Okta Privileged Access Oracle Database Integration Fails Due To Missing TCPS Protocol

An error occurs when configuring an Oracle SQL database connection in Okta Privileged Access if the Transport Layer Security (TLS) protocol is not defined in the listener. The Okta Privileged Access platform requires the TLS protocol, and the database administrator must configure the listener to use the TCPS protocol. The user interface displays the following error message when the database connection fails.

Failed to create database integration: Error: oracledb error: EOF

The gateway logs display the following error.

"failed to ping Oracle database: Oracle ping failed: code: UNEXPECTED_ERROR, message: EOF"

The Oracle listener logs display the following error.

nsprecv:header checksum error
nsprecv:packet hdr
nsprecv:16 03 01 05 B6 01 00 00
nsprecv:error exit

The SQL logging displays the following error.

12569 TNS-12569: TNS:packet checksum failure

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Privileged Access
• Database
• Oracle

When using a default configuration, the listener configuration has a default setup using the Transmission Control Protocol (TCP). The Okta Privileged Access platform requires the protocol to use TLS, and the database administrator must set it with the TCPS protocol. The following code block displays an example of the default listener configuration using the TCP protocol.

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = ip-10-43-80-156.us-west-2.compute.internal)(PORT = 1521))
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    )
  )

How is the Oracle database connection error resolved?

The database administrator must change the listener to use TLS with the TCPS protocol. If logging is not visible, the database administrator must enable the required debug logging.

The hex dump number 16 03 01 confirms that the client sends a TLS 1.0 or TLS 1.2 Client Hello packet. Because the log shows a header checksum error right after receiving these bytes, the client speaks TLS, but the Oracle Listener port expects plain, unencrypted TCP. The listener does not recognize the TLS handshake structure and rejects the packet as corrupted data. The following code block displays the listener log output indicating the rejected packet.

nsprecv:header checksum error
nsprecv:packet hdr
nsprecv:16 03 01 05 B6 01 00 00 |........|
nsprecv:error exit