Oracle Password Rotation Failure due to Password Composition Policy Mismatch - CA Privileged Access Manager

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When attempting to rotate an Oracle Database account password in CA Privileged Access Manager (PAM), the operation may fail with the error: ORA-28003: password verification for the specified password failed. This error occurs when the password generated by PAM does not meet the specific password verification function (e.g., length requirements) assigned to the Oracle user profile.

Cause

The password complexity rules (Password Composition Policy) defined on the Oracle Database side are more stringent than the policy configured in PAM. For example, Oracle may require a minimum password length (e.g., 25 characters) that is not enforced or is set to a lower limit within the PAM policy.

Resolution

To resolve this issue, synchronize the PAM Password Composition Policy with the Oracle Database security requirements.

1. Log in to the CA Privileged Access Manager (PAM) client.
2. Navigate to Credentials > Manage Targets > Target Application.
3. Identify the Password Composition Policy assigned to the failing account.
4. Navigate to Credentials > Manage Targets > Password Composition Policies.
5. Locate the policy identified in step 3 and click View/Modify.
6. Ensure the "Maximum Length" is set to match the requirement specified by the Oracle database (e.g., 25 or higher).
7. Save the changes and re-attempt the password rotation.
8. Alternatively, adjust the password verification function on the Oracle Database side to align with the existing PAM policy settings.