Re: Oracle 8.1.6 Alter User command fails with VERIFY_FUNCTION

Michael Dodd wrote:

> Try this :
>
> Opt to use the VERIFY_FUNCTION in your profile.
> as a normal user (no ALTER ANY USER)
>
> SQL> create user testing identified by testing_1;
>
> User created.
>
> SQL> grant connect to testing;
>
> Grant succeeded.
>
> SQL> connect testing/testing_1;
> Connected.
> SQL> alter user testing identified by qaz_1qaz;
> alter user testing identified by qaz_1qaz
> *
> ERROR at line 1:
> ORA-28003: password verification for the specified password failed
>
> SQL> connect system/password;
> Connected.
>
> SQL> grant alter user to testing;
>
> Grant succeeded.
>
> SQL> connect testing/testing_1;
> Connected.
> SQL> alter user testing identified by qaz_1qaz;
>
> User altered.
>
> SQL> alter user system identified by qaz_1qaz;
>
> User altered.
>
> SQL>
>
> The problem isn't with the password - the problem is with the use of
> ALTER USER without having ALTER USER permissions granted to the user.
> Once that is granted the user can change any user he or she wants to.
> That's the real problem here. The verify function prohibits the use
> of the ALTER USER command in 8.1.6 and higher.
>
> Does anyone have a solution? I am looking at avoiding the use of the
> verify_function. Oracle suggests using SQL*Plus or the OCI call in a
> DLL. That is not satisfactory. We need to have other solutions to
> this.

This is a known and very well reported "feature".

There is no solutions and my understanding is that this is by design.

Daniel A. Morgan Received on Thu Jun 07 2001 - 00:56:30 CDT