Bypassing Password Verify Function

Question

I am considering making a recommendation to enforce a password verify function that will not allow users to change their own passwords. My understanding of the PASSWORD_VERIFY_FUNCTION in Oracle is that the function only restricts the password criteria when the user changes his or her own password. It would not restrict a privileged user from changing someone else's password or a third party IAM software from changing the password, but I cannot find that expressly documented. Am I correct?

Answer 1

The PASSWORD_VERIFY_FUNCTION is used, even when a privileged user changes another user's password, see below.

SQL> @?/rdbms/admin/utlpwdmg.sql
SQL> create user u1 identified by Oracle123#;

User created.

SQL> select profile from dba_users where username = 'U1';

PROFILE
------------------------------
DEFAULT

SQL> select limit from dba_profiles where profile = 'DEFAULT' and resource_name = 'PASSWORD_VERIFY_FUNCTION';

LIMIT
----------------------------------------
VERIFY_FUNCTION_11G

SQL> show user
USER is "SYS"

SQL> alter user u1 identified by 1;
alter user u1 identified by 1
*
ERROR at line 1:
ORA-28003: password verification for the specified password failed
ORA-20001: Password length less than 8

Answer 2

CREATE the user using BY VALUES:

CREATE USER "PEPITO" IDENTIFIED BY VALUES '7D7BA78DE23FF6'
      DEFAULT TABLESPACE "USERS"
      TEMPORARY TABLESPACE "TEMP";

This will bypass any password function

Answer 3

ORA-28003: password verification for the specified password failed ORA-20001: Password length less than 16

If you are getting such a error, please follow the below.

1. change the password with correct 16 character,will satisfy the password policy.
2. change the profile from default to user defined profile/or create new profile alter user profile .
3. now change the password as u wish, which not needed to full fill the password policy.
4. now change the profile back to default.