Can the following be setup in Oracle11.2 for password authentication?

  1. A new, non temp password should be atleast 24 hours old before it can be changed. System admin and authorized help desk personnel may change passwords of any age.

  2. Users will change temporary passwords including system administrator issued passwords at the first login.

I don't see these conditions in oracle documentation.

Thanks in advance


I am using the security documentation to answer your questions:

  1. No, a minimum password life cannot be specified. Only a PASSWORD_LIFE_TIME (maximum life time) can be specified. Depending on what you want to accomplish, PASSWORD_LOCK_TIME might be what you're looking for. (Source)
  2. Yes, this can be configured. You can expire a password, the user will then be prompted that he needs to change his password on first login. Look into the PASSWORD EXPIRE mechanism. (Source)

You could do the first part with a password verify function.
Query the name and ptime from user$, compare it to sysdate and when it hasn't been more than 24 hours raise an exception.
You can use the function from utlpwdmg.sql in the ORACLE_HOME/rdbms/admin directory or alternative one http://www.pentest.co.uk/sql/pentest_password_verify.pls as a starting point. Then associate the verify function with a profile and the profile with the user(s).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy