Error
Error Code: ORA-28206

Oracle ORA-28206: Short Password

📦 Oracle Database
📋

Description

The ORA-28206 error occurs in Oracle Database when a user attempts to set or change their password to one that is shorter than the minimum length required by the database's security policy. This typically happens during user creation or password modification attempts.
💬

Error Message

ORA-28206: password length less than number characters
🔍

Known Causes

3 known causes
⚠️
Insufficient Length
The password provided does not meet the minimum character length requirement enforced by the database profile. 🔒
⚠️
Profile Configuration
The `PASSWORD_LIFE_TIME` profile parameter is set to a value that requires frequent password changes, leading to users choosing weak passwords. ⚙
⚠️
Missing Password Policy
A password policy is not configured, and the default minimum length is insufficient for security requirements. 💻
🛠️

Solutions

3 solutions available

1. Change Password to Meet Requirements easy

The quickest way to resolve this is to set a new password that adheres to the minimum length policy.

1
Connect to your Oracle database as a user with the privilege to alter user passwords (e.g., SYSTEM, SYS, or the user itself if allowed).
sqlplus username/password@connect_string
2
Execute the ALTER USER command, providing a new password that meets the minimum length requirement.
ALTER USER username IDENTIFIED BY NewStrongPassword123;
3
Verify the password change by attempting to log in with the new password. If you are changing your own password, you may need to reconnect.
sqlplus username/NewStrongPassword123@connect_string

2. Temporarily Lower Password Complexity Requirements medium

If the password policy is too strict for the current user's needs, you can temporarily relax it. This should be done with caution and a plan to re-enable strict policies.

1
Connect to the database as a user with DBA privileges (e.g., SYS or SYSTEM).
sqlplus sys as sysdba
2
Query the current password complexity profile to understand the minimum password length.
SELECT profile, resource_name, limit FROM dba_profiles WHERE profile = 'DEFAULT' AND resource_name = 'PASSWORD_LENGTH';
3
Alter the profile to reduce the minimum password length. Replace 'DEFAULT' with the specific profile if a different one is assigned to the user.
ALTER PROFILE DEFAULT LIMIT PASSWORD_LENGTH = 8; -- Set to your desired minimum length (e.g., 8)
4
Now, the user can change their password to one that meets the new, lower length requirement.
ALTER USER username IDENTIFIED BY NewShortPassword;
5
Important: Re-enable stricter password policies when possible. You can revert the change or set a higher limit.
ALTER PROFILE DEFAULT LIMIT PASSWORD_LENGTH = 12; -- Revert to a higher, more secure length

3. Review and Enforce Password Policies medium

Understand the current password policies and ensure users are aware of them. This is a proactive approach to prevent future ORA-28206 errors.

1
Connect to the database as a user with DBA privileges (e.g., SYS or SYSTEM).
sqlplus sys as sysdba
2
Identify all active profiles and their password-related settings.
SELECT profile, resource_name, limit FROM dba_profiles WHERE resource_name LIKE 'PASSWORD_%';
3
For each user, determine which profile they are assigned to.
SELECT username, profile FROM dba_users WHERE username = 'TARGET_USERNAME';
4
Communicate the password requirements (minimum length, complexity, expiration) to your users through documentation or training.
text
5
Consider using Oracle's Unified Auditing or standard auditing to track password change attempts and identify users who consistently violate policies.
text