1

At work we have 11g and the boss told me to make passwords case sensitive, but that's where I'm going, he doesn't want to set the SEC_CASE_SENSITIVE_LOGON to true in the production environment and he told me to find a way to make it through the profiles of the Oracle Database System or another way.

Is there actually a way to make case sensitive passwords through profile settings or another way?

What i believe is that if you don't switch the parameter of SEC_CASE_SENSITIVE_LOGON there is no way the database would let you make them, since this parameter is from the database system itself.

Also from what I've been searching the PROFILE doesn't have any of these functions.

  • 5
    You are right, case sensitive passwords are set by parameter SEC_CASE_SENSITIVE_LOGON - nothing else. Just as information: When you set SEC_CASE_SENSITIVE_LOGON to true then passwords remain case insensitive as long it is modified the first time. – Wernfried Domscheit Jun 16 '17 at 6:34
  • 1
    He needs to explain the reason why he doesn't want to use the parameter. One more hardcore solution would be using the password validation function in the profiles to validate that. – Renato Afonso Jun 16 '17 at 10:06
  • Hey guys, after modifying the verify function and creating another array with all the letters in uppercase and another loop to check if there's an uppercase letter inside the password, it does work at the moment of changing the password, but when you authenticate to database if you put your password in uppercase or lowercase it will still let you in, unless you change the SEC_CASE_SENSITIVE_LOGON to true. – Alejandro Santana Jun 16 '17 at 19:12
  • @Alsantana I figured that would be the case. I don't think it is possible to set case insensitivity using the password verify function (since that is only logic what the password can be set to, not password authentication itself during the login process. I don't see a downside to setting SEC_CASE_SENSITIVE_LOGON to TRUE. Instantaneous change, no downtime needed. Oracle highly recommends it is set to true (it is true by default starting in 11g, when the parameter was added). Of course, the hard part is changing all the passwords after the parameter is set to make it take effect. – Kris Johnston Jun 16 '17 at 19:31
  • Just for the record: in 12c SEC_CASE_SENSITIVE_LOGON is deprecated – jmk Jun 17 '17 at 9:32
1

Yep, it's really strange why SEC_CASE_SENSITIVE_LOGON should not be used for this if it's especially designed for the purpose. I can suggest in this case maybe just use some external authorization method like Oracle Identity Management, e.g.. It's much more complex and require additional infrastructure installed/configured and maintained, but users' credentials will be stored and controlled (including case-sensitive passwords) outside of the database and becomes independent on the database parameter value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.