ORA-01017 on Test in the New/Select Database Connection dialog: SID vs service name and thin vs OCI for a credential-free XE check

Goal

I want to validate a SQL Developer database integration without touching production credentials. My plan is to point the New/Select Database Connection dialog at a local Oracle XE instance with a throwaway low-privilege user and rely on the Test button, which performs a real login round-trip through the JDBC driver, to confirm reachability and authentication.

Where I'm stuck

When authentication fails, the dialog surfaces ORA-01017: invalid username/password; logon denied, raised by the server rather than SQL Developer itself. But I know ORA-01017 can also mask case-sensitive password issues, and expired or locked accounts report differently (ORA-28001/ORA-28000), so a failed test is ambiguous to interpret.

The bigger unresolved decision is the connection shape: SID versus service name, and thin versus OCI (thick) driver. These differ in tnsnames.ora resolution, wallet-based authentication support, and reliance on a matching Oracle client install — and none of it is validated until the first real connection attempt. A Test success also only proves authentication and reachability, not the schema privileges my integration queries actually need.

Questions

1. For a local XE smoke test, should I standardize on service name plus thin driver, or are there documented cases where SID or OCI changes whether Test succeeds?
2. How can I distinguish a genuine wrong-password ORA-01017 from case-sensitivity or account-status causes at the Test stage?
3. What minimal check beyond Test confirms the integration's required privileges without production access?