Oracle Apps Password Security

Oracle applications 11i Implementations has a Security weakness. Oracle application 11i passwords are stored in the database. Apps password stores in2 tables: FND_USER and FND_ORACLE_USERID tables Stores internal oracle applications database accounts. The APPS and APPLSYS database accounts must always have the same password

The APPS.fnd_user table has all applications accounts and there Are 2 Password columns provide for ENCRYPTION.

ENCRYPTED_FOUNDATION_PASSWORD

  1. ENCRYPTED_USER_PASSWORD

The above 2 columns any also contains 1 of the String Values
1.External: Means User Authentication is Delegated So password is not stored in the FND_USER Table

2.INVALID Some Default Oracle apps Accounts access is blocked by directly updating the FND_USER Table.

3.X Means like INVALID

4.ZG If the Encryption Algorithm fails the Error MSG is stord in password column

The Passwords in FND_ORACLE_USERID maintained independent of the database, So Any changes to the account passwords using ALTER USER statements not reflect in the table. If you want change the passwords in FND_ORACLE_USERID can done by utility called FNDCPASS or sysadmin “ORACLE Form”

The Oracle Application passwords can be 1 to 100 chars length and longer Passwords are truncated at 100 Chars.

Oracle Apps passwords Encryption done by APPS.FND_WEB_SEC Or JAVA Class Oracle.apps.fnd.security.websessionManagerProc
Oracle.apps.fnd.security.AolSecurity
Oracle.apps.fnd.security.AolSecurityPrivate

You can find this class information at $JAVA_TOP Directory.

You can download the class and Using Java class Converter You can see how the code is written. The Actual Encryption and Decryption calls are in the “oracle.apps.fnd.security.AolSecurityPrivate” Java class. The Guest account Password is stores in System Profile. You can get by using

Select APPS.FND_PROFILE.VALUE('GUEST_USER_PWD') from dual.

Comments

Post a Comment

Popular posts from this blog

DRINK WATER ON EMPTY STOMACH

It is popular in Japan today to drink water immediately after waking up every morning. Furthermore, scientific tests have proven a its value. We publish below a description of use of water for our readers. For old and serious diseases as well as modern illnesses the water treatment had been found successful by a Japanese medical society as a 100% cure for the following diseases: Headache, body ache, heart system, arthritis, fast heart beat, epilepsy, excess fatness, bronchitis asthma, TB, meningitis, kidney and urine diseases, vomiting, gastritis, diarrhea, piles, diabetes, constipation, all eye diseases, womb, cancer and menstrual disorders, ear nose and throat diseases. METHOD OF TREATMENT 1. As you wake up in the morning before brushing teeth, drink 4 x 160ml glasses of water 2. Brush and clean the mouth but do not eat or drink anything for 45 minute 3. After 45 minutes you may eat and drink as normal. 4. After 15 minutes of breakfast, lunch and dinner do not eat or drink anything f...
Read more

How To Negotiate the Perfect Salary

A company is interested in hiring you for a new opening. You feel as if you are in high demand because you are in a skilled-labor or professional position that requires skills that you possess. If you are considering any new position and you are already employed, you should be seeking higher wages, a better working atmosphere, and an overall improvement in your career. Not asking about your wages up front is a mistake. During most every interview the employer is going to ask you that one question, which is: "What wages are you asking for if you were to come to work for us?" While this can be a difficult question to answer point-blank when you don't know the current rate of pay in the company, you can come prepared for the question and negotiate a higher rate of pay. Never act surprised when that big question is asked. Come to your interview prepared! Make a list of questions that are always asked during interviews, such as: Are you new to the area? Do you have a degree in...
Read more

Adding Responsibility

Using following Script you can Add required responsibilities yourself At APPS Schema. DECLARE v_session_id INTEGER := userenv('sessionid'); v_user_name VARCHAR2(30) ; l_resp_key varchar2(200); l_resp_app varchar2(2000); BEGIN v_user_name :=UPPER('&user_name'); l_resp_key :=UPPER('&resp_key'); l_resp_app :=UPPER('&resp_short_name'); --SELECT --fa.APPLICATION_SHORT_NAME, --fr.RESPONSIBILITY_KEY, --fr.RESPONSIBILITY_NAME --FROM --FND_APPLICATION_vl fa, --fnd_responsibility_vl fr --WHERE --fa.application_id=fr.application_id --AND fr.RESPONSIBILITY_NAME like 'MRC, USD Payables%Reporting%' ---Using Above Query Get Application Shot name and Responsibility Key fnd_user_pkg.addresp (username => v_user_name ,resp_app => l_resp_app ,resp_key => l_resp_key ,security_group => 'STANDARD' ,description => 'Auto Assignment' ,start_date => SYSDATE - 10 ,end_date => SYSDATE + 1000); COMMIT; dbms_output.put_line(...
Read more