Alter user

Hi,
When im using these command the session remains hang
alter user username identified by password
kindly let me know the issues behind these
Thanks

oracle version?
whats in the alertlog?
Post last 10 lines.

Similar Messages

Using alter user to change oracle password for logged in web user on XE

Hi All
I'm building an app using the pl/sql web toolkit on XE (installed on Win XP Pro SP2). (I'm not using the APEX front-end).
I'm using basic authentication and oracle database user accounts, and when a user registers for the first time I create them an oracle user account with dynamic sql, followed by some initial setup stuff, and they then log in with it.
All fine so far.
However I want to allow the user to change their oracle password as part of maintaining their user details. I've done this in the past using the web toolkit and Oracle 9i and it has worked fine using dynamic sql.
Unfortunately I can't get the same thing to work in XE.
For example, if I create the following procedure in the schema aligned to the DAD which holds my application and then run it from a browser (IE or Firefox) then the
Browser and the db just hangs - not even an error message:
CREATE OR REPLACE PROCEDURE ut
AS
v_stmt varchar2(300);
BEGIN
HTP.htmlOpen;
HTP.headOpen;
HTP.title ('User Test');
HTP.headClose;
HTP.bodyOpen;
v_stmt := 'alter user "'||user||'" identified by "BERT"';
htp.print(v_stmt);
EXECUTE IMMEDIATE v_stmt;
htp.print('Done');
HTP.bodyClose;
HTP.htmlClose;
END;
If I run the same statement in SQL*plus it's fine, and if I run the same proc for a different user then it's fine too.
I'm sure it's something to do with trying to change the credentials of the currently logged in user, but I would at least have expected an error message.
I'd be grateful for any ideas.
Thanks
Steve

Hi g.myers
Thanks for your response.
Sorry, yes, bad turn of phrase there. It's not the entire db that hangs. The web browser (either IE or FF) hangs, and if I look at v$session at this point, I can see that the user STATUS=ACTIVE and the STATE=WAITING.
I should also point out that I am using standard Oracle users as users of the application, (e.g. create a new user account called TESTER1). These users are then granted the appropriate privileges on the owning schema in order to run the app, access the tables etc.
Therefore it is the user account (e.g. TESTER1) that is running the password change procedure that is owned by the SYS schema. (However again, this is the exact code and method that I've used in the past and it has worked fine).
If I leave the browser hanging long enough, it will eventually return with the following error:
Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request POST /h/hopapp.pwdmaint_do.
Reason: Error reading from remote server
cheers
Steve

Oracle Security - Controlling the 'alter user' privilege

Hi,
1. DB 10.1.0.5 and 10.2.0.3
2. "Admin User" needs to be able to change some users passwords in database.
3. Create user adminuser - grant alter user to adminuser.
4. DBAs will grant "approle" role to list of required users. DBAs will maintain control of who gets this role.
4. Create system trigger on alter database - will prevent "adminuser" from changing passwords for accounts not authorized - Script does not fire for DBAs and anyone changing their own password.
The trigger works as intended - the "adminuser" account can only change the specific set of users.
Question: We've discovered that the "adminuser" can also use the "alter user" privilege to change default tablespace and tablespace quota. User should only be able to change password.
Anyone have ideas on adding to the trigger to make sure the "adminuser" is only altering the password?
I am playing with the ora_is_alter_column system event, thinking that maybe the password column in user$ would be changed but so far I can't get this to work: Here is my trigger --
CREATE OR REPLACE TRIGGER SYS.PASSWORD_CONTROL AFTER ALTER ON DATABASE
DECLARE
DBACHK varchar2(50);
USRCHK varchar2(50);
BEGIN
BEGIN
-- Ensure users can change their own passwords --
IF
ora_login_user = ora_dict_obj_name
THEN
RETURN;
ELSE
-- Do not apply trigger to DBA group --
select grantee into DBACHK from dba_role_privs where granted_role='DBA'
and grantee = ora_login_user;
IF
DBACHK = ora_login_user
THEN
RETURN;
END IF;
END IF;
EXCEPTION
WHEN NO_DATA_FOUND
THEN
NULL;
END;
BEGIN
select grantee into USRCHK from dba_role_privs where
granted_role='DISCUSR' and grantee = ora_dict_obj_name;
IF
ora_dict_obj_type = 'USER'
and ora_dict_obj_name = USRCHK
---- Need to check that only the password is being change -- the line below does not work
and ora_is_alter_column('PASSWORD') = TRUE
THEN
RETURN;
ELSE
RAISE_APPLICATION_ERROR(-20003,
'You are not allowed to alter user.');
END IF;
EXCEPTION
WHEN NO_DATA_FOUND
THEN
RAISE_APPLICATION_ERROR(-20003,
'You are not allowed to alter user.');
END;
END;

user602453 wrote:
Ed, thank you for your reply. But, let me explain in more detail.
More detail is always helpful. ;-)
>
A specific user has been assigned as the application administrator. This admininstrator is responsible for reseting application user passwords. The DBA (me) recognizes the DB security issues so I am trying to craft a solution that will allow the application administrator the ability to change only the password of the application users.
I see that this may be out your hands, but I'd still question the wisdom of having an apps administrator being the one to change user passwords. Especially if that were a model where the users couldn't change their own passwords. I might accept it if the app admin were acting more of a helper to a clueless user.
Since the only way to change user passwords is to grant the 'alter user' privilege I need a system trigger to keep the user from changing non-application user passwords. Also, because I support nearly 100 production databases that support about 35 different applications I need a solution that can apply to multiple databases. I've been assured that there will only be one administrator charged with resetting passwords.
So,
Given those requirements, I have this trigger that will allow the the specific administrator to change the password of a specific set of user while not impacting DBAs or people wanting to change their own password. The way I've implemented this is to create a "dummy" role and assigning the role to the application user. The trigger will allow the administrator to change the password only if the user has the role assigned. The role has no privileges, it is just a way to "mark" the user as an application user. The administrator cannot grant this "dummy" role, only the DBA can.
Hope that clears things up.I still see another problem in that it still comes back to the dba to create the apps user in the first place, and to assign that dummy role to the user. Also, I'd hope that this proposed apps admin user is a role assigned to a real user. If not, as I mentioned before, you have no real accountability to who is using that account. Simply saying "it shall not be shared", even if written in corporate policy, won't secure it, and you won't be able to trace it. Well, you could turn on auditing and capture the OS userid in the audit log.

Sql_text truncated for alter user not in dba_hist_Sqltext

why sql_text is truncated for "alter user" in v$sqltext
when i query v$sqltext i am getting only "alter user abc" .. not full text..
where as i am getting full text from dba_hist_sqltext for alter user...
Any idea..?

adk wrote:
why sql_text is truncated for "alter user" in v$sqltext
when i query v$sqltext i am getting only "alter user abc" .. not full text..
where as i am getting full text from dba_hist_sqltext for alter user...
Any idea..?what do you see below?
09:48:38 SQL> DESC V$SQLTEXT
Name                            Null?    Type
ADDRESS                             RAW(8)
HASH_VALUE                             NUMBER
SQL_ID                              VARCHAR2(13)
COMMAND_TYPE                             NUMBER
PIECE                                  NUMBER
SQL_TEXT                             VARCHAR2(64)

How to alter user defined objects in oracle

Hi all,
Can any one tell me how to alter user defined objects in oracle .
Thanks,
P Prakash

prakash wrote:
Hi all,
Can any one tell me how to alter user defined objects in oracle .
DROP
then
CREATE
Handle:      prakash
Email:      [email protected]
Status Level:      Newbie (80)
Registered:      Feb 3, 2011
Total Posts:      185
Total Questions:      67 (65 unresolved)
so many questions & so few answers.
How SAD!
Edited by: sb92075 on Sep 22, 2011 9:22 AM

Database Crash after "alter user"

Hi,
I've a problem with oracle 8i databases on windows 2000 server, clustered (active-passive).
When I try to change sys password as sysdba the instance crashes without error messages in alterlog and without dump files.
ie:
sqlplus /nolog
SQL>conn sys/pwd@db as sysdba
SQL>alter user sys identified by pwd2;
this command works and the password file is updated, but the database cluster resource changed its status to "failed"
Is there a relationship with password file and microsoft cluster service or oralce fail safe?
this don't happens neither in standalone server nor clustered 10g databases

I think yes.
Check MOS FailSafe Database Goes Offline After Changing SYS Password - 167496.1
HTH
-Anantha

How to audit alter user sql statements in Oracle 11g.

I want to audit all the alter user sql statements that show who is altered with what sql stment including the connections performed by sys and system.
Ex: If I use the command : alter user xxx quota 50 GB on users;
Then how can i grab this sql stement and who performed it with the timings.

Pl post OS and database versions.
What have you learned from the documentation ?
http://download.oracle.com/docs/cd/E11882_01/server.112/e26088/statements_4007.htm#SQLRF01107
http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/guidelines.htm#DBSEG508
What have you tried to implement so far ?
HTH
Srini

A user granted with alter user privilege

Dear all
i have granted a user with create user, alter user system privilege so that he can create or alter users. But i found the user is able to alter the sys and system also.
Tell me how to restrict the user so that he can not effect sys and system.

Yes. I have created device collection with
installed specific software and used this collection to pull report from out the box report for Primary Device users( Not sure about exact report name but similar) for
this collection. Did some excel work to find primary device user.
But looks like there is no straight forward solution. It would be great if i know how to import multiple users from a text/csv file into a User collection.
Thanks

ALTER USER를 실행한 사용자를 확인하는 방법(SYSTEM EVENT TRIGGER)

제품 : ORACLE SERVER
작성날짜 : 2002-11-07
ALTER USER를 실행한 사용자를 확인하는 방법(SYSTEM EVENT TRIGGER)
================================================================
PURPOSE
자신이나 또는 다른 user들의 password를 바꾸는 등의 alter user command를
사용한 사용자를 확인하는 방법을 알아보자.
Explanation & Example
1. 사용자 정보를 저장할 event table을 생성한다.
Create event table and users to store the alterations made:
SQL> connect / as sysdba;
create table event_table
ora_sysevent varchar2(20),
ora_login_user varchar2(30),
ora_instance_num number,
ora_database_name varchar2(50),
ora_dict_obj_name varchar2(30),
ora_dict_obj_type varchar2(20),
ora_dict_obj_owner varchar2(30),
timestamp date
create user test1 identified by test1;
grant create session, alter user to test1;
create user test2 identified by test2;
grant create session to test2;
2. SYS user에서 AFTER ALTER Client Event Trigger 를 생성한다.
Note: This step creates a trigger and it is fired whenever the user "test1"
issues ALTER command (It can be ALTER USER or ALTER TABLE)
SQL> CREATE or REPLACE TRIGGER after_alter AFTER ALTER on database
BEGIN
IF (ora_dict_obj_type='USER') THEN
insert into event_table
values (ora_sysevent,
ora_login_user,
ora_instance_num,
ora_database_name,
ora_dict_obj_name,
ora_dict_obj_type,
ora_dict_obj_owner,
sysdate);
END IF;
END;
3. test1 user로 접속한 후 test2 user의 password를 변경하는 작업을 실행한다.
SQL> connect test1/test1
SQL> alter user test2 identified by foo;
4. test2 user의 password가 test1 user에 의해 변경되면 그런 내용을
event_table 에서 확인할 수 있다.
Now that we have altered the "test2" user password from user "test1", the
event_table should have captured this details.
Now Login in as sys and Query on event_table:
SQL> connect / as sysdba;
SQL> select * from event_table;
ORA_SYSEVENT ORA_LOGIN_USER ORA_INSTANCE_NUM
ORA_DATABASE_NAME
ORA_DICT_OBJ_NAME ORA_DICT_OBJ_TYPE
ORA_DICT_OBJ_OWNER TIMESTAMP
ALTER TEST1 1
T901.IDC.ORACLE.COM
TEST2 USER
13-JUN-02
event_table의 내용을 조회하여 LOGIN_USER와 ALTERED USER 는
ORA_LOGIN_USER와 ORA_DICT_OBJ_NAME column을 통해 확인할 수 있다.
비슷한 방법으로 아래의 event에서 trigger를 생성하여 확인할 수 있다.
1) BEFORE DROP
2) AFTER DROP
3) BEFORE ANALYZE
4) AFTER ANALYZE
5) BEFORE DDL
6) AFTER DDL
7) BEFORE TRUNCATE
8) AFTER TRUNCATE
Related Documents
Oracle Application Developer's Guide

MAXL - Alter User issue

Hi All,
Does Alter User MAXL work for an external user?
We use Alter User to add users to groups. This works fine for native users, say
Alter user user1 add to group1 ;
From the above statement it is not sure if user1 is a native or an external user. I think the default is native.
Is there any special way to specify that the user is an external user?
Appreciate your thoughts.
Thanks,
-Ethan.

Hi Cameron,
Thank you for the link.
I think LCM works only when both the source & destination are in Shared services mode.
In my case, source is not in Shared services.
All I want to know is, Is there any utility to assign "Server access" to external LDAP users?
Here is the problem.
I need to assign filter access to many users & groups.
I can create native groups & assign filters using MAXLS
I can Alter external LDAP users to assign them to groups using MAXL, ONLY after I give them server access & refersh security, because users will not be recognized in MAXL if they don't have server access privelege.
The complete process cannot be executed in one flow.
I have to manually assign server access to each user or manually include each user to a group & then assign server access to the group.
I am wondering if there is any thing in MAXL or any other utility to assign server access to the users.
This would be very helpful.
Thanks,
-Ethan.

Alter user system identified by manager; need help

SQL> connect /as sysdba;
Connected.
SQL> alter user system account unlock;
User altered.
SQL> alter user system identified by manager;
User altered.
SQL> connect system/manager@q17als;
ERROR:
ORA-28000: the account is locked
Warning: You are no longer connected to ORACLE.

can you try do to the connect system/manager without
putting the @q17als on it?
I bet it will work
Well that one should work, although it may not connect to the right database.
What may have happened is he logged in to a different database using "/as sysdba" and unlocked SYSTEM account there. Therefore connecting as system without using an alias would work (if the password is manager).
the net service name for q17als probably uses different database in its connect descriptor. We can see that if we know what connect descriptor for q17als looks like. (tnsping q17als or checking tnsnames.ora)
I agree with the earlier posts - I think you are
dealing with two different databasesThat is what I am trying to prove as well

Alter user identified by values

I use the following method for connecting as different users for test purposes:
- select the encrypted password from dba_users
- temporarily change their password,
- connect using a temporary password,
- reset their original password using the encrypted value.
The last step is achieved by the 'alter user identified by values ..' syntax.
However, I have now found that if the user has a profile with password complexity verification, this always seems to fail.
Appending the new 9.2 REPLACE <old_password> does not make any difference,
and in any case that should not be needed if being done with alter any user privilege.
Has anyone found a way around this ?

The bad news is that on a 9.2 database I got the error:
SQL> alter user a identified by values 'FD7C3F4E0D2D2A65' ;
alter user a identified by values 'FD7C3F4E0D2D2A65'
ERROR at line 1:
ORA-28003: password verification for the specified password failed
SQL>the good news is that on a 10.2 database it worked:
SQL> alter user a identified by values 'FD7C3F4E0D2D2A65' ;
User altered.
SQL>

Alter User Inside procedure

Hi to all,
I have a user named dbo and vijay.
I have a procedure under dbo named as sp_alteruser
CREATE OR REPLACE PROCEDURE DBO.SP_ALTERUSER
P_USER_ID IN VARCHAR2,P_PASSWORD IN VARCHAR2,P_MSG OUT VARCHAR2)
--Declaration of IN parameters
IS
E_PASSWORD EXCEPTION;
E_INVALIDUSER EXCEPTION;
PRAGMA EXCEPTION_INIT(E_PASSWORD,-00988);
PRAGMA EXCEPTION_INIT(E_INVALIDUSER,-01918);
BEGIN
DECLARE
V_COUNT NUMBER;
V_STATEMENT1 VARCHAR2(200);
BEGIN
--To check whether the user has been already exists
SELECT COUNT(*) INTO V_COUNT
FROM ALL_USERS
WHERE USERNAME = P_USER_ID;
IF V_Count = 0 THEN
--If the count is 0 means that the user does not exist
DBMS_OUTPUT.PUT_LINE('User Does Not exist');
END IF;
IF V_COUNT>0 THEN
--If the count is greater than 0 then the Alter statement is executed
V_STATEMENT1:= 'ALTER USER ' ||P_USER_ID||' IDENTIFIED BY '
||P_PASSWORD;
-- EXECUTE IMMEDIATE 'GRANT ALTER USER TO VIJAY';
-- EXECUTE IMMEDIATE 'ALTER USER ' ||P_USER_ID||' IDENTIFIED BY ' ||P_PASSWORD;
--EXECUTE IMMEDIATE v_STATEMENT1;
P_MSG := 'Password Changed Sucessfully';
END IF;
END;
EXCEPTION
WHEN E_PASSWORD THEN
P_MSG := 'Missing or Invalid Password';
WHEN E_INVALIDUSER THEN
P_MSG := 'User '||P_USER_id||' Does not exist';
END;
I have created a synonym with the same name as sp_alteruser and given the execute privilege to the user vijay...
This procedure works fine when I run as DBO user, when I am trying from the vijay user it is throwing the error as insufficient privilege.
I tried to give the alter user privilege explicitly but none gone right, when i gave dba privilege and checked with it works fine..
Please help me in this regard.
Thanks
vijay

Yes, I got it and apologies. Its not there so the error is correct. I am not sure that which priv is letting the dba role change another user, here is a list of privs for some default roles but none of them is there which depicts clearly the option to change another user.
A very stupid answer, try giving the alter user with the admin option and see what happens. I don't ahve a db here otherwise I would had done it.
HTH
Aman....

Restrict user having alter user privilege

When a user is granted with alter user, the user can change the password for sys. How to restrict the user, so that he can do user administration but cannot do anything with sys or system.

could you solve my problem.
I want to store picture in table using insert statement. But when save trigger executes system generates error message: bad bind variable
my email: [email protected]

Expire password - alter user - privilege authid

Hello to all
I need to allow the users of Data base, that when the password expires, can enter the new password from a page. What I am trying to do is to add a function to modify the user
create function usu_mod
as
begin
execute immediate 'alter user pepe identified by pepe2';
end;
some idea, raised affluent estaria? also it sends an insufficient error to me of privileges, since apex uses the APEX_PUBLIC_USER. I was looking for and I saw AUTHID DEFINER AUTHID, CURRENT_USER. it is necessary to use some of these commandos, somebody can give an idea me of like using them
Thank you very much
Juan Pablo

Juan - We talked about this here: Re: ORACLE Password Change using APEX FORM
Scott

Expire password - alter user - privilege authid (2) english

Hello to all
I need to allow the users of Data base, that when the password expires, can enter the new password from a page. What I am trying to do is to add a function to modify the user
create function usu_mod
as
begin
execute immediate 'alter user pepe identified by pepe2';
end;
some idea, raised affluent estaria? also it sends an insufficient error to me of privileges, since apex uses the APEX_PUBLIC_USER. I was looking for and I saw AUTHID DEFINER AUTHID, CURRENT_USER. it is necessary to use some of these commandos, somebody can give an idea me of like using them
Thank you very much
Juan Pablo

Juan - We talked about this here: Re: ORACLE Password Change using APEX FORM
Scott

Alter user

Similar Messages

Maybe you are looking for