Changing a Password – Dual Control

Two users are required to manage the password of another user.

Prerequisites

Requires the CHANGE PASSWORD system privilege.
The managing user has been granted the right to change the password of the target user.
The CHANGE_PASSWORD_DUAL_CONTROL option is enabled in the login policy of the managing user.

Task

At a command prompt, the first managing user types:

ALTER USER userID
IDENTIFIED FIRST BY password_part1

At a command prompt, the second managing user types:

ALTER USER userID
IDENTIFIED LAST BY password_part1

Example

Assuming login policy Sales1 has the CHANGE_PASSWORD_DUAL_CONTROL option enabled, User3 is assigned Sales1, and User1 and User2 have been granted the necessary privileges to change the password of User3, these statements set the two password parts for User3 to NewPassPart1 and NewPassPart2:

User1 types:

ALTER USER user3 IDENTIFIED FIRST BY NewPassPart1

User2 types:

ALTER USER user3 IDENTIFIED LAST BY NewPassPart2