Skip to main content
This page covers what’s specific to rotating the password of an Oracle account. To turn on rotation and set a rotation account, see Credential rotation.

​
Prerequisites

  • A Gateway running v0.43.133 or later
  • A rotation account with a password of 30 characters or fewer (see Password length)

​
Rotation account

The rotation account needs permission to change the target user’s password:
  • The account itself: An Oracle user can change its own password, so it needs no privileges beyond CREATE SESSION
  • A different account: The rotation account needs the ALTER USER system privilege
For example, to create a rotation user and a user for it to rotate:
Add both users to Infisical PAM as Oracle accounts with the same host, port, and service name, then select infisical_rotator as the rotation account on the app_user account’s Rotation tab. Oracle scopes each user to one database, so a rotation account that connects to a different service name can’t find the target user.

​
How the password is changed

Infisical signs in as the rotation account, using the account’s connection details and SSL settings, and runs:
If the account rotates its own password, the statement also includes the current password, which Oracle requires when a password policy is in force:

​
Password length

Infisical can’t generate an Oracle password longer than 30 characters, and an Oracle template doesn’t accept a Min length above 30. Oracle itself accepts longer passwords, but the Gateway can’t sign in with them. If Infisical generated a longer password, it could no longer reach, check, or rotate the account. If the rotation account’s own password is longer than 30 characters, the rotation account can’t sign in, so change its password to 30 characters or fewer.

​
Troubleshooting

If sessions on an account work but rotation fails with one of these errors, the account’s username probably doesn’t match the case that Oracle stored:
  • ORA-01031: insufficient privileges, if the account rotates its own password
  • ORA-01918: user does not exist, if a different account rotates the password
The rotation statement matches the username exactly. Change the account’s username to the case that Oracle stored, which is uppercase unless the user was created with a quoted name. If a different rotation account returns ORA-01031 and the username is correct, grant the rotation account the ALTER USER privilege.