UTL_TCP、UTL_HTTP 和 UTL_SMTP支持数据库领域外的服务器之间的通信。例如，utl_tcp 用于在两台主机间建立 TCP/IP通信，而不是通过数据库链接。类似地，utl_http 用于从 Web 服务器发出 http 请求，utl_smtp 用于在主机间进行 SMTP邮件呼叫。
这些工具带来了巨大的安全风险。使用utl_tcp，数据库用户可以到达该主机可到达的任何其他计算机，甚至不会遇到系统提示。
11g为了增加安全引入细粒度权限，即access control lists(ACL).

近日有开发人员报告使用某服务一直遭遇 ORA-29273 http request failed.和ORA-24247: network access denied by access control list (ACL)；

登陆数据库11.1.0.7

SQL> select acl,PRINCIPAL,PRIVILEGE,IS_GRANT from dba_network_acl_privileges;

ACL                                                PRINCIPAL                                          PRIVILE IS_GRANT
-------------------------------------------------- -------------------------------------------------- ------- --------------------
/sys/acls/utlpkg.xml                               SCM_STUDY                                          connect true
/sys/acls/utlpkg.xml                               BUFORD                                             connect true

用户SCM_STUDY已经赋予了connect权限，再执行一遍
BEGIN
DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
acl => '/sys/acls/utlpkg.xml',
principal => 'scm_study',
is_grant => true,
privilege => 'connect');
COMMIT;
END;
/
ERROR at line 1:
ORA-44416: Invalid ACL: Unresolved principal 'BUFORD'
ORA-06512: at "SYS.DBMS_NETWORK_ACL_ADMIN", line 346
ORA-06512: at line 2

没有在dba_users/dba_roles发现BUFORD，于是删除
SQL> exec dbms_network_acl_admin.DELETE_PRIVILEGE('/sys/acls/utlpkg.xml','BUFORD');

PL/SQL procedure successfully completed.

SQL> commit;

Commit complete.

SQL> select acl,PRINCIPAL,PRIVILEGE,IS_GRANT from dba_network_acl_privileges;

ACL                                                PRINCIPAL                                          PRIVILE IS_GRANT
-------------------------------------------------- -------------------------------------------------- ------- --------------------
/sys/acls/utlpkg.xml                               SCM_STUDY                                          connect true

问题居然解决了，原来是XML中包含invalid记录，导致每次验证ACL时都失败；