| FNDCPASS Troubleshooting Guide For Login and Changing Applications Passwords [ID 1306938.1] | |||||
| Modified 07-OCT-2011 Type HOWTO Status PUBLISHED | |||||
In this Document
Goal
Solution
1. Error Starting Application Services After Changing APPS Password Using FNDCPASS
2. Log In Fails With: You Don't Have Permission To Access /pls/.../fnd_icx_launch.launch On This Server
3. APP-FND-01564: ORACLE Error 6550 In changepassword With Portal/Login Server/SSO After Patch
4. FNDCPASS Not Able To Decrypt Password For APPLSYSPUB When Changing The APPS Password
5. Changing APPS Password Using FNDCPASS Gives 'not able to decrypt password' Message
6. FNDCPASS Fails Changing Database Password: APP-FND-02704, APP-FND-01564, ORA-01403
7. FNDCPASS Fails With 'ORA-01017: invalid username/password; logon denied
8. adpatch Errors: The Given ORACLE Password Is Not The Correct Password.
9. APP-FND-01496 Received When Changing The APPLSYS Password With FNDCPASS
10. Using FNDCPASS With The ALLORACLE Option, Why Doesn't It Change All User Passwords?
11. Fndcpass Fails with 500 Internal Server Error After Migrating Database From Hp-Ux To Linux
12. FNDCPASS Fails with APP-FND-02702 and APP-FND-02704
13. APP-FND-00434 Unable to Change Password Using FNDCPASS Utility
14. FNDCPASS Gives: APP-FND-01502: Cannot Encrypt Application ORACLE Password
15. Why FNDCPASS Fails With ORA-01005 Using Underscore or Dollar Sign in Passwords?
16. FNDCPASS-CANNOT DECRYPT For Some Users
17. Db Links Are Invalid After Changing The Apps User Password With FNDCPASS
18. Is PASSWORD_VERIFY_FUNCTION Compatible with FNDCPASS in E-Business Suite?
19. ORA-29541 Unable to Change Password Using FNDCPASS Utility
20. FNDCPASS Updates FND_USER.LAST_LOGON_DATE with SYSDATE
21. Why aren't users forced to change/reset passwords during next login after running FNDCPASS?
22. FNDCPASS Was Not Able to Decrypt Password for User 'ABC' During APPLSYS Password Change
23. FNDCPASS was not able to decrypt password for {User Name} during APPLSYS password change
24. APP-FND-01496 Results From FNDCPASS Chaning The APPLSYS password
25. APP-FND-1238: Cannot set value for field :USER.ENCRYPTED_USER_PASSWORD
26. FRM-40200 Changing Users Password With The System Administrator Responsibility
27. "Signon Password Failure Limit" Is Reached Unlocking Queries
28. APP-FND-02704, APP-FND-01564, ORA-01403 changepassword Errors In Custom Schema
29. FND Invalid Hash mode detected for user_id = &USERID When Changing Password
Diagnostics & Utilities Community:
References
Applies to:
Oracle Application Object Library - Version: 11.5.9 to 12.1.3 - Release: 11.5 to 12.1Information in this document applies to any platform.
Goal
This is a consolidation of Top Documents to provide a Single Source for troubleshooting common problems with FNDCPASS.
Solution
1. Error Starting Application Services After Changing APPS Password Using FNDCPASS
Error:
Cannot complete applications logon. You may have entered an invalid applications password, or there may have been a database connect error.
Cannot complete applications logon. You may have entered an invalid applications password, or there may have been a database connect error.
From the error, it's confirmed that the APPS password did not change correctly. Sometimes when changing the APPS password using FNDCPASS with a new APPS password, if able to log into SQLPLUS as the apps user, then it's thought that the password has changed correctly In every scenario, this is not true. If able to connect th SQLPLUS with the new APPS password, then it doesn't verify new APPS password completely. It is just one test for new APPS passwords. If able to start application services successfully, then one can confirm that the APPS password has changed successfully.
Points to keep in mind when changing the APPS password using the FNDCPASS utility:
Point 1: Changing APPS password using an "alter user" command is not supported and should not be used for changing the apps password in any case.
Point 2: Always use FNDCPASS to change the APPS password. For an improved solution to FNDCPASS as of R12.1.2, clickhere.
Point 3: Before changing APPS password, it is strongly recommended to take a backup of FND_USER and FND_ORACLE_USERID.
Point 4: Always check FNDCPASS log for any kind of error. If there is any error in the FNDCPASS log, then DO NOT run autoconfig or try to change configuration file manually. Until and unless FNDCPASS log has no error please do not run autoconfig as you will get problem while logging in oracle application.
Point 5: If getting any error in the FNDCPASS log, then either replace from an original backup with FND_USER and FND_ORACLE_USERID to log into Applications or raise an SR to support with the FNDCPASS log.
Point 2: Always use FNDCPASS to change the APPS password. For an improved solution to FNDCPASS as of R12.1.2, clickhere.
Point 3: Before changing APPS password, it is strongly recommended to take a backup of FND_USER and FND_ORACLE_USERID.
Point 4: Always check FNDCPASS log for any kind of error. If there is any error in the FNDCPASS log, then DO NOT run autoconfig or try to change configuration file manually. Until and unless FNDCPASS log has no error please do not run autoconfig as you will get problem while logging in oracle application.
Point 5: If getting any error in the FNDCPASS log, then either replace from an original backup with FND_USER and FND_ORACLE_USERID to log into Applications or raise an SR to support with the FNDCPASS log.
1. If autoconfig was not run, did not make any change in configuration file manually and also have a valid backup of FND_USER and FND_ORACLE_USERID table, then recover from the original backup. Start application services.
If a valid backup of the FND_USER and FND_ORACLE_USERID table does not exist, then an export/import of table FND_USER and FND_ORACLE_USERID from a Instance that has the same patchset level must be used because autoconfig was not run. If the patchset level is not same, then the export/import of the tables will not work. For example: If facing the issue on a newly cloned instance, then export/import the source instance from which the clone instance was made.
2. If a valid backup of FND_USER and FND_ORACLE_USERID table exists, but have already run autoconfig then the application services cannot be started. Once autoconfig is run, then replacing the original backup of FND_USER and FND_ORACLE_USERID table will not work.
In this case, a backup of the FND_USER and FND_ORACLE_USERID table is not valid because autoconfig was already run and hence only two options left:
A. Follow the procedure mentioned in the below note to remove database credentials:
Note 419475.1: Removing Credentials from a Cloned EBS Production Database
B. Do a fresh clone. (In case the issue exists in a test instance.)
4. One should able to start application services without any error. If able to start the application services without any error, but still are not able to log in, then check a direct forms log in:
For Release 11i : http://
For Release 12: http://
For direct forms logging, below parameter in CONTEXT file should be set to OFF. If it is not set to OFF then make below changes and run autoconfig.
5. Once able to log in in forms mentioned in step 4, but still personal home page log in is not working, then it's confirmed that the issue is now with personel home page log in only and no issue with the APPS password.
Run AOL/J Test. Use below URL to run AOL/J Test:
http://
2. Log In Fails With: You Don't Have Permission To Access /pls/.../fnd_icx_launch.launch On This Server
The apps account is locked from repeatedly running FNDCPASS or logging into sqlplus as apps using the wrong password.
To implement the solution, execute the following steps:
1. Log-in as system owner and run:
SQL> alter profile DEFAULT limit failed_login_attempts unlimited;
SQL> alter user apps account unlock;The first line (optional) results in preventing repeated failed log in attempts from locking the account.
The second line (required) simply unlocks the apps account.
2. Restart the services.
3. APP-FND-01564: ORACLE Error 6550 In changepassword With Portal/Login Server/SSO After Patch
APP-FND-01564: ORACLE error 6550 in changepassword
Cause: changepassword failed due to ORA-06550: line 1, column 7:
PLS-00201: identifier 'FND_SSO_REGISTRATION.IS_OPERATION_ALLOWED' must be declared
ORA-06550: line 1, column 7:
PL/SQL: Statement ignored
ORA-06512: at "APPS.FND_LDAP_WRAPPER", line 1190To implement the solution, execute the following step:
1. For instances integrated with Portal 3.0.9 from ATG_PF.H.RUP3 and above the profile option Applications SSO LDAP Synchronization (APPS_SSO_LDAP_SYNC) needs to be set to "Disabled".
4. FNDCPASS Not Able To Decrypt Password For APPLSYSPUB When Changing The APPS Password
The APPS password appears to have been successfully updated and Autoconfig runs without issue.
However, Discoverer users have authentication problems.
The issue is caused by a data corruption issue in the fnd_user table.
However, Discoverer users have authentication problems.
The issue is caused by a data corruption issue in the fnd_user table.
To implement the solution, execute the following steps:
1. Use FNDCPASS to reset the APPLSYSPUB password.
e.g. FNDCPASS apps/
2. Retest for the issue.
5. Changing APPS Password Using FNDCPASS Gives 'not able to decrypt password' Message
Found in log:
FNDCPASS was not able to decrypt password for
FNDCPASS was not able to decrypt password for
The profile option "Applications SSO Login Types" is set to 'SSO'.
Because the profile "Applications SSO Login Types" is set to 'SSO', the password is maintained by Oracle Internet Directory - OID and not Applications, FNDCPASS cannot update the OID data directly.
The FND_USER table record has the value 'EXTERNAL' in the encrypted password columns.
This can be confirmed using the following SQL:
select user_id, encrypted_foundation_password, encrypted_user_password
from fnd_user
where user_name = '{User Name from FNDCPASS log}' ;
Because the profile "Applications SSO Login Types" is set to 'SSO', the password is maintained by Oracle Internet Directory - OID and not Applications, FNDCPASS cannot update the OID data directly.
The FND_USER table record has the value 'EXTERNAL' in the encrypted password columns.
This can be confirmed using the following SQL:
select user_id, encrypted_foundation_password, encrypted_user_password
from fnd_user
where user_name = '{User Name from FNDCPASS log}' ;
To implement the solution, execute the following steps:
1. Set the profile "Applications SSO Login Types" to 'Both' or 'Local'.
Then change the identified User password using the Security / User / Define form..
2. Ignore the message and remember that the password is managed externally..
Note:
As long as the table value is 'EXTERNAL', the FNDCPASS utility will display the messages in the log.
6. FNDCPASS Fails Changing Database Password: APP-FND-02704, APP-FND-01564, ORA-01403
FNDCPASS apps/***** 0 Y system/**** ORACLE HR HR
APP-FND-02704: Unable to alter user HR to change password.
APP-FND-01564: ORACLE error 1403 in changepassword
Cause: changepassword failed due to ORA-01403: no data found.
The SQL statement being executed at the time of the error was: and was executed from the file &ERRFILE.The database profile DEFAULT was changed for the resource PASSWORD_REUSE_MAX.
To implement the solution, execute the following steps:
1. Revert back the resource of the database profile DEFAULT as:
FAILED_LOGIN_ATTEMPTS to UNLIMITED
PASSWORD_REUSE_MAX to UNLIMITED
PASSWORD_LOCK_TIME to UNLIMITED
PASSWORD_GRACE_TIME to UNLIMITED
PASSWORD_VERIFY_FUNCTION to NULL
2. Re-run FNDCPASS.
7. FNDCPASS Fails With 'ORA-01017: invalid username/password; logon denied
Upgraded to Applications release 12.0 and database from 10.2.0.2 to 11.1.0.6
The database SEC_CASE_SENSITIVE_LOGON parameter defaults to TRUE. When this occurs the password sensitivity conversion does not occur. Passwords that are input as lower case are automatically updated as upper case.
The database SEC_CASE_SENSITIVE_LOGON parameter defaults to TRUE. When this occurs the password sensitivity conversion does not occur. Passwords that are input as lower case are automatically updated as upper case.
To implement the solution, execute the following steps:
1. For Applications 11i with database 11g, Patch 6372396 is needed which is included in 11i.ATG_PF.H.RUP.7 (Patch 6241631).
WORKAROUND
1. Set the database SEC_CASE_SENSITIVE_LOGON parameter to FALSE in the init.ora.
2. Run autoconfig on the application tiers and bounce the database.
8. adpatch Errors: The Given ORACLE Password Is Not The Correct Password.
FNDCPASS fails with:
Working...
APP-FND-01496: Cannot access application ORACLE password
Cause: Application Object Library was unable access your ORACLE password.
Action: Contact your support representative. (USER=TWOODS)
APP-FND-01496: Cannot access application ORACLE password
Issue caused by user password corruption, which resulted in failure when running FNDCPASS in an attempt to re-encrypt the APPLSYS password.
Working...
APP-FND-01496: Cannot access application ORACLE password
Cause: Application Object Library was unable access your ORACLE password.
Action: Contact your support representative. (USER=TWOODS)
APP-FND-01496: Cannot access application ORACLE password
Issue caused by user password corruption, which resulted in failure when running FNDCPASS in an attempt to re-encrypt the APPLSYS password.
To implement the solution, execute the following steps:
1. Use FNDCPASS to update each failing User password individually.
FNDCPASS apps/
Ex: FNDCPASS apps/
2. Rerun FNDCPASS again to successfully alter the APPLSYS password:
FNDCPASS apps/
Ex: $FNDCPASS apps/
NOTE: Changing the APPLSYS password automatically changes the APPS password to match as these two must always agree.
9. APP-FND-01496 Received When Changing The APPLSYS Password With FNDCPASS
APP-FND-01496: Cannot access application ORACLE password
Cause: Application Object Library was unable access your ORACLE password.
The ALTER command was run manually against the APPS user before running FNDCPASS. The APPS and APPLSYS user passwords must be identical.
Cause: Application Object Library was unable access your ORACLE password.
The ALTER command was run manually against the APPS user before running FNDCPASS. The APPS and APPLSYS user passwords must be identical.
To implement the solution, execute the following steps:
1. Run the ALTER command against the APPS and APPLSYS users in sqlplus to change back to the old passwords:
sql>ALTER USER APPLSYS IDENTIFIED BY XXX;
sql>ALTER USER APPS IDENTIFIED BY XXX;
2. Afterwards run FNDCPASS:
FNDCPASS apps/
Ex: $FNDCPASS apps/
Note: Changing the APPLSYS password automatically changes the APPS password to match as these two must always agree.
10. Using FNDCPASS With The ALLORACLE Option, Why Doesn't It Change All User Passwords?
To implement the solution, reference the following:Usernames must appear in the FND_USER or FND_ORACLE_USERID tables. The FNDCPASS utility and ALLORACLE functionality was designed for applications users/schemas.
The following username passwords must be manually changed:
Account Name
--------------------------------
ABM
AHM
AMF
CSS
CUE
CUN
DBSNMP
EAA
EVM
FPT
IBA
IMT
IPD
JUNK_PS
MDSYS
ME
ODM
ODM_MTR
OKB
OKO
OKR
OLAPSYS
ORDPLUGINS
ORDSYS
OUTLN
OWAPUB
OZP
OZS
RHX
RLA
SCOTT
SSOSDK
SYS
VEH
XNC
XNI
XNM
XNS
11. Fndcpass Fails with 500 Internal Server Error After Migrating Database From Hp-Ux To Linux
When attempting to log in to a R12 instance, after migrating the database from HP to Linux following the steps in Note 454616.1, the following error occurs.
500 Internal Server Error
oracle.apps.fnd.cache.CacheException
at oracle.apps.fnd.cache.AppsCache.get(AppsCache.java:228)......
The issue can be reproduced at will by attempting to log in.
Password Hash Migration (FNDCPASS USERMIGRATE) done prior to the data migration.
The cause of this issue is that the FND_USER_PREFERENCES table did not get exported properly due to password hash migration not being covered or accounted for in the existing procedure.
500 Internal Server Error
oracle.apps.fnd.cache.CacheException
at oracle.apps.fnd.cache.AppsCache.get(AppsCache.java:228)......
The issue can be reproduced at will by attempting to log in.
Password Hash Migration (FNDCPASS USERMIGRATE) done prior to the data migration.
The cause of this issue is that the FND_USER_PREFERENCES table did not get exported properly due to password hash migration not being covered or accounted for in the existing procedure.
To implement the solution, reference the following:
1. Export of the fnd_user_preferences table separately using:
$ exp system/
2. Import the Applications database target
3. Import of the fnd_user_preferences table separately
$ imp system/
LOG=imp_fnd_user_preferences.log TABLES=FND_USER_PREFERENCES FROMUSER=APPLSYS IGNORE=Y
4. Reset Advanced Queues ( Note 362205.1 - Section 5)
5. Run adgrants (Note 362203.1 - After the Database Upgrade)
6. Run adctxprv.sql (Note 362203.1 - After the Database Upgrade)
7. Compile Invalid Objects running adadmin
8. Implement and run Autoconfig ( Note 362203.1)
9. Gather Statistics for SYS schema (Note 362203.1 - After the Database Upgrade)
10. Create ConText and Spatial Objects (Note 362205.1 - Section 5)
11. Compile Invalid Objects (Note 362205.1 - Section 5)
12. Maintain Applications database objects (Note 362205.1 - Section 5)
13. Restart Applications Server Processes (Note 362205.1 - Section 5)
12. FNDCPASS Fails with APP-FND-02702 and APP-FND-02704
Followed Note.456838.1 and found a number of accounts that are database users with passwords equal to database users, but those do not seem to be registered as Oracle Schemas/Users.
FNDCPASS ends with the following error:
APP-FND-02702: ABM is not a valid oracle user
The list includes: ABM, AMF, CSS, CUE, CUN, EAA, EVM, FPT, IBA, IMT, IPD, ME, OKB, OKO, OKR, OZP, OZS, RHX, RLA, VEH, XNC, XNI, XNM, XNS.
Also tried to change password for EDWREP user which is not a Database user but is defined as Oracle Schema/User and FNDCPASS errored with:
APP-FND-02704: Unable to alter user EDWREP to change password
FNDCPASS ends with the following error:
APP-FND-02702: ABM is not a valid oracle user
The list includes: ABM, AMF, CSS, CUE, CUN, EAA, EVM, FPT, IBA, IMT, IPD, ME, OKB, OKO, OKR, OZP, OZS, RHX, RLA, VEH, XNC, XNI, XNM, XNS.
Also tried to change password for EDWREP user which is not a Database user but is defined as Oracle Schema/User and FNDCPASS errored with:
APP-FND-02704: Unable to alter user EDWREP to change password
To implement the solution, reference the following:
1. EDWREP is not in the table DBA_USERS nor in FND_USER, so there is no password to change for this user as there is no possible connection to this user. This is explained in Orion Note 431272.1. EDWREP can be ignored as it is not an Oracle user nor an APPS user ( FND_USER ).
2. The list of others users provided ( ABM, ... ) is not in the table fnd_oracle_userid , so it cannot be changed with FNDCPASS, that's the normal behavior.
Note 461904.1 explains that ABM is now obsoleted.
Some Applications/Products are obsoleted in release 12:
cun, amf, jts, xni, oko, okb, ahm, imt, veh, rla, rhx, ozs, ozp, iba, cue, okr, fpt, xns, xnc, xnm, css, me, zfa, zsa, rcm, ipd, evm, abm, eaa
As obsoleted, using the alter command can be used to safely change the password of the above users.
13. APP-FND-00434 Unable to Change Password Using FNDCPASS Utility
When attempting to change the password of any application/database user using FNDCPASS, the following error occurs:
Error:
APP-FND-00434: AFPRCP:Failed to initialize profile option values : FDWHOAMI environment variable contains invalid value 5 for user ID
Step to Reproduce:
Change password of application user "VISION" using below FNDCPASS command:
FNDCPASS apps/apps 0 Y system/manager USER VISION WELCOME
Seeded application user "APPSMGR" is not present in FND_USER table. USER_ID of application user "APPSMGR" is 5. That is why when you are trying to change the password of any application/database user using FNDCPASS utility then it errors out with invalid value 5 for user ID (see the error).
Error:
APP-FND-00434: AFPRCP:Failed to initialize profile option values : FDWHOAMI environment variable contains invalid value 5 for user ID
Step to Reproduce:
Change password of application user "VISION" using below FNDCPASS command:
FNDCPASS apps/apps 0 Y system/manager USER VISION WELCOME
Seeded application user "APPSMGR" is not present in FND_USER table. USER_ID of application user "APPSMGR" is 5. That is why when you are trying to change the password of any application/database user using FNDCPASS utility then it errors out with invalid value 5 for user ID (see the error).
To implement the solution, please execute the following steps:
1. If a backup of the FND_USER table exists, then restore the record for USER_ID=5 from the backup table to the existing FND_USER table.
Connect to SQLPLUS as APPS user:
SQL> insert into FND_USER select * from FND_USER_BAK where USER_ID=5 ;
Where FND_USER_BAK is backup table of FND_USER table.
If a backup of the FND_USER table does not exist, then thedata for the 'APPSMGR' user must be inserted using the below SQL:
Connect to SQLPLUS as APPS user :
SQL> INSERT INTO FND_USER(
USER_ID,
USER_NAME,
LAST_UPDATE_DATE,
LAST_UPDATED_BY,
CREATION_DATE,
CREATED_BY,
LAST_UPDATE_LOGIN,
ENCRYPTED_FOUNDATION_PASSWORD,
ENCRYPTED_USER_PASSWORD,
SESSION_NUMBER,
START_DATE,
END_DATE,
DESCRIPTION)
VALUES(5,'APPSMGR',TO_DATE('10/27/2004 6:00:51 PM','MM/DD/YYYY HH:MI:SS PM') ,0,TO_DATE('05/21/1987 6:00:51 PM','MM/DD/YYYY HH:MI:SS PM'),1,0,'INVALID','INVALID',0,TO_DATE('01/01/1951 6:00:51 PM','MM/DD/YYYY HH:MI:SS PM'),NULL,'User for routine maintenance activities scheduled as concurrent requests. Should be used for pre scheduled requests and for requests submitted at the time of patching applications.')
SQL> Commit;
2. Retest the issue.
3. Migrate the solution as appropriate to other environments.
DO NOT delete any seeded data from any of seeded table. For example: 'APPSMGR' is a seeded application user and should not delete this record from the FND_USER table. Deletion of seeded records from any seeded table is not supported.
14. FNDCPASS Gives: APP-FND-01502: Cannot Encrypt Application ORACLE Password
APP-FND-01502: Cannot encrypt application ORACLE password
Application Object Library was unable encrypt your ORACLE password.
Action: Contact your support representative. (ORACLEUSER=APPS_SERV)
The table fnd_oracle_userid contain rows for schemas that does not exist. Those rows must be deleted
from the table.
Application Object Library was unable encrypt your ORACLE password.
Action: Contact your support representative. (ORACLEUSER=APPS_SERV)
The table fnd_oracle_userid contain rows for schemas that does not exist. Those rows must be deleted
from the table.
To implement the solution, please execute the following steps:
1. Execute the following select statement:
select * from fnd_oracle_userid
where oracle_username not in
(select username from all_users);If this returns any rows, then delete them.
15. Why FNDCPASS Fails With ORA-01005 Using Underscore or Dollar Sign in Passwords?
To implement the solution, please execute the following steps:
Using the Underscore ( _ ) or Dollar Sign ( $ ) as well as Parentheses ( ) and Comma ( , ) will cause the following error to be generated:
Routine AFPCSQ encountered an ORACLE error. ORA-01005: null password given; logon denied
Review your error messages for the cause of the error. (=
Only alphanumeric characters should be for passwords. Bug 5239293 - UNABLE USE THE PUNCTUATION MARK IN FNDCPASS UTILITY has been logged to address using special characters such as the _, #, and $.
16. FNDCPASS-CANNOT DECRYPT For Some Users
Getting error messages like:
FNDCPASS-CANNOT DECRYPT (USER=CONCURRENT MANAGER)
FNDCPASS-CANNOT DECRYPT (USER=ANONYMOUS)
FNDCPASS-CANNOT DECRYPT (USER=APPLSYSPUB)
Patch (5846796) was created to fix the fnd_web_sec.validate_password to use the SIGNON_PASSWORD_CASE profile setting for establishing new password criteria.
According to Development Patch 5846796 will not be available standalone.
FNDCPASS-CANNOT DECRYPT (USER=CONCURRENT MANAGER)
FNDCPASS-CANNOT DECRYPT (USER=ANONYMOUS)
FNDCPASS-CANNOT DECRYPT (USER=APPLSYSPUB)
Patch (5846796) was created to fix the fnd_web_sec.validate_password to use the SIGNON_PASSWORD_CASE profile setting for establishing new password criteria.
According to Development Patch 5846796 will not be available standalone.
To implement the solution, please execute the following steps:
1. Customers should apply 11i.ATG_PF.H.delta.6 (RUP 6) Patch 5903765 for this issue.
Workaround
The error messages should disappear setting the System Profile 'Password Case Option' to 'Insensitive'.
17. Db Links Are Invalid After Changing The Apps User Password With FNDCPASS
To implement the solution, please execute the following steps:
1. Since changing the apps password all the db links should have the new APPS password. Run
AutoConfig after changing the APPS password and this will update all. Please note that there is no need to run autoconfig each time FNDCPASS is run, only if changing any of the following users:
- APPLSYS
- APPS
- APPS_MRC
- APPLSYSPUB
- PORTAL30 & PORTAL30_SSO (For Oracle Log in Server and Portal 3.0.9 with E-Business Suite 11i)
18. Is PASSWORD_VERIFY_FUNCTION Compatible with FNDCPASS in E-Business Suite?
To implement the solution, please execute the following steps:
1. Log a service request requesting to attach it to the existing enhancement. Once this is done, the service request will be closed as it's unknown when the enhancement will be integrated into Applications.
2. Follow Enhancement Request: Bug 3363011.
19. ORA-29541 Unable to Change Password Using FNDCPASS Utility
Oracle error -29541: ORA-29541: class APPS.oracle/apps/fnd/security/WebSessionManagerProc could not be resolved has been detected in FND_WEB_SEC.VALIDATE_PASSWORD
To implement the solution, please execute the following steps:
1. Unzip RDBMS $ORACE_HOME/rdbms/jlib/servlet.jar to a temporary location.
2. cd to the
loadjava -u sys/
3. cd to the
loadjava -u sys/
4. If the above load is successful, then try to compile the following java classes in this order:
/69cdcac5_URLTools
/9bcc02c9_GenericFileManager
/98ca471e_GenericFileManager
/7ef1f61b_AppsContext
/be1b2bb2_ErrorStack
/4cc59dc8_AppsException
/4f323587_DataVerificationExce
/b3e79110_HTTPData
/50e4719a_AolSecurity
/3906534f_WebSessionManagerProc
For example :
SQL> conn apps/apps
Connected.
SQL> alter java class "/69cdcac5_URLTools" resolve;
Java altered.
5. Retest the issue.
20. FNDCPASS Updates FND_USER.LAST_LOGON_DATE with SYSDATE
The FND_USER.LAST_LOGON_DATE table is getting reset with SYSDATE when FNDCPASS command is run to change the apps password on the database.
Changing APPS, APPLSYS and Oracle Apps schema passwords is updating FND_USER.LAST_LOGON_DATE for Application Users.
eg FNDCPASS apps/ 0 Y system/ SYSTEM APPLSYS
Changing APPS, APPLSYS and Oracle Apps schema passwords is updating FND_USER.LAST_LOGON_DATE for Application Users.
eg FNDCPASS apps/
To implement the solution, please execute the following steps:
1. The official fix is included in RUP7 Patch 6241631.
As a workaround, please disable the trigger:
1. Connect to the apps schema using sqlplus.
2. Alter trigger FND_USER_RESET DISABLE;
21. Why aren't users forced to change/reset passwords during next login after running FNDCPASS?
This is expected functionality. FNDCPASS does not force the user to reset their passwords during the next log in. Users wanting to reset/change their passwords upon change should do so through the FNDSCAUS.fmb (Define User) form. When a password is changed in the Define User form, the user is forced to reset their password.
22. FNDCPASS Was Not Able to Decrypt Password for User 'ABC' During APPLSYS Password Change
When attempting to run command 'FNDCPASS apps/XXX 0 Y system/XXX SYSTEM APPLSYS XXX',
the following error occurs:
ERROR
-----------------------
FNDCPASS was not able to decrypt password for user 'GCC' during applsys password change.
FNDCPASS was not able to decrypt password for user 'APPS' during applsys password change.
FNDCPASS was not able to decrypt password for user 'APPLSYS' during applsys password change.
Debug line of code (fnd_preference.remove) was found in a sql script that ran during the upgrade process - patch/115/sql/afsecctx.sql. This causes the error message when run FNDCPASS to change APPS password after upgrading to 12.1.3 .
This is justified in Bug 8764069 - POST USERMIGRATE TO HASH PASSWORDS, AFTER 12.1 UPG, FNDCPASS FAILS DECRYPT
the following error occurs:
ERROR
-----------------------
FNDCPASS was not able to decrypt password for user 'GCC' during applsys password change.
FNDCPASS was not able to decrypt password for user 'APPS' during applsys password change.
FNDCPASS was not able to decrypt password for user 'APPLSYS' during applsys password change.
Debug line of code (fnd_preference.remove) was found in a sql script that ran during the upgrade process - patch/115/sql/afsecctx.sql. This causes the error message when run FNDCPASS to change APPS password after upgrading to 12.1.3 .
This is justified in Bug 8764069 - POST USERMIGRATE TO HASH PASSWORDS, AFTER 12.1 UPG, FNDCPASS FAILS DECRYPT
To implement the solution, please execute the following steps:
1. Download and review the readme for Patch 8764069.
2. Apply Patch 8764069 in a test environment.
3. Confirm the following file versions:
You can use the commands like the following:
strings -a $FND_TOP/ patch/115/sql/afsecctx.sql | grep -i '$Header'
4. Retest the issue.
5. Migrate the solution as appropriate to other environments.
WORKAROUND
1. Change password of All Oracle Applications Users (FND_USER) according to Note 419475.1 Removing Credentials from a Cloned EBS Production Database.
2. Retest the issue.
23. FNDCPASS was not able to decrypt password for {User Name} during APPLSYS password change
The passwords were updated by a method other than the Define User form or FNDCPASS. This is NOT supported.
To implement the solution, please execute the following steps:
Re-run FNDCPASS for the specific failed {User Name}.
Examples:
FNDCPASS apps/
FNDCPASS apps/
24. APP-FND-01496 Results From FNDCPASS Chaning The APPLSYS password
AFTER manually using the 'alter user' in sqlplus the following error occurs in the log for every application user account:
ERROR
APP-FND-01496: Cannot access application ORACLE password
Cause: Application Object Library was unable access your ORACLE password.
The APPLSYS (APPS) password became corrupted using ALTER USER because an applications session was not maintained at the same time. This apps session is necessary to change the APPLSYS password in:
'Security> Oracle> Register' WHILE being in SQL*PLUS as the SYSTEM user.
The supported method is use of FNDCPASS.
ERROR
APP-FND-01496: Cannot access application ORACLE password
Cause: Application Object Library was unable access your ORACLE password.
The APPLSYS (APPS) password became corrupted using ALTER USER because an applications session was not maintained at the same time. This apps session is necessary to change the APPLSYS password in:
'Security> Oracle> Register' WHILE being in SQL*PLUS as the SYSTEM user.
The supported method is use of FNDCPASS.
To implement the solution, please execute the following steps:
1. Restore the FND_ORACLE_USERID and FND_USER tables from a backup.
2. Then run FNDCPASS to change the APPLSYS password. Ex.
FNDCPASS apps/
25. APP-FND-1238: Cannot set value for field :USER.ENCRYPTED_USER_PASSWORD
When attempting to change a user password, the error below is generated:
APP-FND-1238: Cannot set value for field :USER.ENCRYPTED_USER_PASSWORD.
Review your error messages (Help ->Diagnostics -> Display Database Error ...) to see the cause of the error.
Encrypted APPLSYS password was corrupted.
APP-FND-1238: Cannot set value for field :USER.ENCRYPTED_USER_PASSWORD.
Review your error messages (Help ->Diagnostics -> Display Database Error ...) to see the cause of the error.
Encrypted APPLSYS password was corrupted.
To implement the solution, please execute the following steps:
Run FNDCPASS on the database tier and change the APPLSYS password to its original password value.
For example:
FNDCPASS apps/
Ex: $FNDCPASS apps/
NOTE: Changing the APPLSYS password automatically changes the APPS password to match as these two must always agree.
26. FRM-40200 Changing Users Password With The System Administrator Responsibility
Unable to change a users password with the System Administrator responsibility. The password field is not accessible and the following message appears at the bottom of the window:
FRM-40200 Field is protected against update
The fnd_user.encrypted_user_password column = 'EXTERNAL'.
In FND_USER, if the fnd_user.encrypted_user_password column = 'EXTERNAL', then:
1. The Change Password menu entry should be disabled on the Forms menu.
2. The Password field should be disabled on the Users form.
This is expected behavior for the column being set to EXTERNAL.
FRM-40200 Field is protected against update
The fnd_user.encrypted_user_password column = 'EXTERNAL'.
In FND_USER, if the fnd_user.encrypted_user_password column = 'EXTERNAL', then:
1. The Change Password menu entry should be disabled on the Forms menu.
2. The Password field should be disabled on the Users form.
This is expected behavior for the column being set to EXTERNAL.
To implement the solution, please execute the following steps:
1. Use FNDCPASS to change the password as required.
Example: FNDCPASS apps/
2. Reference: Note 303621.1 - How to Change and Which Apps Database Users Passwords Can Be Changed in a Multi-Node Apps Installation?
27. "Signon Password Failure Limit" Is Reached Unlocking Queries
Q1: A user account is locked after "Signon Password Failure Limit" is reached. Can it be unlocked without resetting the password?
Q2: After the account is locked because of "Signon Password Failure Limit", can it be automatically unlocked after 24hrs (or a set # of hrs)?
Q2: After the account is locked because of "Signon Password Failure Limit", can it be automatically unlocked after 24hrs (or a set # of hrs)?
To implement the solution, please execute the following step:
A1. No. To elaborate:
'Signon Password Failure Limit' invalidates the user account by updating the fnd_user encrypted password columns with value INVALID. In order to reinstate (unlock) the account these INVALID password values must be again populated with encrypted values. This ONLY happens when the password is reset.
A2. No. To elaborate:
There is no such automatic functionality within EBusiness Suite Apps to do this. The reinstatement (unlocking) of the application user account must be done by resetting the password which is done by the administrator either thru the FNDSCAUS (Security > User > Define) form or by FNDCPASS.
28. APP-FND-02704, APP-FND-01564, ORA-01403 changepassword Errors In Custom Schema
When attempting to modify a custom schema's (XXINT) password with FNDCPASS, the following error message occurred:
APP-FND-02704: Unable to alter user XXINT to change password.
APP-FND-01564: ORACLE error 1403 in changepassword
Cause: changepassword failed due to ORA-01403: no data found.
FND does not support case sensitive passwords for ORACLE accounts. FND expects database level passwords to be in uppercase. The SQL Reference manual, under Object Naming Rules, states that passwords can only contain alphanumeric characters from your database's character set and the characters _, $, and #.
Using $ and # is strongly discouraged.
When "Hard to Guess" functionality is activated, the password cannot contain repeating characters. (By repeating characters, it is meant *consecutively* repeating characters. Hence oracleo passes this criteria, while oraclee does not.) The ORACLE password is converted to all upper case internally and then "Hard to Guess" is validated, if enabled.
APP-FND-02704: Unable to alter user XXINT to change password.
APP-FND-01564: ORACLE error 1403 in changepassword
Cause: changepassword failed due to ORA-01403: no data found.
FND does not support case sensitive passwords for ORACLE accounts. FND expects database level passwords to be in uppercase. The SQL Reference manual, under Object Naming Rules, states that passwords can only contain alphanumeric characters from your database's character set and the characters _, $, and #.
Using $ and # is strongly discouraged.
When "Hard to Guess" functionality is activated, the password cannot contain repeating characters. (By repeating characters, it is meant *consecutively* repeating characters. Hence oracleo passes this criteria, while oraclee does not.) The ORACLE password is converted to all upper case internally and then "Hard to Guess" is validated, if enabled.
To implement the solution, please execute the following step:
Only use single case (upper suggested) passwords for ORACLE passwords. If the "Hard to Guess" functionality is activated, verify that the selected password meets all the requirements.
29. FND Invalid Hash mode detected for user_id = &USERID When Changing Password
Occurs when:
1. Go to Navigator Menu Edit> Preference > Change Password.
2. Enter Old Password and New Password/Re-enter password.
3. Press OK Button.
This issue has been fixed in the file "fnd src/security fdspwd.lc" in version "115.33"
This is explained in the following bug:
BUG 7304220 - 1OFF:6658428:ATG RUP6:11.5.10.2:UNABLE TO RESET PASSWORD AFTER IMPLEMENTING NON-REVERSIBLE HASH PASSWD(FNDCPASS)
1. Go to Navigator Menu Edit> Preference > Change Password.
2. Enter Old Password and New Password/Re-enter password.
3. Press OK Button.
This issue has been fixed in the file "fnd src/security fdspwd.lc" in version "115.33"
This is explained in the following bug:
BUG 7304220 - 1OFF:6658428:ATG RUP6:11.5.10.2:UNABLE TO RESET PASSWORD AFTER IMPLEMENTING NON-REVERSIBLE HASH PASSWD(FNDCPASS)
To implement the solution, please execute the following step:
1. Download and review the readme and pre-requisites for Patch 7304220.
2. Ensure that you have taken a backup of your system before applying the recommended patch.
3. Apply the patch in a test environment.
4. Please log a Service Request for support to post you the password.
5. Retest the issue.
6. Migrate the solution as appropriate to other environments.
WORKAROUNDS
1. a. The SSWA/Framework Preferences page.
b. Security > Define > User form.
OR
2. FNDCPASS apps/
