Hi "Tom",

A question regarding the Gradual Password Rollover feature. I'm running Oracle Enterprise 19.24 on Linux.


Consider this example, assuming I run it on September 1st:

create profile PWROLLOVER limit password_rollover_time 10;

alter user SCOTT profile PWROLLOVER;
alter user SCOTT identified by "Lion2024";

This means that Scott will be able to use the old and new password until September 10th, after that the old password will expire and only the new one will work. I review this date by checking PASSWORD_CHANGE_DATE from DBA_USERS and the respective LIMIT from DBA_PROFILES.

So far so good.

Now consider this, executed on September 5th:

alter profile PWROLLOVER limit password_rollover_time 30;

To my knowledge, the expiry date of the old password is set when it is changed, so it will remain Sep. 10th.

Q1: Is this correct?

Q2: How/where can I see the actual expiry date for Scott after the profile change?

Thanks!
Bjoern

select 
       username, profile, account_status, password_change_date,
       case 
         when account_status like '%ROLLOVER%' then
           password_change_date + limit 
       end rollover_ends
from   dba_users 
join   dba_profiles
using  ( profile )
where  resource_name = 'PASSWORD_ROLLOVER_TIME';