How to change password version by myself in oracle?

Question

Oracle documentation (18c) says:

....

You must expire the users who have only the 10G password version, and do not have one or both of the 11G or 12C password versions.

For example:

ALTER USER username PASSWORD EXPIRE;

Ask the users whose passwords you expired to log in. When the users log in, they are prompted to change their passwords. The database generates the missing 11G and 12C password versions for their account, in addition to the 10G password version. The 10G password version continues to be present, because the database is running in the permissive mode.

...

But, there is some way to do it by myself? (and to use the same old password)

Answer 1

The exercise of updating the password hash that you reference is only necessary if you have users that only have a 10G password hash. If they also have 11G or 12C (or whatever is the minimum level you desire them to have) then there is no need to change or update individual users - just skip to setting the sqlnet.ora parameters described below to enforce the minimum authentication protocol usage you desire.

Check your password hash versions for each user with this query:

select username, password_versions from dba_users order by 2;

USERNAME         PASSWORD_VERSIONS
---------------- -----------------
PMDBA            10G

If there are in fact users with only a 10G hash as shown above, then they must reset their password to have Oracle create valid hashes for 11G or 12C authentication protocols. You cannot do it for them without knowing what the actual password was (knowing the 10G hash will not help). Assuming that they have clients like sqlplus that support handling expired passwords, you can force users to do it themselves by expiring their accounts with

ALTER USER username PASSWORD EXPIRE;

As @EdStevens warned however, not all client applications can handle this and may just prevent the user from logging in entirely. You will have to use your best judgement on how to force each user to change their password.

Once all of your users have the minimum level of hash that you require, set the sqlnet.allowed_logon_version_client and sqlnet.allowed_logon_version_server parameter on your server as described here (https://docs.oracle.com/en/database/oracle/oracle-database/19/netrf/parameters-for-the-sqlnet.ora.html#GUID-B2908ADF-0973-44A9-9B34-587A3D605BED) to enforce that minimum level of authentication protocol usage going forward.

When the final minimum values for the sqlnet.ora parameters are set, obsolete hash values will be deleted automatically whenever a user changes their password. There will be users that still show "10G" or other obsolete password versions for some amount of time after you set the sqlnet.ora parameters. This is ok, as the sqlnet.ora settings will not allow those less secure hash values to be used for authentication.

Answer 2

If you have the proper permissions, you can change anyone's password. Of course, if you want to keep the password the same, just "changing" it so that it gets upgraded to new standards, you will need to know the current value.

And you don't have to expire it first. Expiring the password simply forces the user to set a "new" password the next time they log in. And even that depends on what client they are using. Some do not trap and handle expired passwords, and simply fail the logon.

Exactly which oracle doc were you quoting? (Never quote a source without full citation.)