ORA-01017 during RMAN Duplicate from Active Database

While refreshing a standby Database (11gR2) using “duplicate target database for standby” I recently encountered an error which one would normally associate with password files and/or the fact that the SYS password is not the same on the source and target databases.

RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of Duplicate Db command at 01/16/2014 11:44:26
RMAN-05501: aborting duplication of target database
RMAN-03015: error occurred in stored script Memory Script
RMAN-03009: failure of backup command on c1 channel at 01/16/2014 11:44:26
ORA-17629: Cannot connect to the remote database server
ORA-17627: ORA-01017: invalid username/password; logon denied
ORA-17629: Cannot connect to the remote database server

However, despite hours of double checking passwords, password files, listener and tnsnames configuration files I was no nearer a solution until I was reviewing the changes that had been made since the standby database was initially built (luckily, this was only a few weeks ago). The only change that seemed remotely possible was the fact that several maintenance scripts had been written using OS authentication.

It turns out that if you have an OS authenticated account for the oracle user (i.e. OP$ORACLE) then you need to fully qualify the connection to the target database with the SYS user and password as RMAN is attempting to create a login via the OPS$ORACLE account rather than the SYS account. This is despite the error message stating it cannot connect to the remote database server (quite misleading)!

So in summary, if you have an OS authenticated account then the following will NOT work:

man target=/ auxiliary=sys/*****@PDBWB1_1_DGB cmdfile=rebuild_standby.rman

Instead, you should qualify the SYS username and password like so:

rman target=sys/***** auxiliary=sys/*****@PDBWB1_1_DGB cmdfile=rebuild_standby.rman

So, a good example of why you should be keeping a change log!