Oracle credential rotation

​

How the password is changed

ALTER USER "<target_username>" IDENTIFIED BY "<generated_password>";

ALTER USER "<target_username>" IDENTIFIED BY "<generated_password>" REPLACE "<current_password>";

• Self-rotation returns ORA-01031: insufficient privileges, because changing a user other than the one signed in needs the ALTER USER privilege, and the name that doesn’t exist counts as another user.
• Delegated rotation returns ORA-01918: user does not exist, because the rotation account holds ALTER USER and gets past the privilege check.

​

Rotation account requirements

• Self-rotation: an Oracle user can change its own password, so no extra privileges are needed beyond CREATE SESSION.
• Delegated rotation: the rotation account needs the ALTER USER system privilege to change another user’s password. Without it Oracle returns ORA-01031: insufficient privileges.

-- the user Infisical connects as to perform rotations
CREATE USER infisical_rotator IDENTIFIED BY "temporary_password";
GRANT CREATE SESSION TO infisical_rotator;
GRANT ALTER USER TO infisical_rotator;

-- the account whose password gets rotated
CREATE USER app_user IDENTIFIED BY "temporary_password";
GRANT CREATE SESSION TO app_user;

​

Password length