You configured Kerberos authentication for databases running on servers A and B. However a database link connecting the database on server A to the database on server B fails with ORA- 12638…

Question

Options

• Aon client side of server B
• Bon client side of server A
• Con server side of server B
• Don server side of server A

• A
  17% (6)
• B
  72% (26)
• C
  8% (3)
• D
  3% (1)

Explanation

Option B is correct because a database link originates from server A's database connecting to server B - meaning server A is acting as the client in that connection. The sqlnet.ora client-side settings on server A control how outgoing connections authenticate, so that is where you must set SQLNET.AUTHENTICATION_SERVICES to allow stored (password-based) credentials instead of Kerberos.

Why the distractors fail:

• A (client side of server B): Server B is the recipient of the connection, not the initiator - its client-side config is irrelevant to this link.
• C (server side of server B): The server side governs what authentication methods server B accepts, but ORA-12638 is a credential retrieval failure on the connecting side, not an acceptance failure on the receiving side.
• D (server side of server A): The server side of server A handles connections coming in to server A - it has no bearing on outgoing database link connections.

Memory tip: Follow the direction of the link - the database link "leaves" server A, so server A is the client. The client always owns credential retrieval, so the fix lives on the client side of the machine that initiates the connection (server A).

No community discussion yet for this question.