ORA-20002: YOU ARE NOT ALLOWED TO CHANGE THE PASSWORD FOR CRITICAL SCHEMAS

I'm trying to change the password for Oracle DB user but I'm getting below error:

ORA-28003: password verification for the specified password ORA-20002: YOU ARE NOT ALLOWED TO CHANGE THE PASSWORD FOR CRITICAL SCHEMAS 

I've tried to change the password using sys user and got same error. DB version: 12.2.0.1.0 Client: SQLPlus

Please help

1 Answer

The exception is being raised by a password verification function, assigned to the user via a profile.

You can see the profile name and the function being applied by querying:

select du.profile, dp.limit from dba_users du join dba_profiles dp on dp.profile = du.profile where du.username = '<YOUR_USER>' and dp.resource_name = 'PASSWORD_VERIFY_FUNCTION'; 

You can then see what the function is actually doing by looking at its source, using the name identified in the previous query:

select text from dba_source where owner = 'SYS' and name = '<FUNCTION_NAME>' order by line; 

From there you can see when and why it's happening, by looking for a line like:

raise_application_error(-20002, 'YOU ARE NOT ALLOWED TO CHANGE THE PASSWORD FOR CRITICAL SCHEMAS'); 

and seeing what logic leads to it being raised.

You'll need to decide whether that rule is (still) appropriate for that user - clearly it's there for a reason so don't remove it or change the user's profile without really understanding it, and discussing with the DBA and/or application owner etc. - basically anyone with an interest in that user account.