Re: Moving users between profiles - PW issues?

On 7 Dec 2003 07:32:42 -0800, jcsanne_at_yahoo.com (jay) wrote:

>My company has created a profile that all Oracle databases must
>implement. The main purpose of this profile is to enforce stronger
>password standards. The corporate folks have a new
>PASSWORD_VERIFY_FUNCTION that will enforce longer password lengths,
>ensure at least one special character, and at least one numeric.
>
>I manage a database that has about 300 folks in the DEFAULT profile
>without anything specified for PASSWORD_VERIFY_FUNCTION. I'm assuming
>that many of my users don't have passwords that meet all of the
>standards above.
>
>Before I blindly shift 300 accounts to this new profile I want to know
>what will happen to users with passwords that will "fail" new
>PASSWORD_VERIFY_FUNCTION.
>
>For instance, if the new PASSWORD_VERIFY_FUNCTION says 6 characters,
>but the user's password is 3 characters, what happens? Will Oracle
>force a "graceful" password change or is the account locked out?
>
>Does anyone has experience with this?
>
>Thanks.

IIRC the password verify function is only invoked when changing the password, so current passwords shouldn't be affected. The verify function isn't called at logon, as you seem to imply. It also *DOESN'T work with ALTER USER identified by, you'll need to use the password command (sql*plus) or a specific OCI, which I can't remember, but which is documented.

--
Sybrand Bakker, Senior Oracle DBA