Oracle Target Connector returns error "ORA-28221 REPLACE not specified"

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

When performing a password change operation for an Oracle Database account in the Privileged Access Manager (PAM) target connector, the operation fails with the following error: java.sql.SQLException: ORA-28221: REPLACE not specified

Environment

Product: Symantec Privileged Access Manager (PAM)

Component: Oracle Target Connector

Database: Oracle Database with PASSWORD_VERIFY_FUNCTION enabled.

Cause

The Oracle Target Connector is designed to read the configuration status of the REPLACE parameter at the time the page is loaded. If you attempt to enable the REPLACE option and change the password within the same save operation, the connector fails to pass the REPLACE keyword to the Oracle Database, triggering the ORA-28221 error and causing the Oracle database to reject the request.

This error typically occurs when the Oracle Database has a PASSWORD_VERIFY_FUNCTION enabled, requiring the REPLACE keyword for credential updates.

Resolution

To successfully change the password for the Oracle Target Account, you must split the configuration change and the password update into two separate operations:

1. Commit the REPLACE Setting:
   • Open the Oracle Target  Account for editing.
   • Go to the "Oracle" tab
   • Enable the REPLACE option. (Check mark the - Use REPLACE Syntax)
   • Click OK to Save. This ensures the setting is committed to the PAM database.
   • Do not modify the password field at this stage
2. Update the Password: 
   • Once the above save is successful.
   • Re-edit the same Oracle Target Account.
   • Enter the new password and perform the update operation
   • Click OK to Save.

This two-step process ensures the connector correctly recognizes the REPLACE parameter before sending the ALTER USER command to the Oracle Database.