An administrator account is granted the CREATE SESSION and SET CONTAINER system privileges. A multitenant container database (CDB) instant has the following parameter set: THREADED_EXECUTION = FALSE…

Common users are provisioned at the CDB root level with a c## prefix and hold their CREATE SESSION privilege there, so a standard SQL*Plus CONNECT statement authenticates them successfully even when the root is open read-only. Read-only mode restricts data modification, not session establishment.

Local users are schema accounts created inside a specific PDB and do not exist in the CDB root container, making it impossible to authenticate as a local user when connecting to root.

Easy Connect uses a host:port/service_name string resolved entirely on the client side and is independent of the database open mode, so it works for any user with CREATE SESSION on the target container.

OS authentication is available because THREADED_EXECUTION=FALSE keeps the dedicated server process model active, which allows the Oracle listener to verify the operating system user identity without requiring a password. If THREADED_EXECUTION were TRUE, OS authentication would be blocked.

A Net Service name in tnsnames.ora or an LDAP directory is simply a network alias that resolves to a connect descriptor; the database open mode has no effect on whether this naming method can be used to establish a session.

SET CONTAINER switches an already-connected session between containers and requires a common user or a user with the appropriate privilege; local users have no authentication context in root and cannot use this statement to connect there.