Breaking the Oracle Database Password Stalemate: A Solution That Actually Works

Many Oracle databases have application account passwords that haven’t changed in years, and some are still on their defaults. Compliance frameworks like SOX and PCI DSS expect them to be rotated, and they rarely are, because changing one has traditionally meant risking an outage.

Why Passwords Don’t Get Changed

When it comes to changing Oracle database application account passwords, how many times have you heard some combination of “it’s too hard/can’t be done/not sure of the impact/vendor silence or non-response”? These responses have become so routine that many organisations have simply accepted the risk rather than face potential downtime or application failures.

Traditional password changes for database application accounts are all-or-nothing events. Change the password, update every connection string and configuration file simultaneously, and hope nothing breaks. Miss one connection point, and critical applications go offline, along with the cause being an absolute nightmare to diagnose.

Oracle Provides a Path Forward

Gradual password rollover, introduced in Oracle 21c and backported to Oracle 19c (19.12 and above), allows both the old and new passwords to work simultaneously during a transition period.

Instead of an immediate cutover, you can activate the new password while keeping the old one functional. This gives you time to methodically update applications, test connections, identify old password connection sources, and verify everything works before decommissioning the old password.

Implementation Requirements

Before implementing gradual password rollover, ensure your Oracle database is running 19.12+, Oracle 21c or 23ai. The feature works with most connection methods, though you’ll want to test with your specific application stack. The rollover period is configurable up to 60 days, giving you the flexibility to extend or shorten the transition window based on your operational needs.

Enabling Gradual Password Rollover

This feature can be enabled using the following example for a 30 day rollover period:

alter profile EBS_APPS limit PASSWORD_ROLLOVER_TIME 30;

To check what client connections are still using the old password:

SELECT DBUSERNAME, AUTHENTICATION_TYPE, OS_USERNAME, USERHOST, EVENT_TIMESTAMP
FROM UNIFIED_AUDIT_TRAIL
WHERE ACTION_NAME='LOGON' AND EVENT_TIMESTAMP > SYSDATE-1
AND REGEXP_LIKE(AUTHENTICATION_TYPE, '(VERIFIER=.*?-OLD)');