- ORA-12400: invalid argument to facility error handling
- Cause: An argument to a facility error handling function exceeded a maximum limit or referred to an invalid product/facility.
- Action: Specify a valid facility error handling parameter value.
- ORA-12420: required procedures and functions not in policy package "string"
- Cause: The policy package did not contain all of the procedures and functions necessary to enforce the policy.
- Action: Consult the label framework documentation for a list of required procedures and functions for a policy package.
- ORA-12457: security label exceeded maximum allowable length
- Cause: An operation attempted to materialize a security label greater than 4000 bytes in length.
- Action: Consult the Oracle Label Security documentation for information on how the length of a security label is calculated. Re-submit the operation once the problem has been corrected.
- ORA-12465: Not authorized for read or write on specified groups or compartments
- Cause: You included groups or compartments that are not in the user's list of groups and compartments authorized for read or write access.
- Action: Include read access when authorizing groups or compartments for write access.
- ORA-12477: greatest lower bound resulted in an invalid OS label
- Cause: You tried to do an operation that generated a greatest lower bound (GLB) label which is not a valid label on your operating system.
- Action: Consult your OS label management documentation for information on invalid label generation.
- ORA-12480: specified clearance labels not within the effective clearance
- Cause: You specified a clearance range that was not within your authorized clearance; you can only specify clearance ranges that are within your clearance.
- Action: Specify clearance labels that are within your own clearance range.
- ORA-12481: effective label not within program unit clearance range
- Cause: The effective label when the program unit was invoked was not within the range authorized for the program unit.
- Action: Modify the program unit clearance range or invoke the program unit from a session with an authorized effective clearance.
- ORA-12488: maximum label does not dominate minimum label
- Cause: You attempted to enter a value for a clearance label that did not preserve the dominance relationship between the minimum and maximum labels.
- Action: Enter label values that preserves the dominance relationship between the minimum and maximum.
- ORA-12492: DBLOW cannot be changed
- Cause: You attempted to change the value of DBLOW after it had been set to any initial value. DBLOW can only be set once after initial database creation.
- Action: To change DBLOW, you have to create a new database, set DBLOW to the new value, and import your data into the new database.
- ORA-12494: cannot insert or delete a level, category, or release category
- Cause: You attempted to insert or delete a level, category, or release category definition.
- Action: If the label definition is no longer valid, change its name to one that identifies it as invalid. When any labels are converted to character strings, the new label definition will be used.
- ORA-12495: cannot disable an enabled level, category, or release category
- Cause: You attempted to disable a level, category, or release category that had previously been enabled. An enabled label definition may be exist in some database label, so cannot be disabled.
- Action: If the label definition is no longer valid, change its name to one that identifies it as invalid. When any labels are converted to character strings, the new label definition will be used.
- ORA-12497: maximum combined categories exceeds string
- Cause: The maximum number of descriptive categories plus release categories supported by the MLS policy was exceeded.
- Action: Enter numbers that do not add up to more than the maximum.
- ORA-12500: TNS:listener failed to start a dedicated server process
- Cause: The process of starting up a dedicated server process failed. The executable could not be found or the environment may be set up incorrectly.
- Action: Turn on tracing at the ADMIN level and reexecute the operation. Verify that the ORACLE Server executable is present and has execute permissions enabled. Ensure that the ORACLE environment is specified correctly in LISTENER.ORA. The Oracle Protocol Adapter that is being called may not be installed on the local hard drive. Please check that the correct Protocol Adapter are successfully linked. If error persists, contact Oracle Customer Support.
- ORA-12504: TNS:listener was not given the SERVICE_NAME in CONNECT_DATA
- Cause: The listener was not configured with a default service and SERVICE_NAME was missing from the CONNECT_DATA received by the listener.
- Action: Possible solutions are: - Configure DEFAULT_SERVICE parameter in LISTENER.ORA with a valid service name. Reload the listener parameter file using reload [
]. This should be done by the LISTENER administrator.
- If using a service name, Check that the connect descriptor corresponding to the service name in TNSNAMES.ORA has a SERVICE_NAME or SID component in the CONNECT_DATA.
- ORA-12505: TNS:listener does not currently know of SID given in connect descriptor
- Cause: The listener received a request to establish a connection to a database or other service. The connect descriptor received by the listener specified a SID for an instance (usually a database instance) that either has not yet dynamically registered with the listener or has not been statically configured for the listener. This may be a temporary condition such as after the listener has started, but before the database instance has registered with the listener.
- Action: - Wait a moment and try to connect a second time.
- Check which instances are currently known by the listener by executing: lsnrctl services
- Check that the SID parameter in the connect descriptor specifies an instance known by the listener.
- Check for an event in the listener.log file.
- ORA-12509: TNS:listener failed to redirect client to service handler
- Cause: The dispatcher terminated unexpectedly
- Action: Attempt to connect again and if the same error occurs, contact the DBA to check the state of the dispatchers for this SID. If the problem persists, turn on tracing in the listener to determine the TNS error caused by the redirect.
- ORA-12510: TNS:database temporarily lacks resources to handle the request
- Cause: The dispatchers appear to be busy handling other requests.
- Action: Attempt the connection again. If error persists, ask the DBA to increase the number of dispatchers and/or dispatchers' limit on number of connections/sessions that they can accept.
- ORA-12511: TNS:service handler found but it is not accepting connections
- Cause: The dispatchers notified the listener that they temporarily do not accept new connections.
- Action: Attempt the connection again. If error persists, contact the DBA to check the state of the dispatchers and/or ask him to increase the number of dispatchers.
- ORA-12514: TNS:listener does not currently know of service requested in connect descriptor
- Cause: The listener received a request to establish a connection to a database or other service. The connect descriptor received by the listener specified a service name for a service (usually a database service) that either has not yet dynamically registered with the listener or has not been statically configured for the listener. This may be a temporary condition such as after the listener has started, but before the database instance has registered with the listener.
- Action: - Wait a moment and try to connect a second time.
- Check which services are currently known by the listener by executing: lsnrctl services
- Check that the SERVICE_NAME parameter in the connect descriptor of the net service name used specifies a service known by the listener.
- If an easy connect naming connect identifier was used, check that the service name specified is a service known by the listener.
- Check for an event in the listener.log file.
- ORA-12515: TNS:listener could not find a handler for this presentation
- Cause: None of the listener's known service handlers are registered as supporting the presentation protocol required by the connecting client.
- Action: Check that the destination service is configured to accept the presentation protocol.
- ORA-12516: TNS:listener could not find available handler with matching protocol stack
- Cause: None of the known and available service handlers for the given SERVICE_NAME support the client's protocol stack: transport, session, and presentation protocols.
- Action: Check to make sure that the service handlers (e.g. dispatchers) for the given SERVICE_NAME are registered with the listener, are accepting connections, and that they are properly configured to support the desired protocols.
- ORA-12518: TNS:listener could not hand off client connection
- Cause: The process of handing off a client connection to another process failed.
- Action: Turn on listener tracing and re-execute the operation. Verify that the listener and database instance are properly configured for direct handoff. If problem persists, call Oracle Support.
- ORA-12520: TNS:listener could not find available handler for requested type of server
- Cause: None of the known and available service handlers for requested type of server (dedicated or shared) are appropriate for the client connection.
- Action: Run "lsnrctl services" to ensure that the instance(s) have registered with the listener and that the appropriate handlers are accepting connections.
- ORA-12521: TNS:listener does not currently know of instance requested in connect descriptor
- Cause: The listener received a request to establish a connection to a database or other service. The connect descriptor received by the listener specified in addition to the service name an instance name for an instance (usually a database instance) that either has not yet dynamically registered with the listener or has not been statically configured for the listener. This may be a temporary condition such as after the listener has started, but before the database instance has registered with the listener.
- Action: - Wait a moment and try to connect a second time.
- Check which instances are currently known by the listener by executing: lsnrctl services
- Check that the INSTANCE_NAME parameter in the connect descriptor specifies an instance name known by the listener.
- Check for an event in the listener.log file.
- ORA-12522: TNS:listener could not find available instance with given INSTANCE_ROLE
- Cause: There are not any available and appropriate database instances registered with the listener, that are part of the service identified by SERVICE_NAME given in the connect descriptor and that have the specified INSTANCE_ROLE (and INSTANCE_NAME, if specified).
- Action: Check to make sure that the INSTANCE_ROLE specified is correct. Run "lsnrctl services" to ensure that the instance(s) have registered with the listener and that they are ready to accept connections.
- ORA-12523: TNS:listener could not find instance appropriate for the client connection
- Cause: The listener could not find any available (database) instances, that are appropriate for the client connection.
- Action: Run "lsnrctl services" to ensure that the instance(s) are registered with the listener, and have status READY.
- ORA-12525: TNS:listener has not received client's request in time allowed
- Cause: The listener disconnected the client because the client failed to provide the necessary connect information within the allowed time interval. This may be a result of network or system delays; or this may indicate that a malicious client is trying to cause a Denial of Service attack on the listener.
- Action: If the error occurred because of a slow network or system, reconfigure INBOUND_CONNECT_TIMEOUT to a larger value. If a malicious client is suspected, use the address in listener.log to identify the source and restrict access. Turn on tracing for more information.
- ORA-12526: TNS:listener: all appropriate instances are in restricted mode
- Cause: Database instances supporting the service requested by the client were in restricted mode. The Listener does not allow connections to instances in restricted mode. This condition may be temporary, such as during periods when database administration is performed.
- Action: Attempt the connection again. If error persists, then contact the database administrator to change the mode of the instance, if appropriate.
- ORA-12527: TNS:listener: all instances are in restricted mode or blocking new connections
- Cause: All appropriate database instances supporting the service requested by the client reported that they either were in restricted mode or were blocking the new connections. The Listener does not allow connections to such instances. This condition may be temporary, such as at instance startup.
- Action: Attempt the connection again. If error persists, then contact the database administrator to check the status of the instances.
- ORA-12528: TNS:listener: all appropriate instances are blocking new connections
- Cause: All instances supporting the service requested by the client reported that they were blocking the new connections. This condition may be temporary, such as at instance startup.
- Action: Attempt the connection again. If error persists, then contact the administrator to check the status of the instances.
- ORA-12529: TNS:connect request rejected based on current filtering rules
- Cause: Connection Manager and its listener were configured with filtering rules specifying that the connect request be rejected.
- Action: If this connect request should be allowed, then contact the administrator to modify the filtering rules.
- ORA-12533: TNS:illegal ADDRESS parameters
- Cause: An illegal set of protocol adapter parameters was specified. In some cases, this error is returned when a connection cannot be made to the protocol transport.
- Action: Verify that the destination can be reached using the specified protocol. Check the parameters within the ADDRESS section of TNSNAMES.ORA. Legal ADDRESS parameter formats may be found in the Oracle operating system specific documentation for your platform. Protocols that resolve names at the transport layer (such as DECnet object names) are vulnerable to this error if not properly configured or names are misspelled.
- ORA-12534: TNS:operation not supported
- Cause: An internal function received a request to perform an operation that is not supported (on this machine).
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation. If error persists, contact Oracle Customer Support.
- ORA-12535: TNS:operation timed out
- Cause: The requested operation could not be completed within the time out period.
- Action: Look at the documentation on the secondary errors for possible remedy. See SQLNET.LOG to find secondary error if not provided explicitly. Turn on tracing to gather more information.
- ORA-12538: TNS:no such protocol adapter
- Cause: The protocol adapter requested (by way of the "(PROTOCOL=..)" keyword-value pair in a TNS address) is unknown. If the supplied address is typographically correct then the protocol adapter is not installed.
- Action: Install the protocol adapter or correct typographically error, as appropriate. Note: if the supplied address was derived from resolving the service name, check the address in the appropriate file (TNSNAMES.ORA, LISTENER.ORA or SQLNET.ORA).
- ORA-12539: TNS:buffer over- or under-flow
- Cause: Buffer too small for incoming data or too large for outgoing data.
- Action: This restriction (which is associated with CONNECT DATA) is not normally visible to the user. For further details, turn on tracing and reexecute the operation; contact Oracle Customer Support.
- ORA-12541: TNS:no listener
- Cause: The connection request could not be completed because the listener is not running.
- Action: Ensure that the supplied destination address matches one of the addresses used by the listener - compare the TNSNAMES.ORA entry with the appropriate LISTENER.ORA file (or TNSNAV.ORA if the connection is to go by way of an Interchange). Start the listener on the remote machine.
- ORA-12545: Connect failed because target host or object does not exist
- Cause: The address specified is not valid, or the program being connected to does not exist.
- Action: Ensure the ADDRESS parameters have been entered correctly; the most likely incorrect parameter is the node name. Ensure that the executable for the server exists (perhaps "oracle" is missing.) If the protocol is TCP/IP, edit the TNSNAMES.ORA file to change the host name to a numeric IP address and try again.
- ORA-12557: TNS:protocol adapter not loadable
- Cause: On some platforms (such as OS/2) protocol adapters are loaded at run-time. If the shared library (or DLL) for the protocol adapter is missing or one of its supporting libraries is missing then this error is returned.
- Action: For further details, turn on tracing and reexecute the operation. The trace file will include the name of the shared library (or DLL) that could not be loaded.
- ORA-12558: TNS:protocol adapter not loaded
- Cause: On some platforms (such as OS/2) protocol adapters are loaded at run-time. If the shared library (or DLL) for the protocol adapter has not been loaded, then this error is returned.
- Action: For further details, turn on tracing and reexecute the operation. The trace file will have the name of the shared library (or DLL) that has not been loaded.
- ORA-12560: TNS:protocol adapter error
- Cause: A generic protocol adapter error occurred.
- Action: Check addresses used for proper protocol specification. Before reporting this error, look at the error stack and check for lower level transport errors. For further details, turn on tracing and reexecute the operation. Turn off tracing when the operation is complete.
- ORA-12574: TNS:redirection denied
- Cause: The connect request failed because it would have required redirection and the caller has requested no redirections.
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation. If error persists, contact Oracle Customer Support.
- ORA-12576: TNS:handoff not supported for this session
- Cause: Handoff of a established session was attempted which either had tcps as its transport or NA options were enabled for this session.
- Action: Check the transport setting as well as NA options. If error persists, contact Oracle Customer Support.
- ORA-12589: TNS:connection not bequeathable
- Cause: An attempt to hand-off a connection from one process to another has failed because the protocol provider does not support it.
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation. If error persists, contact Oracle Customer Support.
- ORA-12593: TNS:no registered connection
- Cause: An attempt to solicit network event activity has failed because no connections are registered for event notification.
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation. If error persists, contact Oracle Customer Support.
- ORA-12601: TNS:information flags check failed
- Cause: The TNS information flags set by the process prior to connection negotiation were not present after the negotiation was finished.
- Action: This is an internal error. Enable tracing and attempt to repeat the error. If it occurs again, contact Oracle Customer Support.
- ORA-12602: TNS: Connection Pooling limit reached
- Cause: The operation failed because maximum active current connections has been reached. It may not be a real error when the Connection Pooling feature is enabled. It is possible that the application later reissues the operation and successfully grabs the connection pool slot and proceeds.
- Action: This is an internal error. Enable tracing and attempt to repeat the error. If it occurs again, contact Oracle Customer Support.
- ORA-12606: TNS: Application timeout occurred
- Cause: A network session did not reach an application-defined stage within the allowed time interval.
- Action: This is an error which does not normally appear at the high level. The action to take is application specific, and is detailed in the higher level error description.
- ORA-12607: TNS: Connect timeout occurred
- Cause: A network session did not reach a predefined connect stage within the allowed time interval.
- Action: This is an error which does not normally appear at the high level. The action to take is application specific, and is detailed in the higher level error description.
- ORA-12622: TNS:event notifications are not homogeneous
- Cause: An attempt to register a connection for event notification failed because the event notification type conflicts with existing registrations.
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation and contact Oracle Customer Support.
- ORA-12624: TNS:connection is already registered
- Cause: An attempt to register a connection for event notification failed because the connection is already registered.
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation and contact Oracle Customer Support.
- ORA-12628: TNS:no event callbacks
- Cause: An attempt to register a connection for event notification failed because asynchronous callbacks are not available.
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation and contact Oracle Customer Support.
- ORA-12629: TNS:no event test
- Cause: An attempt to register a connection for event notification failed because the ability to test for events is not available.
- Action: Not normally visible to the user. For further details, turn on tracing and reexecute the operation and contact Oracle Customer Support.
- ORA-12635: No authentication adapters available
- Cause: The executable was not linked with any authentication service adapters but the sqlnet.ora parameter that determines whether or not authentication is required was set to true.
- Action: Either disable the parameter or relink the executable with service adapters.
- ORA-12636: Packet send failed
- Cause: A process was unable to send a packet to another process. Possible causes are: 1. The other process was terminated.
2. The machine on which the other process is running went down.
3. Some other communications error occurred. - Action: If the cause is not obvious, contact Oracle Customer Support.
- ORA-12637: Packet receive failed
- Cause: A process was unable to receive a packet from another process. Possible causes are: 1. The other process was terminated.
2. The machine on which the other process is running went down.
3. Some other communications error occurred. - Action: If the cause is not obvious, contact Oracle Customer Support.
- ORA-12639: Authentication service negotiation failed
- Cause: No match was found between the types of authentication services that the client supports and those that the server is using.
- Action: Possible solutions: 1. Change the entry in sqlnet.ora that determines which services are to be used.
2. Relink the client with at least one of the authentication service adapters that the server supports.
3. Relink the server with at least one of the authentication service adapters that the client supports.
4. Disable authentication on both the client and server.
- ORA-12643: Client received internal error from server
- Cause: The client process received an error from the server that indicated that an internal Oracle Net native services error had occurred.
- Action: Enable tracing on both processes and attempt to recreate the problem. If successful in recreating the problem, contact Oracle Customer Support.
- ORA-12650: No common encryption or data integrity algorithm
- Cause: The client and server have no algorithm in common for either encryption or data integrity or both.
- Action: Choose sets of algorithms that overlap. In other words, add one of the client's algorithm choices to the server's list or vice versa.
- ORA-12651: Encryption or data integrity algorithm unacceptable
- Cause: The algorithm the server chose to use for encryption or data integrity was not one of the choices acceptable to the client. This is either the result of an internal error, of a network data transmission error, or of deliberate tampering with the transmitted data.
- Action: For further details, turn on tracing, re-execute the operation, and contact Oracle Customer Support.
- ORA-12656: Cryptographic checksum mismatch
- Cause: The cryptographic checksum received with a packet of incoming data didn't match the checksum computed by the receiving end. This indicates that the packet was tampered with or otherwise corrupted in transit.
- Action: Look for sources of data corruption, perhaps including deliberate tampering.
- ORA-12658: ANO service required but TNS version is incompatible
- Cause: A client process that is running an earlier version of TNS attempted to connect but the connection failed because the server process required that an ANO service (authentication, encryption, etc.) be used.
- Action: Relink the calling executable and retry the connection or eliminate the requirement that the service be used on the server side.
- ORA-12659: Error received from other process
- Cause: An error was received by one or more services from the process on the other side of the connection.
- Action: Enable tracing to determine the exact error(s). The error(s) is (are) not returned directly because an error generated by a server may not make sense on the client side and vice-versa.
- ORA-12660: Encryption or crypto-checksumming parameters incompatible
- Cause: One side of the connection specified "REQUIRED" for encryption or crypto-checksumming, while the other side specified "REJECTED".
- Action: Change the "REQUIRED" side to "REQUESTED" if the you want encryption or crypto-checksumming to be optional, or change the "REJECTED" side to "ACCEPTED" if you do not want the service to be optional.
- ORA-12661: Protocol authentication to be used
- Cause: The Oracle Advanced Security authentication service has determined that the Oracle Net transport protocol in use is to be utilized to authenticate a user's identity.
- Action: This error is used solely to communicate information between the authentication service and the Oracle Net session layer and should not normally be visible. If the error is seen, contact Oracle Worldwide Support.
- ORA-12663: Services required by client not available on the server
- Cause: Service(s) that was (were) required by the client process were not available on the server process.
- Action: Configure the server with the services required by the client (best solution) or delete the requirement from the configuration file of the client (least secure).
- ORA-12664: Services required by server not available on the client
- Cause: Service(s) that was (were) required by the server process were not available on the client process.
- Action: Configure the client with the services required by the server (best solution) or delete the requirement from the configuration file of the server (least secure).
- ORA-12666: Dedicated server: outbound transport protocol different from inbound
- Cause: The protocol specified for an externally-identified outbound connection from a dedicated server (database link) was not the same as that used for the inbound connection. It is not possible for Oracle Net to authenticate a proxy connection that uses a protocol that is different from that which was used for the connection to the dedicated server.
- Action: Specify the same protocol in the Oracle Net connect descriptor for the outbound connection as that used for the inbound connection.
- ORA-12667: Shared server: outbound transport protocol different from inbound
- Cause: The protocol specified for an externally-identified outbound connection from a shared server (database link) was not the same as as that used for the inbound connection. It is not possible for Oracle Net to authenticate a proxy connection that uses a protocol that is different from that which was used for the connection to the shared server.
- Action: Specify the same protocol in the Oracle Net connect descriptor for the outbound connection as that used for the inbound connection
- ORA-12668: Dedicated server: outbound protocol does not support proxies
- Cause: The protocol specified to perform an externally-identified proxy connection (database link) from a dedicated server does not support proxy connections.
- Action: Specify a protocol in the Oracle Net connect descriptor used for the connection that does support externally-authenticated proxy connections. NOTE: Because of a limitation in Oracle Net, the protocol used for the proxy connection must the same as that used for the connection from the client to the server.
- ORA-12669: Shared server: outbound protocol does not support proxies
- Cause: The protocol specified to perform an externally-identified proxy connection (database link) from a shared server does not support proxy connections.
- Action: Specify a protocol in the Oracle Net connect descriptor used for the connection that does support externally-authenticated proxy connections. NOTE: Because of a limitation in Oracle Net, the protocol used for the proxy connection must the same as that used for the connection from the client to the server.
- ORA-12671: Shared server: adapter failed to save context
- Cause: The adapter for the authentication service failed when it tried to save the data needed for proxy connections (database links) through the shared server.
- Action: Enable tracing to determine the exact error. Contact Oracle Customer Support if the reason is not obvious.
- ORA-12675: External user name not available yet
- Cause: The authentication service in use was not able to return the external name of a user of the ORACLE server because it is not available to the service yet.
- Action: This is just an informational message and should not normally be visible to the user. If the error does appear, contact Oracle Customer Support.
- ORA-12676: Server received internal error from client
- Cause: The server process received an error from the client which indicated that an internal Oracle Net native services error had occurred.
- Action: Enable tracing on both processes and attempt to recreate the problem. If the problem recurs, contact Oracle Customer Support.
- ORA-12677: Authentication service not supported by database link
- Cause: The authentication service used by the proxy process (database link) was unable to find the adapter being used by the client in its list of authentication mechanisms.
- Action: Specify an authentication adapter that is shared by the client and the server being used for the database link.
- ORA-12685: Native service required remotely but disabled locally
- Cause: A native service is required by the remote process but native services have been disabled locally.
- Action: Enable native services locally or change the configuration parameters on the remote host so that no native services are required.
- ORA-12688: Login failed: the SecurID server rejected the new pincode
- Cause: There are a number of reasons why the SecurID server would refuse a pincode: - The user might not have permission to make up his own pincode.
- The pincode was either too short or too long. Valid pincodes consist of minimal four, but no more than eight characters.
- The pincode contains any non alphanumeric characters. - Action: Reexecute the operation and make sure to use a pincode that satisfies the above requirements. If the problem persists, turn on tracing at the Oracle Server side of the connection and examine the trace file for the exact error.
- ORA-12689: Server Authentication required, but not supported
- Cause: Server Authentication is required for this connection, but not supported by both sides of the connection.
- Action: Make sure both sides of the connection have the correct version of Advanced Networking Option, and that the Authentication Adapter supports Server Authentication.
- ORA-12690: Server Authentication failed, login cancelled
- Cause: Server Authentication is required, but the server's credentials were found invalid by the client.
- Action: Make sure that the server has a valid set of credentials. Refer to your authentication adapter specific documentation on how to do this.
- ORA-12696: Double Encryption Turned On, login disallowed
- Cause: The user is using a Secure Protocol Adapter that has Encryption turned ON as well as ANO Encryption.
- Action: Turn OFF either ANO Encryption or the Protocol Adapter Encryption if possible. Refer to Oracle Advanced Security Administrator's Guide on how to do this.