Password security policy can prohibit password changes

Details

Detail name Value
Changelog Number 10869
Type Bug
Status Resolved
Affected Versions Exasol 7.0.0, Exasol 6.1.11, Exasol 6.2.8
Fix Versions Exasol 7.0.3, Exasol 6.2.11, Exasol 6.1.13
Resolution Date 2020-10-07

Background

In EXASOL-2660 old SHA-based passwords hashes were retired, which required users that have these old passwords to change their passwords before updating to one of the mentioned versions.

Description

Under certain conditions, users may not be able to change their password after the update if both of these conditions are met:

  • The password security policy REUSABLE_AFTER_CHANGES or REUSABLE_AFTER_DAYS is set
  • An old SHA based password was used in last n passwords defined in REUSABLE_AFTER_CHANGES or m days defined in REUSABLE_AFTER_DAYS

Workaround

Disable the password security policy temporarily for changing the password using a DBA user. 

--save the policy first, if you haven't already
select SYSTEM_VALUE from EXA_PARAMETERS where PARAMETER_NAME='PASSWORD_SECURITY_POLICY';

--turn the policy off
alter system set PASSWORD_SECURITY_POLICY='OFF';

--change the password
 ALTER USER U1 IDENTIFIED BY '<SECRET>';

--turn the policy on again
alter system set PASSWORD_SECURITY_POLICY='<policy you saved>';