Make it secure

Question

I have created a Oracle Form.
I transfered this form onto Oracle Apps Server.
Its working fine.
This is a simple FORM.
Functionality of the user_unlock FORM is as follows:
Its allows user to unlock account.
This FORM base on all_users table.
when user run this form.
First user need to serach the name on
enter the name in the text field.
when user clicks on the button its unlock the user account.
I have wrote a procedure in my database.
execute this procedure on when_button_pressed trigger.
For this process make little secure.
I have created a user abc with create session privileges.
I have granted above procedure to the new user.
I add one database logon FORM in this process as below:
Now our non-oracle help desk user browse the url.
database logon FORM popup,
all username/password/strings values are already there.
They need to click on logon button will bring unlock FORM.
And helpdesk user will unlock the account.
Here are my worries:
What is to prevent someone from unlocking the privileged accounts that have
well known default passwords that are now shipped as locked?
The search facility makes it possible for a hacker to l
earn all the usernames on the database with a wildcard search.
How can I make it secure?
DN

Answer 1

DN, you asked this before I answered it.
Re: How to give limited privileges to the user to  perform required duties?
If you don't like that answer, please say so and why. Another alternative you might consider if you don't have an application user table and must use ALL_USERS is to create a role for your application and grant that role (without admin) to your application users. You can then join ALL_USERS with USER_ROLE_PRIVS in your block and eliminate all but the users of your application.