Identify current oracle encryption

Question

I currently run applications in Oracle WebDB built using PL/SQL. The only access I have to change a user's password for WebDB in an Oracle Enterprise Manager Console installed on my PC. Our web console and change password page for the users are no longer available.

I am trying to write a new change password page. Is there any way I can find out what encryption type the OEM console uses to update the sys.user$ table so I can replicate it in my new password change page?

Not really my area, but surely passwords are hashed rather than encrypted? — William Robertson, Aug 30 '18 at 15:10

score 2 · Answer 1 · answered Aug 30 '18 at 14:36

2

You can use dynamic sql in your PLSQL to perform the proper

'Alter user -user- identified by "password";'

statement.

answered Aug 30 '18 at 14:36

REW

1,228
9
8

score 1 · Answer 2 · answered Sep 03 '18 at 16:03

You may not update the SYS.USER$ view directly. And it is not encryption, it uses hashing.

Use ALTER USER <username> identified by <user_password> statements from PL/SQL. Then the password is hashed and stored as you see it in the SYS.USER$ view. You should make them dynamic, using the EXECUTE IMMEDIATE syntax:

DECLARE
  dml_create_user VARCHAR2(256) := ''; 
  s_user_to_create := 'ju' ;
  s_user_password := 'the_passwd' ;
BEGIN
  dml_create_user := 
      'create user '||s_user_to_create
   || 'identified by '||s_user_password
   || ' default tablespace TSR01 '
   || ' temporary tablespace TST01 '
   || '  profile DEFAULT ' ;

  EXECUTE IMMEDIATE dml_create_user  ; 
END;

Identify current oracle encryption

2 Answers2