Password Rollover in Oracle 19c: A Comprehensive Guide

Managing passwords in a database environment can often be challenging, especially during transitions. Oracle 19c introduces an innovative solution: the PASSWORD_ROLLOVER_TIME feature. This functionality makes it easier for database administrators (DBAs) to transition user passwords seamlessly without disrupting operations. In this guide, we’ll explore everything you need to know about configuring password rollover in Oracle 19c.

What is Password Rollover?

Password rollover is a feature that provides a defined period during which both the old and new passwords are valid for user authentication. This ensures a smooth transition when changing passwords, avoiding immediate lockouts or disruptions across connected applications and systems.

Why Use Password Rollover?

• Minimize Disruption: Users can continue working without interruptions during the transition.
• Enhance Security: Allows gradual implementation of new passwords while retaining control over access.
• Streamline Operations: Particularly useful in environments with multiple dependencies or automated connections.

Step-by-Step Guide to Configuring Password Rollover in Oracle 19c

1. Verify Your Database Version

Ensure your database is Oracle 19c, specifically version 19.12 or later. Run the following query to check:

SELECT * FROM v$version;


2. Set the Password Rollover Period

The PASSWORD_ROLLOVER_TIME parameter is configured at the profile level. You can set the period in hours:

• Set in Hours:
  For a 24-hour period:
  ALTER PROFILE defaultLIMIT PASSWORD_ROLLOVER_TIME 24;
• Set in Days:
  Since the parameter only accepts hours, calculate the equivalent for days (1 day = 24 hours). For example, to set a 3-day period:
  ALTER PROFILE my_profile LIMIT PASSWORD_ROLLOVER_TIME 72;

3. Assign the Profile to a User

If you’re working with a custom profile, assign it to the intended user:

ALTER USER username PROFILE my_profile;
Replace username with the actual user account name.

4. Change the User’s Password

Initiate the rollover period by updating the user’s password:

ALTER USER username IDENTIFIED BY new_password;
During the configured rollover time, both the old and new passwords will be valid.

Testing the Configuration

After setting up the rollover period:

1. Log in with the Old Password: sqlplus username/old_password@database
2. Log in with the New Password:sqlplus username/new_password@database

Both should work until the rollover period expires. After that, only the new password will be valid.

Disabling Password Rollover

If password rollover is no longer needed, set the PASSWORD_ROLLOVER_TIME to 0:

ALTER PROFILE my_profile LIMIT PASSWORD_ROLLOVER_TIME 0;
This ensures that the old password becomes invalid immediately after a change.

Best Practices for Using Password Rollover

1. Define a Reasonable Rollover Period: Avoid overly long rollover periods to minimize security risks.
2. Audit Login Activity: Regularly monitor database login attempts during the rollover period.
3. Notify Users: Inform users of password changes and the allowed transition time.
4. Update Dependencies: Ensure automated scripts, applications, and integrations use the new password promptly.

Quick Reference for Rollover Durations

• 12 hours: 12 hours
• 1 day: 24 hours
• 2 days: 48 hours
• 7 days: 168 hours

Why This Matters in Modern Database Management

As databases become increasingly interconnected with applications, ensuring smooth password transitions is critical. The PASSWORD_ROLLOVER_TIME feature in Oracle 19c not only simplifies this process but also enhances security and operational efficiency. By using this feature strategically, organizations can improve user experience and reduce the risks associated with abrupt password changes.

Conclusion

The password rollover feature in Oracle 19c is a powerful tool for DBAs managing complex environments. By following the steps outlined in this guide, you can implement this feature effectively and ensure a seamless password transition process for your users.

Do you use password rollover in your environment? Share your experiences or ask questions in the comments below!

Author: Rohit Mishri