FNDCPASS doesn’t always use the SYSTEM password

FNDCPASS does not check the system password when used to change an application’s user account. We can check this with a simple test.

First, we’ll change the SYSTEM password to the default value “manager”:

[applmgr@appsrv01 ~]$ sqlplus system

SQL> exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.3.0 - Production
With the Partitioning, OLAP and Data Mining Scoring Engine options
[applmgr@appsrv01 ~]$

Next, we’ll use FNDCPASS to change the SYSADMIN application password using an incorrect value for the SYSTEM password:

[applmgr@appsrv01 ~]$ FNDCPASS apps/apps 0 Y system/badpassword USER SYSADMIN sysadmin
Log filename : L4203491.log

Report filename : O4203491.out

If we cat the log file, we can see the password change was successful:

[applmgr@appsrv01 ~]$ cat L4203491.log
+---------------------------------------------------------------------------+
Application Object Library: Version : 11.5.0

+---------------------------------------------------------------------------+

Next, we’ll try to change the GL schema password using the same incorrect SYSTEM password:

[applmgr@appsrv01 ~]$ FNDCPASS apps/apps 0 Y system/badpassword ORACLE GL gl

Report filename : O4203493.out

This time, the log shows failure because of an inability to connect as SYSTEM:

[applmgr@appsrv01 ~]$ cat L4203493.log
+---------------------------------------------------------------------------+
Application Object Library: Version : 11.5.0

+---------------------------------------------------------------------------+

It appears that FNDCPASS only uses the SYSTEM password when changing a database account, which makes sense, since only the APPS password is required to execute FND_WEB_SEC and change a password in FND_USER.