1

At work we have 11g and the boss told me to make passwords case sensitive, but that's where I'm going, he doesn't want to set the SEC_CASE_SENSITIVE_LOGON to true in the production environment and he told me to find a way to make it through the profiles of the Oracle Database System or another way.

Is there actually a way to make case sensitive passwords through profile settings or another way?

What i believe is that if you don't switch the parameter of SEC_CASE_SENSITIVE_LOGON there is no way the database would let you make them, since this parameter is from the database system itself.

Also from what I've been searching the PROFILE doesn't have any of these functions.

Improve this question
6
  • 5
    You are right, case sensitive passwords are set by parameter SEC_CASE_SENSITIVE_LOGON - nothing else. Just as information: When you set SEC_CASE_SENSITIVE_LOGON to true then passwords remain case insensitive as long it is modified the first time.
    – Wernfried Domscheit
    Jun 16, 2017 at 6:34
  • 1
    He needs to explain the reason why he doesn't want to use the parameter. One more hardcore solution would be using the password validation function in the profiles to validate that.
    – Renato Afonso
    Jun 16, 2017 at 10:06
  • Hey guys, after modifying the verify function and creating another array with all the letters in uppercase and another loop to check if there's an uppercase letter inside the password, it does work at the moment of changing the password, but when you authenticate to database if you put your password in uppercase or lowercase it will still let you in, unless you change the SEC_CASE_SENSITIVE_LOGON to true.
    – Alejandro Santana
    Jun 16, 2017 at 19:12
  • @Alsantana I figured that would be the case. I don't think it is possible to set case insensitivity using the password verify function (since that is only logic what the password can be set to, not password authentication itself during the login process. I don't see a downside to setting SEC_CASE_SENSITIVE_LOGON to TRUE. Instantaneous change, no downtime needed. Oracle highly recommends it is set to true (it is true by default starting in 11g, when the parameter was added). Of course, the hard part is changing all the passwords after the parameter is set to make it take effect.
    – Kris Johnston
    Jun 16, 2017 at 19:31
  • Just for the record: in 12c SEC_CASE_SENSITIVE_LOGON is deprecated
    – jmk
    Jun 17, 2017 at 9:32

1 Answer 1

Reset to default
1

Yep, it's really strange why SEC_CASE_SENSITIVE_LOGON should not be used for this if it's especially designed for the purpose. I can suggest in this case maybe just use some external authorization method like Oracle Identity Management, e.g.. It's much more complex and require additional infrastructure installed/configured and maintained, but users' credentials will be stored and controlled (including case-sensitive passwords) outside of the database and becomes independent on the database parameter value.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.