re sqldeveloper -- connections and passwords/expiry

We're trying out sqldeveloper as an application inside Nfuse (Citrix).

Two issues I have noted are
a. There doesn't seem to be a way of preventing an sqldeveloper user from "probing" the network trying out different hostname/IP:port:SID combinations. Is there any way to have an sqldeveloper install access only a specific database ?
Revoking write permission on IDEConnections.xml only prevents the user from saving his connection descriptors, but does not prevent him from making a new connection.

b. sqldeveloper does not handle ORA-28001 "the password has expired" by prompting the user to set a new password. I know that the PASSWORD command is not supported [yet ?].

These issues make it difficult to make sqldeveloper available to small groups accessing specific environments (eg one group of developers to be allowed only the TEST environment, another group of support persons to access only the PROD environment).

With the first issue, a Test Developer can still "try his luck" attempting to connect to a Production environment. Yes, the same issue arises in client-side SQLPlus and/or products like TOAD etc. But am wondering if there is any way to hard-code a specific connection in sqldeveloper. -- eg sqldeveloper as short-cut to connect only to TESTDB as user "developerA"

With the second issue, a new user cannot login until he has been given a full sqlplus client to first change his default (initial) password. Similarly, users cannot change their passwords regularly.

I've posted these questions at the sqldeveloper forum as well.

Hemant K Chitale
http://web.singnet.com.sg/~hkchital

--
http://www.freelists.org/webpage/oracle-l