Changing password using forms_ddl not working

Question

All,
I am building a custom logon screen that is similar to Metalink Document 30860.1. The form works fine until it encounters error "ORA-28001 password expired". When this occurs the user is moved to a different block (CHNG_PSSWRD) to change their password.
In the OK button on this block I use the forms_ddl command to alter the user's password, then logout and log back in using the new password. This is where the application fails. The forms_ddl built-in returns form_faliure=false however, the password does not change and when the code attempts to logon the user back on the form encounters error ORA:1017. I can verify this by logging into SQL*PLUS, the password is still expired.
Here is the relevant code:
When-Button-Pressed (Item Level, on LOGON_BLOCK.BUTTON_CONNECT)
DECLARE
     v_connectResults varchar2(20);
BEGIN
     v_connectResults := connect_to;
IF v_connectResults = 'YES' THEN
leave(TRUE);
END IF;
:global.logon_tries := TO_NUMBER(:global.logon_tries) - 1;
IF TO_NUMBER(:global.logon_tries) = '0' THEN
leave(FALSE);
END IF;
IF v_connectResults = 'EXPIRED_PASSWORD' THEN
     msg_popup(dbms_error_text,'E',FALSE);
go_block('CHNG_PSSWRD');
END IF;
END;
FUNCTION connect_to RETURN VARCHAR2 IS
BEGIN
IF :logon_block.username IS NULL THEN
BELL;
END IF;
LOGON(:logon_block.username,
:logon_block.password||'@'||:logon_block.connect, FALSE);
IF FORM_SUCCESS THEN
RETURN 'YES';
ELSIF dbms_error_code = -28001 then
     RETURN 'EXPIRED_PASSWORD';
ELSE
     msg_popup(dbms_error_text,'E',FALSE);
RETURN 'NO';
END IF;
END;
PROCEDURE leave(p_status BOOLEAN DEFAULT TRUE) IS
BEGIN
IF p_status THEN
:global.logged_on := 'TRUE';
ELSE
:global.logged_on := 'FALSE';
END IF;
EXIT_FORM;
END;
This procedure is called by the OK button on CHNG_PSSWRD block
PROCEDURE change_password (p_passWrd in varchar2)
IS
v_un varchar2(60) := get_application_property(username);
v_cs varchar2(60):= get_application_property(connect_string);
statement varchar2(100);
begin
-- build the alter user statement for changing the password
statement := 'alter user ' ||v_un ||' identified by ' || p_passWrd;
-- print the contents of statement & connect string for testing purposes
msg_popup(statement || ' connect string: ' || v_cs,'I',FALSE);
     -- execute the alter user statement
forms_ddl(statement);
-- if RDBMS does not accept password, display database error message
if FORM_FAILURE then
     msg_popup(DBMS_ERROR_TEXT,'E',TRUE);
else
     -- password was accepted, log user back in with new password
     logout;
     if FORM_FAILURE then
          msg_popup(DBMS_ERROR_TEXT,'F',TRUE);
     end if;
     logon(v_un,p_passWrd ||'@'||v_cs,FALSE);
     -- Display error message if login fails
     if FORM_FAILURE then
          msg_popup(DBMS_ERROR_TEXT,'F',TRUE);
     else
     msg_popup('Your Password has been changed.','I',True);
     end if;
end if;
end;
This code executes on the form that runs the custom logon form
On-Logon (Form Level)
CALL_FORM('co_f_logon', NO_HIDE);
IF :global.logged_on != 'TRUE' THEN
RAISE FORM_TRIGGER_FAILURE;
END IF;
What am I doing wrong?
thanks for you help in advance
Jim C

Answer 1

This approach may not be the safest, as having a special account able to change other users passwords can bring important security considerations.
For example, suppose the user and password of that special account are "hard coded" in your application. That means you will not be able to change that password often. So, it will bee too easy to use a brute-force attac, to guess this password. After that, you could simply change the password of any user you want, and impersonate it. Of course, there are many other considerations to think of, but I'm sure you get the idea by now.
A much better approach could be to write a little program that receives username, old password, new password and connection as parameters, and uses the Oracle OCI API to change the password. Then you could simply call this little program from your application when needed, providing the right parameters, to do the trick.
I found a good sample of this in metalink note 52718.1, Handling Expired Passwords from within Forms (V4.5/5.0)
In this note, you'll find a little pro-c code to do just that. There is also another note (124970.1) with a little more complicated sample made in Java.
(you may need to select All Sources on metalink to find it, as they have been archived and are no longer presented if you search only the knowledge base).
hope this helps.
Eng. Gabriel Rosales Aymerich, M.Sc.
Senior DBA
Mercado de Valores de Costa Rica