Password Expire 1

[Friend33]

Hi Tharg,

Thank you for the help you have rendered to me so far.

Had 2 small issues (silly ones !!) so i thought i could ask you.

1. In 'alter user scott password expire' which we write
after the user has been e-mailed a username/password
combo. But, where specifically do i write this ?
Can you explain please ?

2. Also, how do i prevent users from reusing passwords
that have been used in the last 12 months ?

Thank You,

Ravi

 

[Thargy]

Ravi,

you should expire the user's account in the same pl/sql routine that sends the email. You could also include advice in the email to the effect that the account has been configured to require the user to change their password, when next they log in. That way the user will be expecting the change.

With regard to preventing re-use, it is up to you to write a routine to implement your specific business requirements. Oracle has a password checking routine, but it is limited in scope. It is called PASSWORD_VERIFY_FUNCTION and can be used when you specify profiles. Whenever a user logs in, with a changed password, you have to pass this to your checking routine. The checking routine should check for re-use, easy to guess, password same as user name etc.

If you devise your own security, you will have to devise your own password checking routine.

I can't be more specific because I don't know if you're using Oracle standard security, your own custom Oracle security, front-end security or single sign-on.

Are you asking for me to post pl/sql that implements custom security?

Regards

Tharg

Grinding away at things Oracular