Re: password policy and ORA-28007: the password cannot be reused

From: Ivan Saez <i.a.saez.scheihing_at_tue.nl>
Date: Mon, 04 Mar 2002 14:29:02 +0100
Message-ID: <3C83769E.E350D3E9@tue.nl>

Hi,

I'll answer my own question:
old passwords are stored in user_history$ I did a trace to find out:

...
..
PARSING IN CURSOR ...
alter user isaez identifi
END OF STMT BINDS #1:

---

PARSING IN CURSOR
delete from user_history$ where password_date + :1/86400 < :2 and user# = :3
END OF STMT BINDS #2:

 bind 0:    value=155520000
 bind 1:    value="3/4/2002 14:6:14"
 bind 2:    value=193

155520000/86400 is 1800 days. That's the value of my PASSWORD_REUSE_TIME

---

PARSING IN CURSOR
select 1 from dual where exists (select password from user_history$ where password = :1 and user# = :2)

 bind 0: value="26EE11B3E752B0EB"
 bind 1: value=193

---

PARSING IN CURSOR
declare n boolean; x number; begin n:=sys.VERIFY_PASSWORD_FUNCTION(:1, :2,:3); if n = TRUE then x:=1; else x:=0; end if; :4:=x; end; END OF STMT
PARSE #2:c=0,e=0,p=0,cr=0,cu=0,mis=1,r=0,dep=1,og=0,tim=0 BINDS #2:

 bind 0:    value="ISAEZ"
 bind 1:    value="BLA"
 bind 2: dty=1 mxl=32(00) mal=00 scl=00 pre=00 oacflg=10 oacfl2=1 size=32

offset=0

   bfp=00000000 bln=32 avl=00 flg=09
 bind 3: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=00 oacfl2=1 size=24 offset=0

   bfp=018d8490 bln=22 avl=00 flg=05

Ivan Saez wrote:

> Hi,
>
> I'm implementing a password policy (Oracle 8.1.7.2 on Sun Solaris 2.8)
> and it seems that Oracle remembers ALL old passwords. This is my
> intention
> (I specified PASSWORD_REUSE_TIME 1800). But where does Oracle put old
> passwords? Is there a data dictionary table where Oracle stores old
> passwords?
> I thought Oracle did remember only one previous password but it seems
> it remembers all!
>
> kind regards,
>
> Ivan
Received on Mon Mar 04 2002 - 07:29:02 CST