Oracle’s July 2026 Database Release Update (19.32 and 23.26.3) contains an unannounced fix for a subtle bug in Centrally Managed Users.
The bug is easy to reproduce but likely not seen in most Active Directory records. If your DN has multiple contiguous spaces within it, then the problem will arise.
For example, this DNs will be processed correctly if defined for Centrally Managed users with a database.
CN=John Doe,OU=Employees,OU=Sales and Marketing,DC=corp,DC=example,DC=com
But this DN will cause a problem if the Oracle database is left unpatched.
CN=John Doe,OU=Employees,OU=Sales and Marketing,DC=corp,DC=example,DC=com
Notice the typo in the DN where two spaces following “Sales” and preceding “and”.
The bug arises when the user enters an invalid password. Normally when this happens the user’s hash stored in orclCommonAttribute within Active Directory will not match and the user receives an ORA-01017 error for invalid credentials. In addition, the database will send an invalid password attempt for the user in AD which then increments the failed attempt counter and, if enabled, eventually locks out the user from repeated attempts.
The first part, the ORA-01017 error happens as expected, but the second part does not. The bug causes the database to clean the DN before sending it. Trimming off extraneous leading or trailing spaces from a DN is legal and common practice. Collapsing multiple spaces within a DN though, is not appropriate.
So, for an invalid password for the user with the second DN above, Oracle should attempt a bad bind to that DN, but will instead attempt an invalid bind to the first DN. Since that DN doesn’t match, the user’s bad password count is never incremented!
In the best case this allows the user to bypass the security settings to lock out a user after too many invalid attempts. In the worst case (but probably unlikely), this will still happen but another user who happens to have the shortened DN will instead become locked out!
I was able to replicate the bug in versions from 19.1 to 19.31 as well as multiple versions from 23.1 to 23.26.2. I believe the bug has existed since CMU functionality was introduced in 18c.
One might think that we could at least reinforce the AD security rules by implementing similar lockout rules within a database user profile; but that doesn’t work either. Once the user has been defined to be identified globally via the Distinguished Name, the database profile rules no longer apply.
Thus the only solutions are to update any DNs to remove multiple spaces (and adjust any corresponding OU, DC, or CN values that DNs are build from) or to upgrade/patch to at least 19.32 or 23.26.3 or to not use the Centrally Managed User functionality for database authentication.
Patching is almost always a good idea, but in this case you may get a fix for a bug you didn’t even know you had. Oracle Support provided a few one-off patches but then they had to be removed when the next release update came out. Having the fix finally included in the core products through these latest DBRU is a long, awaited relief.
I hope this helps. Questions and comments, as always, are welcome.