CODEWITHSUNDEEP
oracle-databasesecuritypasswords
user4504267
user4504267

Reputation: 138

Oracle locking users when they use the same password

we have oracle set up to lock a user after 3 failed login attempts. however, when we change a password, we have some systems that will continue to use the old password for a few seconds. This is causing these accounts to get locked.

The purpose of locking an account is to prevent people from brute forcing a password.. but if systems just try the same password over and over, that's not really the point of locking the account. is there any way to allow the same password to be tried repetitively, but lock the account after 3 different passwords are tried?

Upvotes: 2

Views: 279

Answers (1)

Gary Myers
Gary Myers

Reputation: 35401

I don't believe there's any simple syntax for this.

Looking here you can probably develop a DDL trigger fired after an ALTER USER command that determines, from expiry_date on DBA_USERS, whether the password has just been changed. In that situation, it can change the profile to a less restrictive FAILED_LOGIN_ATTEMPTS. Then you'd have a batch job that picks up accounts with that profile after an hour or two, and sets it back to the standard profile.

Upvotes: 2

Related Questions