Validating User Oracle Passwords for Reset application

Question

This is a mix of programming and sysadmin but I decided its more of a programming issue.

Currently working building a password management web application for managing Oracle user accounts (C#).

The scope calls for verification of the users Oracle username and password before they're allowed to set a new password. Without creating a table of users passwords (hashed or otherwise, this is a security risk), how can I verify the old users password?

My current solution is to make an attempt to connect to the database using the username/password specified by the user. Too many attempts at this would lock the user out on the Oracle end, so brute forcing isn't too plausible. Are there other security risks here I am missing or is there a better way of handling this?

We use AD as primary authentication but the AD accounts aren't tied to the Oracle accounts so it's just a preliminary check.

Flow of the application (if this helps):

1. AD Check for proper domain (intranet)
2. User enters Oracle Username/Password
3. Enters old Password, new Password + Confirmation
4. Reset password if correct

Answer 1

The algorithm for hashing Oracle passwords is well known and not hard to duplicate. So you could take the user's entry, hash it using the same algorithm and match it to the hash value. That value is visible in DBA_USERS prior to 11g or in SYS.USER$ otherwise.

The danger of this approach is making the hash available allows for brute-force cracking of the password (which is why 11g makes the hashed value less visible).

Answer 2

As dpbradley suggests, I would connect to the database using the supplied credentials. If it succeeds, let them change their password.

Answer 3

When calling Alter User you can add the Replace keyword so that it will only alter the user if you have entered the correct old password (eg. alter user userName identified by newPassword replace oldPassword.) There are cases where this will not cause an error if you enter an incorrect old password but you can look them up if you run into a problem with it.