1

I am considering making a recommendation to enforce a password verify function that will not allow users to change their own passwords. My understanding of the PASSWORD_VERIFY_FUNCTION in Oracle is that the function only restricts the password criteria when the user changes his or her own password. It would not restrict a privileged user from changing someone else's password or a third party IAM software from changing the password, but I cannot find that expressly documented. Am I correct?

3

The PASSWORD_VERIFY_FUNCTION is used, even when a privileged user changes another user's password, see below.

SQL> @?/rdbms/admin/utlpwdmg.sql
SQL> create user u1 identified by Oracle123#;

User created.

SQL> select profile from dba_users where username = 'U1';

PROFILE
------------------------------
DEFAULT

SQL> select limit from dba_profiles where profile = 'DEFAULT' and resource_name = 'PASSWORD_VERIFY_FUNCTION';

LIMIT
----------------------------------------
VERIFY_FUNCTION_11G

SQL> show user
USER is "SYS"

SQL> alter user u1 identified by 1;
alter user u1 identified by 1
*
ERROR at line 1:
ORA-28003: password verification for the specified password failed
ORA-20001: Password length less than 8
  • Unless the privileged user changes the user's password via VALUES. – Joshua Huber Jun 17 '14 at 22:30
  • A priviliged user could also set the profile's PASSWORD_VERIFY_FUNCTION to NULL, then update the user's password, then set the profile back again. – JasonInVegas Jun 24 '15 at 16:02
0

CREATE the user using BY VALUES:

CREATE USER "PEPITO" IDENTIFIED BY VALUES '7D7BA78DE23FF6'
      DEFAULT TABLESPACE "USERS"
      TEMPORARY TABLESPACE "TEMP";

This will bypass any password function

-1

ORA-28003: password verification for the specified password failed ORA-20001: Password length less than 16

If you are getting such a error, please follow the below.

  1. change the password with correct 16 character,will satisfy the password policy.
  2. change the profile from default to user defined profile/or create new profile alter user profile .
  3. now change the password as u wish, which not needed to full fill the password policy.
  4. now change the profile back to default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.