Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Application Server Security >> Oracle financials passwords storage
        
(Message started by: Pete Finnigan on Aug 2^nd, 2006, 10:34am)

Title: Oracle financials passwords storage
Post by Pete Finnigan on Aug 2^nd, 2006, 10:34am

Hi People,
This is a very informative forum and keep it up.
Where does Oracle financials 11 store the application usernames and passwords? In which table are they stored, and are they encrypted?

Rgds

Title: Re: Oracle financials passwords storage
Post by Pete Finnigan on Aug 6^th, 2006, 5:02pm

Hi,

Start with FND_USERS. They are encrypted. Have a look at the FNDPASS utility that can be used to set application and schema passwords.

hth

cheers

Pete

Title: Re: Oracle financials passwords storage
Post by Pete Finnigan on Aug 7^th, 2006, 7:19am

Thanks pete. That helped alot. Are the passwords encrypted the same way as oracle database passwords? I need to test if users are using strong passwords and which password craking tools i can try. Can Orabf be used for this or which tools are available to test this?

Thanks

Title: Re: Oracle financials passwords storage
Post by Pete Finnigan on Aug 7^th, 2006, 12:03pm

Hi,

No its a different algorithm. I know how it works but I am not certain its in the public domain so I will not edscribe it here. Maybe someone else knows if there are any free password cracking tools available. It is possible to use SQL to check passwords. You can use the following SQL:

Code:

select fnd_web_sec.validate_login('PETE','PASSWD') from sys.dual;

cheers

Pete