1

I am considering making a recommendation to enforce a password verify function that will not allow users to change their own passwords. My understanding of the PASSWORD_VERIFY_FUNCTION in Oracle is that the function only restricts the password criteria when the user changes his or her own password. It would not restrict a privileged user from changing someone else's password or a third party IAM software from changing the password, but I cannot find that expressly documented. Am I correct?

3

The PASSWORD_VERIFY_FUNCTION is used, even when a privileged user changes another user's password, see below.

SQL> @?/rdbms/admin/utlpwdmg.sql
SQL> create user u1 identified by Oracle123#;

User created.

SQL> select profile from dba_users where username = 'U1';

PROFILE
------------------------------
DEFAULT

SQL> select limit from dba_profiles where profile = 'DEFAULT' and resource_name = 'PASSWORD_VERIFY_FUNCTION';

LIMIT
----------------------------------------
VERIFY_FUNCTION_11G

SQL> show user
USER is "SYS"

SQL> alter user u1 identified by 1;
alter user u1 identified by 1
*
ERROR at line 1:
ORA-28003: password verification for the specified password failed
ORA-20001: Password length less than 8
|improve this answer|||||
  • Unless the privileged user changes the user's password via VALUES. – Joshua Huber Jun 17 '14 at 22:30
  • A priviliged user could also set the profile's PASSWORD_VERIFY_FUNCTION to NULL, then update the user's password, then set the profile back again. – JasonInVegas Jun 24 '15 at 16:02
0

CREATE the user using BY VALUES:

CREATE USER "PEPITO" IDENTIFIED BY VALUES '7D7BA78DE23FF6'
      DEFAULT TABLESPACE "USERS"
      TEMPORARY TABLESPACE "TEMP";

This will bypass any password function

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.