自定義密碼驗證函式

在Oracle中可以很方便的自定義密碼驗證函式，用來檢驗使用者的新密碼是否符合安全標準。

 

 

下面是一個最簡單的自定義驗證函式的例子：

SQL> CONN / AS SYSDBA
已連線。
SQL> CREATE OR REPLACE FUNCTION F_MY_VERIFY
  2     (P_USERNAME IN VARCHAR2, P_PASSWORD IN VARCHAR2, P_OLD_PASSWORD IN VARCHAR2)
  3  RETURN BOOLEAN AS
  4  BEGIN
  5     IF P_PASSWORD = P_OLD_PASSWORD THEN
  6             RAISE_APPLICATION_ERROR(-20001, 'NEW PASSWORD SAME AS OLD PASSWORD.');
  7     END IF;
  8    
  9     IF P_PASSWORD = P_USERNAME THEN
 10             RAISE_APPLICATION_ERROR(-20002, 'PASSWORD SAME AS USERNAME.');
 11     END IF;
 12    
 13     IF INSTR(P_PASSWORD, P_OLD_PASSWORD, 1) > 0 OR INSTR(P_OLD_PASSWORD, P_PASSWORD, 1) > 0 THEN
 14             RAISE_APPLICATION_ERROR(-20003, 'NEW PASSWORD AND OLD PASSWORD ARE LIKE EACH OTHER.');
 15     END IF;
 16    
 17     IF INSTR(P_PASSWORD, P_USERNAME, 1) > 0 OR INSTR(P_USERNAME, P_PASSWORD, 1) > 0 THEN
 18             RAISE_APPLICATION_ERROR(-20004, 'PASSWORD AND USERNAME ARE LIKE EACH OTHER.');
 19     END IF;
 20    
 21     IF LENGTH(P_PASSWORD) < 6 THEN
 22             RAISE_APPLICATION_ERROR(-20005, 'PASSWORD TOO SHORT.');
 23     END IF;
 24    
 25     RETURN TRUE;
 26  END;
 27  /

函式已建立。

將當前的驗證函式設定為DEFAULT策略的驗證函式：

SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_VERIFY_FUNCTION F_MY_VERIFY;

配置檔案已更改

最後檢驗一下驗證函式是否正常工作：

SQL> CONN U1/P_U1
已連線。
SQL> ALTER USER U1 IDENTIFIED BY P_U1 REPLACE P_U1;
ALTER USER U1 IDENTIFIED BY P_U1 REPLACE P_U1
*
第 1 行出現錯誤:
ORA-28007: 無法重新使用口令

SQL> ALTER USER U1 IDENTIFIED BY U1 REPLACE P_U1;
ALTER USER U1 IDENTIFIED BY U1 REPLACE P_U1
*
第 1 行出現錯誤:
ORA-28003: 指定口令的口令驗證失敗
ORA-20002: PASSWORD SAME AS USERNAME.

SQL> ALTER USER U1 IDENTIFIED BY P_U123 REPLACE P_U1;
ALTER USER U1 IDENTIFIED BY P_U123 REPLACE P_U1
*
第 1 行出現錯誤:
ORA-28003: 指定口令的口令驗證失敗
ORA-20003: NEW PASSWORD AND OLD PASSWORD ARE LIKE EACH OTHER.

SQL> ALTER USER U1 IDENTIFIED BY PASS_U1 REPLACE P_U1;
ALTER USER U1 IDENTIFIED BY PASS_U1 REPLACE P_U1
*
第 1 行出現錯誤:
ORA-28003: 指定口令的口令驗證失敗
ORA-20004: PASSWORD AND USERNAME ARE LIKE EACH OTHER.

SQL> ALTER USER U1 IDENTIFIED BY 12345 REPLACE P_U1;
ALTER USER U1 IDENTIFIED BY 12345 REPLACE P_U1
                            *
第 1 行出現錯誤:
ORA-00988: 口令缺失或無效

SQL> ALTER USER U1 IDENTIFIED BY "12345" REPLACE P_U1;
ALTER USER U1 IDENTIFIED BY "12345" REPLACE P_U1
*
第 1 行出現錯誤:
ORA-28003: 指定口令的口令驗證失敗
ORA-20005: PASSWORD TOO SHORT.

SQL> ALTER USER U1 IDENTIFIED BY NEW_COMPLICATE_PASSWORD REPLACE P_U1;

使用者已更改。