ORA-28000 means the user's account is locked, so the database refuses every logon, even with the correct password. Accounts are locked by an administrator with ALTER USER ... ACCOUNT LOCK, or automatically after too many failed logins, when the user's profile sets FAILED_LOGIN_ATTEMPTS. An administrator unlocks the account; finding what caused the failed logins prevents it from locking again.
Reproduce the Error
A profile locks accounts after three failed logins, for one hour:
Example:
-- a test user whose profile locks it after 3 failed logins drop user if exists demo_app cascade; create profile demo_lock_profile limit failed_login_attempts 3 password_lock_time 1/24; create user demo_app identified by "Demo_Pass_26" profile demo_lock_profile; grant create session to demo_app;
Three wrong passwords, then the right one:
Example:
# three wrong passwords, then the right one for pw in Guess_1 Guess_2 Guess_3 Demo_Pass_26; do echo "--- password $pw" sqlplus -s -L demo_app/$pw@localhost:1521/FREEPDB1 <<'SQL' | grep -E "ORA-|DEMO_APP" select user from dual; SQL done
Output:
--- password Guess_1 ORA-01017: invalid credential or not authorized; logon denied --- password Guess_2 ORA-01017: invalid credential or not authorized; logon denied --- password Guess_3 ORA-01017: invalid credential or not authorized; logon denied --- password Demo_Pass_26 ORA-28000: The account is locked; login denied.
After the third failure the account is locked, and the correct password gets ORA-28000.
Find the Account Status
Example:
select username, account_status from dba_users where username = 'DEMO_APP';
select resource_name, limit from dba_profiles
where profile = 'DEMO_LOCK_PROFILE'
and resource_name in ('FAILED_LOGIN_ATTEMPTS', 'PASSWORD_LOCK_TIME');Output:
USERNAME ACCOUNT_STATUS ___________ _________________ DEMO_APP LOCKED(TIMED) RESOURCE_NAME LIMIT ________________________ ________ FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME .0416
LOCKED(TIMED) means a lock from failed logins, which ends on its own after PASSWORD_LOCK_TIME, here 1/24 of a day. LOCKED, without TIMED, means an administrator locked it.
Fix: Unlock the Account
Example:
alter user demo_app account unlock; select username, account_status from dba_users where username = 'DEMO_APP';
Output:
User DEMO_APP altered. USERNAME ACCOUNT_STATUS ___________ _________________ DEMO_APP OPEN
Example:
sqlplus -s -L demo_app/Demo_Pass_26@localhost:1521/FREEPDB1 <<'SQL' select user from dual; SQL
Output:
USER ---------- DEMO_APP
Things to Know
- A common cause is an application or job with an old password that keeps retrying; update it, or the account locks again.
- Unified auditing records failed logons, which shows where they came from.
- Sample and system accounts are often locked on purpose; unlock only those you need.
Related Guides
- How to Create Users with Profiles in Oracle
- How to Fix ORA-01017: Invalid Username/Password; Logon Denied in Oracle
Conclusion
ORA-28000 means the account is locked. Check its status in DBA_USERS, unlock it with ALTER USER ... ACCOUNT UNLOCK, and fix whatever keeps trying the wrong password.
