Friday, February 27, 2015

ORA-24247: network access denied by access control list (ACL)

Easy solution for this error....
Problem:
You may face above error, when you will use several PL/SQL APIs (UTL_TCP, UTL_SMTP, UTL_MAIL, UTL_HTTP and UTL_INADDR)  utilities in Oracle database 11g or higher version. This is a new security policy, implemented by Oracle in latest versions. but you can pass it via following steps

1) Connect with super user (SYS user)

2) Create following " Pro_add_me_to_acl_list" procedure (This procedure is for "Drop ACL", "Create_ACL" and "Assign_ACL" with the package "DBMS_NETWORK_ACL_ADMIN" )
or
you can do same thing without creating the procedure see here  http://oracle-base.com/articles/11g/fine-grained-access-to-network-services-11gr1.php

(But this procedure will simplify you activity)

3) and then execute the procedure with appropriate parameters .

Here it is in live example :

 SQL*Plus: Release 11.2.0.1.0 Production on Fri Feb 27 15:14:58 2015  
 Copyright (c) 1982, 2010, Oracle. All rights reserved.  
            STEP-#1   
 SQL>  
 SQL> conn sys@orcl_dev_linux as sysdba  
 Enter password:  
 Connected.  
 SQL>  
 SQL>  
 SQL> show user  
 USER is "SYS"  
 SQL>  
            STEP-#2   
 SQL>  
 SQL> CREATE OR REPLACE PROCEDURE Pro_add_me_to_acl_list (aacl     VARCHAR2,  
  2                           acomment   VARCHAR2,  
  3                           aprincipal  VARCHAR2,  
  4                           aisgrant   BOOLEAN,  
  5                           aprivilege  VARCHAR2,  
  6                           aserver    VARCHAR2,  
  7                           aport     NUMBER)  
  8 IS  
  9 BEGIN  
  10   BEGIN  
  11    DBMS_NETWORK_ACL_ADMIN.DROP_ACL (aacl);  
  12    DBMS_OUTPUT.put_line ('ACL dropped.....');  
  13   EXCEPTION  
  14    WHEN OTHERS  
  15    THEN  
  16      DBMS_OUTPUT.put_line ('Error dropping ACL: ' || aacl);  
  17      DBMS_OUTPUT.put_line (SQLERRM);  
  18   END;  
  19  
  20   BEGIN  
  21    DBMS_NETWORK_ACL_ADMIN.CREATE_ACL (aacl,  
  22                      acomment,  
  23                      aprincipal,  
  24                      aisgrant,  
  25                      aprivilege);  
  26    DBMS_OUTPUT.put_line ('ACL created.....');  
  27   EXCEPTION  
  28    WHEN OTHERS  
  29    THEN  
  30      DBMS_OUTPUT.put_line ('Error creating ACL: ' || aacl);  
  31      DBMS_OUTPUT.put_line (SQLERRM);  
  32   END;  
  33  
  34   BEGIN  
  35    DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL (aacl, aserver, aport);  
  36    DBMS_OUTPUT.put_line ('ACL assigned.....');  
  37   EXCEPTION  
  38    WHEN OTHERS  
  39    THEN  
  40      DBMS_OUTPUT.put_line ('Error assigning ACL: ' || aacl);  
  41      DBMS_OUTPUT.put_line (SQLERRM);  
  42   END;  
  43  
  44   COMMIT;  
  45   DBMS_OUTPUT.put_line ('ACL commited.....');  
  46 END;  
  47  
  48 /  
 Procedure created.  
 SQL>  
 SQL>  
 SQL>  
 SQL> COLUMN host FORMAT A30  
 SQL> COLUMN acl FORMAT A30  
 SQL>  
 SQL> SELECT host, lower_port, upper_port, acl  
  2 FROM  dba_network_acls;  
 HOST              LOWER_PORT UPPER_PORT  
 ------------------------------ ---------- ----------  
 ACL  
 ------------------------------  
 <smtp_server>             25     25  
 /sys/acls/smtp-gate-permission  
 s.xml  
 your_smtp_server_name_or_ip             25     25  
 /sys/acls/mailserver_acl.xml  
                
                       STEP-#3  
 SQL>  
 SQL>  
 SQL> BEGIN  
  2   Pro_add_me_to_acl_list ('mailserver_acl.xml',  
  3               'ACL for used Email Server to connect',  
  4               'HR',            --(user name/schema)  
  5               TRUE,  
  6               'connect',  
  7               'your_smtp_server_name_or_ip', --(your exchange mail server name)  
  8               25);             --default port number  
  9 END;  
  10  
  11 /  
 PL/SQL procedure successfully completed.  
 SQL>  
 SQL>  


Thanks
Halim

No comments: