I was getting ORA-01017: invalid username/password; logon denied intermittently (Mostly random using JDBC connection pool but OCI too).
Now (6 months later ...) I found why ... listener was routing connection attempt to MGMTDB
Services Summary...
Service "-MGMTDBXDB" has 1 instance(s).
Instance "-MGMTDB", status READY, has 1 handler(s) for this service...
Service "_mgmtdb" has 1 instance(s).
Instance "-MGMTDB", status READY, has 1 handler(s) for this service...
Service "orac" has 2 instance(s).
Instance "-MGMTDB", status READY, has 1 handler(s) for this service... Instance "orac1", status READY, has 1 handler(s) for this service...
Service "oracXDB" has 1 instance(s).
Instance "orac1", status READY, has 1 handler(s) for this service...
Now thinking back and issue during installation I didn't have -priv in hosts and that explains everything. And solution was simple
alter system set local_listener='(ADDRESS=(PROTOCOL=TCP)(HOST=x.x.x.x)(PORT=22333))' scope=both;
alter system set remote_listener='(ADDRESS=(PROTOCOL=TCP)(HOST=x.x.x.x)(PORT=22333))' scope=both;
Now lsnrctl status listener_scan1 looks good
Services Summary...
Service "orac" has 1 instance(s).
Instance "orac1", status READY, has 1 handler(s) for this service...
Service "oracXDB" has 1 instance(s).
Instance "orac1", status READY, has 1 handler(s) for this service...
Or just
srvctl stop mgmtdb
And on top of that one can still get ORA-01017 in JDBC 12.1.0.2 without patch 24943518.