNECT sys/password@192.168.1.100:1521/ORCL AS SYSDBA

-- Confirm instance is up after connecting via EZConnect
SELECT INSTANCE_NAME, STATUS, DATABASE_STATUS 
FROM V$INSTANCE;

-- Check Oracle Net parameters for listener configuration
SELECT NAME, VALUE 
FROM V$PARAMETER 
WHERE NAME LIKE '%listener%'
ORDER BY NAME;
Enter fullscreen mode Exit fullscreen mode

Fix: Work with your network team to open LDAP ports, or add multiple LDAP servers to ldap.ora for failover:

DIRECTORY_SERVERS = (ldap1.company.com:389:636, ldap2.company.com:389:636)
Enter fullscreen mode Exit fullscreen mode

Quick Fix Summary

Scenario Action
LDAP not needed Remove LDAP from NAMES.DIRECTORY_PATH in sqlnet.ora
Wrong LDAP server info Fix host/port in ldap.ora
Firewall blocking Open port 389/636 or use TNSNAMES fallback
Emergency bypass Use EZConnect: host:port/service

Prevention Tips

1. Audit sqlnet.ora Across All Environments
Store sqlnet.ora and ldap.ora in version control. Regularly audit all Oracle client and server machines to ensure LDAP is only listed when a reachable LDAP server exists.

-- Scheduled check: verify net parameters are consistent
SELECT NAME, VALUE, DESCRIPTION 
FROM V$PARAMETER 
WHERE NAME LIKE '%tns%' OR NAME LIKE '%listener%'
ORDER BY NAME;
Enter fullscreen mode Exit fullscreen mode

2. Monitor LDAP Server Availability
If OID or Active Directory is used for Oracle name resolution, set up automated health checks (via OEM or cron) on LDAP ports. Configure multiple LDAP servers in ldap.ora to ensure high availability and prevent a single point of failure from causing widespread ORA-12168 errors across your environment.

Related Errors

  • ORA-12154 – TNS could not resolve connect identifier (often follows ORA-12168)
  • ORA-12170 – TNS connect timeout (LDAP server reachable but slow)
  • ORA-12533 – Illegal ADDRESS parameters in ldap.ora
  • ORA-12545 – Target host does not exist (bad LDAP-resolved hostname)

📖 Want a more detailed guide?
Check out the full in-depth version (Korean) on oraerror.com — includes detailed analysis, additional SQL examples, and prevention tips.

Top comments (0)