Oracle Database / Accounts, Security & Access
ORA-24247: inspect database network ACL access for the actual principal
A PL/SQL network call can fail despite a working host network because database ACL policy denies the operation. Identify the executing principal and destination.
Environment and inputs: Oracle Database 19c baseline · SQL*Plus-compatible SQL unless RMAN, DGMGRL, ADRCI or a host shell is specified. Check release, patch level, edition and container first.
Start with this diagnostic
Use the stated SQL, RMAN, DGMGRL or host shell and replace sample names with approved targets. DBA and V$ views need authorized catalog access in the correct container. Do not grant broad privileges for an example.
SELECT host, lower_port, upper_port, principal, privilege, grant_type FROM dba_host_aces WHERE principal = 'APP_OWNER';Read the result
The entries show host ACE configuration for this principal. Effective permission also depends on host matching, ports, deny entries and execution context.
Resolve and verify
Compare the exact destination, port and package rights model. Have the security owner authorize only the required host and privilege, then retest the original call.
Operational precautions
Do not grant wildcard outbound access or bypass database ACLs to make a test pass.