Databricks Community

luketl2 · ‎01-28-2026

I am following this guide to connect to an Oracle DB in Amazon RDS: https://docs.databricks.com/aws/en/query-federation/oracle. I've created the connection, but when I go to test it, it loads for a while and then says "socket closed". From my understanding, this implies that the TCP session establishes (networking is fine) but immediately is closed by Oracle DB for whatever reason. I've gone through all the possibilities: we are using NNE, we checked and server-side NNE is at "REQUESTED" level (should be higher than "ACCEPTED"), we have stable egress IP and it is whitelisted on server side, and we have double-checked the service name. Not sure what else to do. Is there any way to get more info on the Databricks side? I tried checking driver logs but I did not see anything useful. Thanks

SteveOstrowski · ‎03-07-2026

Hi @luketl2,

Based on your description and the stack trace you shared, the root cause is almost certainly an NNE (Native Network Encryption) algorithm mismatch between the Oracle JDBC thin driver that Databricks uses and your Oracle RDS server-side configuration. The key clue is this line in your stack trace:

Authentication lapse 0 ms

This means the TCP handshake completed successfully (which you already confirmed with nc -vz), the JDBC driver initiated the Oracle Net session, but encryption/integrity algorithm negotiation failed during authentication. Oracle then drops the socket before the authentication exchange finishes.

Here is a systematic approach to diagnose and resolve this.

STEP 1: VERIFY THE SERVER-SIDE NNE ALGORITHM LIST

On your Oracle RDS instance, check which encryption and integrity (checksum) algorithms are configured. You can query this from a privileged session:

SELECT name, value
FROM v$parameter
WHERE name IN (
'sqlnet.encryption_types_server',
'sqlnet.encryption_server',
'sqlnet.crypto_checksum_types_server',
'sqlnet.crypto_checksum_server'
);

Or if you have access to the RDS parameter group, look for these parameters:

sqlnet.encryption_server = REQUESTED (you confirmed this)
sqlnet.encryption_types_server = (list of algorithms)
sqlnet.crypto_checksum_server = REQUESTED or ACCEPTED
sqlnet.crypto_checksum_types_server = (list of algorithms)

The Databricks JDBC thin driver supports a specific set of NNE algorithms. If your server is configured with algorithms the thin driver does not support (for example, older algorithms like DES or 3DES112 only, or newer ones not yet in the driver), negotiation will fail silently and Oracle closes the socket.

STEP 2: ALIGN ENCRYPTION ALGORITHMS

The Oracle JDBC thin driver typically supports these NNE encryption algorithms:

AES256
AES192
AES128
3DES168

And these integrity/checksum algorithms:

SHA256
SHA384
SHA512
SHA1

Make sure your RDS parameter group includes at least one algorithm from each list above. For example, in your RDS custom parameter group, set:

sqlnet.encryption_types_server = AES256,AES192,AES128
sqlnet.crypto_checksum_types_server = SHA256,SHA1

After changing RDS parameter group values, you may need to reboot the RDS instance for the changes to take effect (depending on whether the parameter is static or dynamic).

STEP 3: CHECK THE CRYPTO_CHECKSUM SETTING

A commonly overlooked cause of "socket closed" during NNE negotiation is the integrity/checksum configuration. Even if encryption negotiation succeeds, if the checksum algorithms do not match, Oracle will close the connection. Make sure:

sqlnet.crypto_checksum_server = REQUESTED (or ACCEPTED)
sqlnet.crypto_checksum_types_server includes at least SHA256 or SHA1

STEP 4: TEST WITH EXPLICIT JDBC PROPERTIES (OPTIONAL DIAGNOSTIC)

Since you already tried using the ojdbc driver from Maven directly, you can further diagnose by setting explicit NNE properties on the JDBC connection. In a notebook on your cluster, try:

jdbc_url = "jdbc:oracle:thin:@//YOUR_HOST:1521/YOUR_SERVICE_NAME"

connection_properties = {
"user": "YOUR_USER",
"password": "YOUR_PASSWORD",
"oracle.net.encryption_client": "REQUESTED",
"oracle.net.encryption_types_client": "(AES256)",
"oracle.net.crypto_checksum_client": "REQUESTED",
"oracle.net.crypto_checksum_types_client": "(SHA256)",
"oracle.jdbc.timezoneAsRegion": "false"
}

df = spark.read.format("jdbc") \
.option("url", jdbc_url) \
.option("dbtable", "(SELECT 1 FROM DUAL)") \
.options(**connection_properties) \
.load()

df.show()

If this works, the issue is confirmed as an algorithm mismatch. If it still fails, try changing the encryption_types_client and crypto_checksum_types_client values to match what your server supports.

STEP 5: CHECK FOR ORACLE RDS-SPECIFIC CONSIDERATIONS

Amazon RDS for Oracle has specific behavior around NNE:

1. NNE configuration is done through RDS option groups (not sqlnet.ora directly). Make sure the NATIVE_NETWORK_ENCRYPTION option is added to your RDS option group with compatible algorithms.

2. In the RDS option group, look for these settings under NATIVE_NETWORK_ENCRYPTION:
- SQLNET.ENCRYPTION_SERVER
- SQLNET.ENCRYPTION_TYPES_SERVER
- SQLNET.CRYPTO_CHECKSUM_SERVER
- SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER

3. RDS documentation for NNE configuration:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.NetworkEncryption.htm...

STEP 6: ENABLE JDBC DRIVER TRACING (ADDITIONAL DIAGNOSTICS)

For more detail on what is happening during the connection attempt, you can enable Oracle JDBC thin driver tracing on your Databricks cluster. Add these Spark config properties to your cluster configuration:

spark.driver.extraJavaOptions -Doracle.jdbc.Trace=true -Djava.util.logging.config.file=/tmp/ojdbc_logging.properties

Create the logging properties file in an init script:

cat > /tmp/ojdbc_logging.properties << 'EOF'
.level=FINE
handlers=java.util.logging.FileHandler
java.util.logging.FileHandler.pattern=/tmp/ojdbc_trace.log
java.util.logging.FileHandler.limit=50000000
java.util.logging.FileHandler.count=1
java.util.logging.FileHandler.formatter=java.util.logging.SimpleFormatter
EOF

After the failed connection attempt, check /tmp/ojdbc_trace.log on the driver for detailed NNE negotiation messages.

ADDITIONAL NOTES

- The Databricks documentation confirms that Lakehouse Federation uses NNE (not TLS) for non-Oracle Cloud connections: https://docs.databricks.com/aws/en/query-federation/oracle

- Make sure your Oracle RDS security group allows inbound traffic on port 1521 from the Databricks stable egress IPs (which you mentioned you have already done).

- If you are using a SQL warehouse (serverless), make sure you have configured a Network Connectivity Configuration (NCC) and that the stable NAT IPs are whitelisted on the RDS side: https://docs.databricks.com/aws/en/security/network/serverless-network-security/serverless-firewall....

- The "Socket read timed out" variant you saw with the Maven ojdbc driver points to the same root cause: the driver is waiting for the server to respond to its authentication/encryption handshake, but the server has already closed the socket due to algorithm negotiation failure.

If you have tried all the above and are still seeing the issue, I would recommend opening a Databricks support ticket. The support team can inspect the serverless/cluster-side connection logs at a deeper level and help identify the exact negotiation failure point.

* This reply used an agent system I built to research and draft this response based on the wide set of documentation I have available and previous memory. I personally review the draft for any obvious issues and for monitoring system reliability and update it when I detect any drift, but there is still a small chance that something is inaccurate, especially if you are experimenting with brand new features.

View solution in original post

Saritha_S · ‎02-03-2026

Hi @luketl2 Could you please provide us the complete stack trace?

luketl2 · ‎02-03-2026

A few notes: we know that my IP from the cluster I am testing on is whitelisted, and I have run nc -vz to their IP and port and it returns "open," so I am confident we establish tcp. Nothing in stderr on driver, but here is what I see in log4j:

26/02/03 15:19:41 INFO ClusterLoadMonitor: Removed query with execution ID:9. Current active queries:0

26/02/03 15:19:41 INFO SQLExecution: 0 QueryExecution(s) are running

26/02/03 15:19:41 INFO CurrentQueryContext: Thread Thread[WRAPPER-ReplId-19c23-fe347-5,5,main]: current category Some(EXECUTABLE_COMMAND), restoring to previous category Some(UNDETERMINED).

26/02/03 15:19:41 ERROR SQLDriverLocal: Error in SQL query: -- This is a system generated query from catalog explorer

CREATE FOREIGN CATALOG `foreign_data` USING CONNECTION `foreign_db` OPTIONS (service_name 'db_a', test_catalog 'true')

org.apache.spark.SparkIllegalArgumentException: [CANNOT_ESTABLISH_CONNECTION] Cannot establish connection to remote ORACLE database. Please check connection information and credentials e.g. host, port, user, password and database options. ** If you believe the information is correct, please check your workspace's network setup and ensure it does not have outbound restrictions to the host. Please also check that the host does not block inbound connections from the network where the workspace's Spark clusters are deployed. ** Detailed error message: ORA-17002: I/O error: Socket read interrupted, Authentication lapse 0 ms.

https://docs.oracle.com/error-help/db/ora-17002/. SQLSTATE: 08001

at org.apache.spark.sql.errors.QueryExecutionErrors$.cannotEstablishConnectionError(QueryExecutionErrors.scala:1278)

at org.apache.spark.sql.execution.datasources.jdbc.JDBCDialectTestConnection.testCatalogConnection(JDBCTestConnection.scala:86)

at com.databricks.sql.managedcatalog.command.QueryFederationCommand$.testCatalogConnection(queryFederationCommandsExec.scala:153)

at com.databricks.sql.managedcatalog.command.TestForeignCatalogConnectionCommand.run(queryFederationCommandsExec.scala:302)

at org.apache.spark.sql.execution.command.ExecutedCommandExec.$anonfun$sideEffectResult$2(commands.scala:84)

at org.apache.spark.sql.execution.SparkPlan.runCommandInAetherOrSpark(SparkPlan.scala:194)

at org.apache.spark.sql.execution.command.ExecutedCommandExec.$anonfun$sideEffectResult$1(commands.scala:84)

at com.databricks.spark.util.FrameProfiler$.record(FrameProfiler.scala:94)

at org.apache.spark.sql.execution.command.ExecutedCommandExec.sideEffectResult$lzycompute(commands.scala:81)

at org.apache.spark.sql.execution.command.ExecutedCommandExec.sideEffectResult(commands.scala:80)

at org.apache.spark.sql.execution.command.ExecutedCommandExec.executeCollect(commands.scala:94)

at org.apache.spark.sql.execution.QueryExecution.$anonfun$eagerlyExecuteCommands$5(QueryExecution.scala:553)

at com.databricks.util.LexicalThreadLocal$Handle.runWith(LexicalThreadLocal.scala:63)

at org.apache.spark.sql.execution.QueryExecution.$anonfun$eagerlyExecuteCommands$4(QueryExecution.scala:553)

at org.apache.spark.sql.catalyst.QueryPlanningTracker$.withTracker(QueryPlanningTracker.scala:233)

at org.apache.spark.sql.execution.QueryExecution.$anonfun$eagerlyExecuteCommands$3(QueryExecution.scala:552)

at org.apache.spark.sql.execution.SQLExecution$.$anonfun$withNewExecutionId0$11(SQLExecution.scala:486)

at com.databricks.sql.util.MemoryTrackerHelper.withMemoryTracking(MemoryTrackerHelper.scala:80)

at org.apache.spark.sql.execution.SQLExecution$.$anonfun$withNewExecutionId0$10(SQLExecution.scala:422)

at org.apache.spark.sql.execution.SQLExecution$.withSQLConfPropagated(SQLExecution.scala:810)

at org.apache.spark.sql.execution.SQLExecution$.$anonfun$withNewExecutionId0$1(SQLExecution.scala:352)

at org.apache.spark.sql.SparkSession.withActive(SparkSession.scala:1481)

at org.apache.spark.sql.execution.SQLExecution$.withNewExecutionId0(SQLExecution.scala:217)

at org.apache.spark.sql.execution.SQLExecution$.withNewExecutionId(SQLExecution.scala:747)

at org.apache.spark.sql.execution.QueryExecution.$anonfun$eagerlyExecuteCommands$2(QueryExecution.scala:548)

at org.apache.spark.sql.execution.QueryExecution$.withInternalError(QueryExecution.scala:1426)

at org.apache.spark.sql.execution.QueryExecution.$anonfun$eagerlyExecuteCommands$1(QueryExecution.scala:544)

at org.apache.spark.sql.execution.QueryExecution.withMVTagsIfNecessary(QueryExecution.scala:473)

at org.apache.spark.sql.execution.QueryExecution.org$apache$spark$sql$execution$QueryExecution$$eagerlyExecute$1(QueryExecution.scala:542)

at org.apache.spark.sql.execution.QueryExecution$$anonfun$$nestedInanonfun$eagerlyExecuteCommands$8$1.applyOrElse(QueryExecution.scala:621)

at org.apache.spark.sql.execution.QueryExecution$$anonfun$$nestedInanonfun$eagerlyExecuteCommands$8$1.applyOrElse(QueryExecution.scala:616)

at org.apache.spark.sql.catalyst.trees.TreeNode.$anonfun$transformDownWithPruning$1(TreeNode.scala:521)

at org.apache.spark.sql.catalyst.trees.CurrentOrigin$.withOrigin(origin.scala:85)

at org.apache.spark.sql.catalyst.trees.TreeNode.transformDownWithPruning(TreeNode.scala:521)

at org.apache.spark.sql.catalyst.plans.logical.LogicalPlan.org$apache$spark$sql$catalyst$plans$logical$AnalysisHelper$$super$transformDownWithPruning(LogicalPlan.scala:42)

at org.apache.spark.sql.catalyst.plans.logical.AnalysisHelper.transformDownWithPruning(AnalysisHelper.scala:361)

at org.apache.spark.sql.catalyst.plans.logical.AnalysisHelper.transformDownWithPruning$(AnalysisHelper.scala:357)

at org.apache.spark.sql.catalyst.plans.logical.LogicalPlan.transformDownWithPruning(LogicalPlan.scala:42)

at org.apache.spark.sql.catalyst.trees.TreeNode.transformDown(TreeNode.scala:497)

at org.apache.spark.sql.execution.QueryExecution.$anonfun$eagerlyExecuteCommands$8(QueryExecution.scala:616)

at org.apache.spark.sql.catalyst.plans.logical.AnalysisHelper$.allowInvokingTransformsInAnalyzer(AnalysisHelper.scala:418)

at org.apache.spark.sql.execution.QueryExecution.eagerlyExecuteCommands(QueryExecution.scala:616)

at org.apache.spark.sql.execution.QueryExecution.$anonfun$lazyCommandExecuted$1(QueryExecution.scala:429)

at scala.util.Try$.apply(Try.scala:213)

at org.apache.spark.util.Utils$.doTryWithCallerStacktrace(Utils.scala:1684)

at org.apache.spark.util.Utils$.getTryWithCallerStacktrace(Utils.scala:1745)

at org.apache.spark.util.LazyTry.get(LazyTry.scala:58)

at org.apache.spark.sql.execution.QueryExecution.commandExecuted(QueryExecution.scala:434)

at org.apache.spark.sql.Dataset.<init>(Dataset.scala:406)

at org.apache.spark.sql.Dataset$.$anonfun$ofRows$3(Dataset.scala:150)

at org.apache.spark.sql.SparkSession.withActive(SparkSession.scala:1481)

at org.apache.spark.sql.SparkSession.$anonfun$withActiveAndFrameProfiler$1(SparkSession.scala:1488)

at com.databricks.spark.util.FrameProfiler$.record(FrameProfiler.scala:94)

at org.apache.spark.sql.SparkSession.withActiveAndFrameProfiler(SparkSession.scala:1488)

at org.apache.spark.sql.Dataset$.ofRows(Dataset.scala:141)

at org.apache.spark.sql.SparkSession.$anonfun$sql$4(SparkSession.scala:1161)

at org.apache.spark.sql.SparkSession.withActive(SparkSession.scala:1481)

at org.apache.spark.sql.SparkSession.sql(SparkSession.scala:1113)

at org.apache.spark.sql.SparkSession.sql(SparkSession.scala:1185)

at com.databricks.backend.daemon.driver.DriverLocal$DbClassicStrategy.executeSQLQuery(DriverLocal.scala:372)

at com.databricks.backend.daemon.driver.DriverLocal.executeSQLSubCommand(DriverLocal.scala:472)

at com.databricks.backend.daemon.driver.DriverLocal.$anonfun$executeSql$1(DriverLocal.scala:496)

at scala.collection.immutable.List.map(List.scala:293)

at com.databricks.backend.daemon.driver.DriverLocal.executeSql(DriverLocal.scala:491)

at com.databricks.backend.daemon.driver.SQLDriverLocal.repl(SQLDriverLocal.scala:39)

at com.databricks.backend.daemon.driver.DriverLocal.$anonfun$execute$36(DriverLocal.scala:1321)

at com.databricks.unity.UCSEphemeralState$Handle.runWith(UCSEphemeralState.scala:51)

at com.databricks.unity.HandleImpl.runWith(UCSHandle.scala:104)

at com.databricks.backend.daemon.driver.DriverLocal.$anonfun$execute$30(DriverLocal.scala:1312)

at com.databricks.logging.AttributionContextTracing.$anonfun$withAttributionContext$1(AttributionContextTracing.scala:49)

at com.databricks.logging.AttributionContext$.$anonfun$withValue$1(AttributionContext.scala:293)

at scala.util.DynamicVariable.withValue(DynamicVariable.scala:62)

at com.databricks.logging.AttributionContext$.withValue(AttributionContext.scala:289)

at com.databricks.logging.AttributionContextTracing.withAttributionContext(AttributionContextTracing.scala:47)

at com.databricks.logging.AttributionContextTracing.withAttributionContext$(AttributionContextTracing.scala:44)

at com.databricks.backend.daemon.driver.DriverLocal.withAttributionContext(DriverLocal.scala:130)

at com.databricks.logging.AttributionContextTracing.withAttributionTags(AttributionContextTracing.scala:96)

at com.databricks.logging.AttributionContextTracing.withAttributionTags$(AttributionContextTracing.scala:77)

at com.databricks.backend.daemon.driver.DriverLocal.withAttributionTags(DriverLocal.scala:130)

at com.databricks.backend.daemon.driver.DriverLocal.$anonfun$execute$1(DriverLocal.scala:1236)

at com.databricks.backend.daemon.driver.DriverLocal$.$anonfun$maybeSynchronizeExecution$4(DriverLocal.scala:1721)

at com.databricks.backend.daemon.driver.DriverLocal.execute(DriverLocal.scala:879)

at com.databricks.backend.daemon.driver.DriverWrapper.$anonfun$tryExecutingCommand$2(DriverWrapper.scala:1054)

at scala.util.Try$.apply(Try.scala:213)

at com.databricks.backend.daemon.driver.DriverWrapper.$anonfun$tryExecutingCommand$1(DriverWrapper.scala:1043)

at com.databricks.backend.daemon.driver.DriverWrapper.$anonfun$tryExecutingCommand$3(DriverWrapper.scala:1089)

at com.databricks.logging.UsageLogging.executeThunkAndCaptureResultTags$1(UsageLogging.scala:616)

at com.databricks.logging.UsageLogging.$anonfun$recordOperationWithResultTags$4(UsageLogging.scala:643)

at com.databricks.logging.AttributionContextTracing.$anonfun$withAttributionContext$1(AttributionContextTracing.scala:49)

at com.databricks.logging.AttributionContext$.$anonfun$withValue$1(AttributionContext.scala:293)

at scala.util.DynamicVariable.withValue(DynamicVariable.scala:62)

at com.databricks.logging.AttributionContext$.withValue(AttributionContext.scala:289)

at com.databricks.logging.AttributionContextTracing.withAttributionContext(AttributionContextTracing.scala:47)

at com.databricks.logging.AttributionContextTracing.withAttributionContext$(AttributionContextTracing.scala:44)

at com.databricks.backend.daemon.driver.DriverWrapper.withAttributionContext(DriverWrapper.scala:81)

at com.databricks.logging.AttributionContextTracing.withAttributionTags(AttributionContextTracing.scala:96)

at com.databricks.logging.AttributionContextTracing.withAttributionTags$(AttributionContextTracing.scala:77)

at com.databricks.backend.daemon.driver.DriverWrapper.withAttributionTags(DriverWrapper.scala:81)

at com.databricks.logging.UsageLogging.recordOperationWithResultTags(UsageLogging.scala:611)

at com.databricks.logging.UsageLogging.recordOperationWithResultTags$(UsageLogging.scala:519)

at com.databricks.backend.daemon.driver.DriverWrapper.recordOperationWithResultTags(DriverWrapper.scala:81)

at com.databricks.backend.daemon.driver.DriverWrapper.tryExecutingCommand(DriverWrapper.scala:1089)

at com.databricks.backend.daemon.driver.DriverWrapper.executeCommandAndGetError(DriverWrapper.scala:766)

at com.databricks.backend.daemon.driver.DriverWrapper.executeCommand(DriverWrapper.scala:859)

at com.databricks.backend.daemon.driver.DriverWrapper.$anonfun$runInnerLoop$1(DriverWrapper.scala:630)

at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)

at com.databricks.logging.AttributionContextTracing.$anonfun$withAttributionContext$1(AttributionContextTracing.scala:49)

at com.databricks.logging.AttributionContext$.$anonfun$withValue$1(AttributionContext.scala:293)

at scala.util.DynamicVariable.withValue(DynamicVariable.scala:62)

at com.databricks.logging.AttributionContext$.withValue(AttributionContext.scala:289)

at com.databricks.logging.AttributionContextTracing.withAttributionContext(AttributionContextTracing.scala:47)

at com.databricks.logging.AttributionContextTracing.withAttributionContext$(AttributionContextTracing.scala:44)

at com.databricks.backend.daemon.driver.DriverWrapper.withAttributionContext(DriverWrapper.scala:81)

at com.databricks.backend.daemon.driver.DriverWrapper.runInnerLoop(DriverWrapper.scala:625)

at com.databricks.backend.daemon.driver.DriverWrapper.runInner(DriverWrapper.scala:548)

at com.databricks.backend.daemon.driver.DriverWrapper.run(DriverWrapper.scala:373)

at java.base/java.lang.Thread.run(Thread.java:840)

Suppressed: org.apache.spark.util.Utils$OriginalTryStackTraceException: Full stacktrace of original doTryWithCallerStacktrace caller