Best to get the SAP SIngle Sign On product. It's not expensive, and any alternative I've seen is quite complicated.

If it's useful for anyone, there are two notes referring to this.2064052 - "ORA-00922: missing or invalid option" error in phase MAIN_SHDCRE/SUBMOD_SHDDBCLONE/DBCLONE or MAIN_NEWBAS/PARCONV_UPG 2445917 - ORA-00922: missing or invalid option in 12c T...