ORA-28000 – the account is locked in the Active Standby Database

ORA-28000, the account was unlocked in the primary database, but still locked in the Active Standby Database.

Situation:

The primary database is configured with Dataguard is returning an error ORA-28000, “the account is locked,” when the user tries to log in. 

The database administrator unlocked this user’s account in the primary database but still the user is unable to connect to the standby and receives the same error code, ORA-28000, for that specific user; nonetheless, the standby account status indicates that it is open.

Standby Situation:

SYS@DATABASE  > conn raheel/raheel123

ERROR:

ORA-28000: the account is locked

Warning: You are no longer connected to ORACLE.

SYS@DATABASE > select username,account_status from dba_users where username=’RAHEEL’;

USERNAME                      ACCOUNT_STATUS

——————————————————————————————

Raheel                               OPEN

SYS@DATABASE > @check_db

DbId Name      Log Mode     Open Mode            Database Role    Created             Resetlogs         Remote Archive

———– ——— ———— ——————– —————- ——————- ——————- ——————

603299473 RAHEEL   ARCHIVELOG   READ ONLY WITH APPLY PHYSICAL STANDBY 11/13/2019 20:16:17 11/13/2019 03:54:21 ENABLED

SOLUTION:
This is a result of the standby’s read-only access and inability to change any tables.  A user’s account is only locked in memory on the standby database when it has to be.

The database administrator, sysdba, is a privileged user who needs to log in to the standby and unlock the account.  The account is now unlocked in the standby database, as confirmed by the message ORA-28015 “Account unlocked, but the database is open for read-only access.”  After that, there are no more errors for the user to encounter when logging into the standby database.

Connect Standby Database and unlock the account:

SYS@DATABASE > ALTER USER RAHEEL ACCOUNT UNLOCK;

ALTER USER RAHEEL ACCOUNT UNLOCK;

ERROR at line 1:

ORA-28015: Account unlocked, but the database is open for read-only access

SYS@DATABASE > conn raheel/raheel123

Connected.