Setting a dual control password (SQL)

Set a dual control password or change the first or last part of a dual control password. This feature prevents an administrator from knowing a user's complete password.

Prérequis

You must have the CHANGE PASSWORD system privilege.

The target user must have the change_password_dual_control option enabled in their login policy.

Contexte et remarques

Another administrator must change the other part of the password. The user combines the two password parts and uses this combined password to connect to the database.

Password parts are case-sensitive and they cannot:

begin with white space, single quotes, or double quotes
end with white space
contain semicolons
be longer than 127 bytes in length

Task

Connect to the database.
An administrator executes the following statement to set the first part of the dual control password, and then communicates password-part1 to the user:
ALTER USER user-name IDENTIFIED FIRST BY password-part1;
Another administrator executes the following statement to set the second part of the dual control password, and then communicates password-part2 to the user.
ALTER USER user-name IDENTIFIED LAST BY password-part2;

Résultat

The password for the target user is set to use the combined first and last password parts (password-part1 password-part2).

Suivant

The target user connects to the database using the combined parts as their password, and is prompted to create a new password.

Setting a dual control password (SQL)

Task

See also