Oracle - Understanding Password Hash Versions

Question

We ran into a problem, and so we're trying to understand all about the password versions. Here is what happened:

We upgraded from 11g to 12c. Our sqlnet.ora had this parameter: SQLNET.ALLOWED_LOGON_VERSION = 8. Users were able to log in, using both upper & lower case passwords. So all was good.

However, since SQLNET.ALLOWED_LOGON_VERSION = 8 was deprecated, thousands of error messages were going into the alert log. So, we commented out that parameter, and added SQLNET.ALLOWED_LOGON_VERSION_SERVER = 8, but then started receiving ORA-01017. So, we basically reset the password using "alter user......".

Once that was done, any client that had an upper case password could no longer connect. We noticed that the 10G was missing from the password_versions string.

So, to fix this, we put the SSQLNET.ALLOWED_LOGON_VERSION_SERVER = 11, then reset the password again, and then reset it back to SQLNET.ALLOWED_LOGON_VERSION_SERVER = 8.

The password_version string now contained 10G again, but still could not log in with an upper case password. So to finally fix this, we disabled password case sensitivity.

So we are curious on a couple things. First, why does the SQLNET.ALLOWED_LOGON_VERSION matter when it comes to the password_version? And, why after getting the 10G back into the password_version string, did it still not behave as it did before?

Many thanks.

Answer 1

First, note that the SEC_CASE_SENSITIVE_LOGON parameter has been deprecated, and that Oracle is planning to force case-sensitive passwords in coming releases.

SQLNET.ALLOWED_LOGON_VERSION determines which minimum hashing or encryption algorithms will be used for hash generation by the client or accepted by the server.

Changing PASSWORD_VERSION only changes the algorithms in use for future password hashing. It does not change or generate new hashes for existing passwords. So if your password_version was set for 12, then 10G would not be supported until you reset password_version and changed your password again.

All of the details (and much more) are documented here in "How Oracle Stores Passwords"