ORA-28007: the password cannot be reused

Question

Anytime I try and login with a user that has password verification profile I receive:
ORA-28007: the password cannot be reused
Please tell me that ApEx 2.2 did not actually just implement the 'change password' and see if the hashes match for the built in DB Authentication.

Answer 1

In hindsight, perhaps we should have mentioned in the Release Notes that when this new authentication scheme is used in post-2.0 applications, the underlying mechanism used for password verification is database version dependent, explaining potential drawbacks of the pre-10.2.0.3 method. Then developers would have better information about the new authentication scheme type and could decide if it was right for them. They would also be able to decide whether importing post-2.0 applications that used this authentication scheme from a 10.2.0.3 database into a post-2.0 Application Express instance on a pre-10.2.0.3 database would be the right choice given the same potential issues. However, this technique, like it or not, is used as a workaround to the absence of exposed password verification methods in earlier server versions and has been used for many years in production systems, including large-scale HTML DB deployments, from well before this new authentication scheme was exposed for use as such, but where developers implemented the method themselves as components of their authentication architecture.
In short, I think your objection to the method on technical grounds (citing known pitfalls) is valid but I think you're saying that anyone who's ever used the method in any application technology in a production system ought to have found a better alternative. Maybe you're right.
Scott