Password Rotation

This topic describes how to configure password rotation, its behavior, and provides examples in Oracle-compatible mode. The password rotation mechanism allows both the old and new passwords to be used for authentication within a set validity period after a password change. This helps ensure a smooth transition and reduces the risk of business interruptions during the password change process.

Password Rotation Behavior

Before configuration, understand the behavior characteristics of password rotation:

• Automatic entry into rotation: When the user's profile is configured with PASSWORD_ROLLOVER_TIME, changing the password automatically triggers password rotation. During the rotation window, both the old and new passwords can be used for login.
• Multiple password changes within the rotation period: If you change the password multiple times within the rotation validity period, usually only the initially retained old password and the last set new password are valid simultaneously. Passwords generated in intermediate iterations are no longer considered valid old passwords.
• Beyond the rotation period: After the rotation time specified by the profile expires, the old password automatically becomes invalid, and only the new password is usable.
• Support for ending rotation early: You can end the current password rotation period early without waiting for natural expiration, causing the old password to immediately become invalid (only the current password is retained). For specific commands, see the "End rotation manually" section below.

Configure Password Rotation

Control the Password Rotation Validity Period

Password rotation means that during the dual-password state, users can change their password at any time, but the old password can still be used for login until the rotation validity period expires or rotation is manually ended, after which the old password becomes invalid. The current feature provides parameters to control the rotation validity period and views to view the rotation validity period.

• Control method: Define the password rotation window using the profile-level parameter PASSWORD_ROLLOVER_TIME, in microseconds. Within this window, after a user changes their password, they can use both the old and new passwords for authentication for a period of time. After the window expires or rotation is manually ended, the old password becomes invalid. Users must be associated with a profile that has PASSWORD_ROLLOVER_TIME configured before entering the rotation period after a password change.
• View the rotation validity period: You can view the rotation strategy configured for a tenant/profile by checking the row where RESOURCE_NAME is PASSWORD_ROLLOVER_TIME in the DBA_PROFILES view. The LIMIT column displays the configured strategy.
• Profile description: A profile is a policy template for user passwords and login restrictions. After associating a user with a profile, the user inherits the password policies within it. For example, PASSWORD_ROLLOVER_TIME is one such policy.

End Rotation Manually

If you do not want to wait for the rotation to naturally expire, you can end the current password rotation period early, causing the old password to immediately become invalid (only the current password is retained):

ALTER USER user_name EXPIRE PASSWORD ROLLOVER PERIOD;

The parameters are described as follows:

• user_name: The target Oracle username. The execution privileges are the same as for regular ALTER USER; typically, you need the ALTER USER system privilege.

Examples

To set the password rotation validity period for the DEFAULT profile to 86400000000 microseconds (an example value; please convert according to your business needs), you must have the corresponding management privileges:

obclient [SYS]> ALTER PROFILE "DEFAULT" LIMIT PASSWORD_ROLLOVER_TIME 86400000000;

Update the password for the user appuser to NewSecret. If rotation is enabled for the profile, the user enters the rotation period:

obclient [SYS]> ALTER USER appuser IDENTIFIED BY NewSecret;

After the business switchover is completed, end the rotation in advance:

obclient [SYS]> ALTER USER appuser EXPIRE PASSWORD ROLLOVER PERIOD;

Feature maintenance

You can view the password rotation status through system views:

• When password rotation is in progress and the account can still be logged in normally, the ACCOUNT_STATUS field in the DBA_USERS or USER_USERS view displays as OPEN & IN ROLLOVER, indicating that the account is normal and in the password rotation period, and both the old and new passwords are valid.

References

• ALTER USER
• ALTER PROFILE
• DBA_PROFILES
• DBA_USERS
• USER_USERS