FNDCPASS Troubleshooting

6/21/2015
Document1306938.1
FNDCPASSTroubleshootingGuideForLoginandChangingApplicationsPasswords(DocID
1306938.1)
InthisDocument
Goal
Solution
1.ErrorStartingApplicationServicesAfterChangingAPPSPasswordUsingFNDCPASS
2.LogInFailsWith:YouDon'tHavePermissionToAccess/pls/.../fnd_icx_launch.launchOnThisServer
3.APPFND01564:ORACLEError6550InchangepasswordWithPortal/LoginServer/SSOAfterPatch
4.FNDCPASSNotAbleToDecryptPasswordForAPPLSYSPUBWhenChangingTheAPPSPassword
5.ChangingAPPSPasswordUsingFNDCPASSGives'notabletodecryptpassword'Message
6.FNDCPASSFailsChangingDatabasePassword:APPFND02704,APPFND01564,ORA01403
7.FNDCPASSFailsWith'ORA01017:invalidusername/passwordlogondenied
8.adpatchErrors:TheGivenORACLEPasswordIsNotTheCorrectPassword.
9.APPFND01496ReceivedWhenChangingTheAPPLSYSPasswordWithFNDCPASS
10.UsingFNDCPASSWithTheALLORACLEOption,WhyDoesn'tItChangeAllUserPasswords?
11.FndcpassFailswith500InternalServerErrorAfterMigratingDatabaseFromHpUxToLinux
12.FNDCPASSFailswithAPPFND02702andAPPFND02704
13.APPFND00434UnabletoChangePasswordUsingFNDCPASSUtility
14.FNDCPASSGives:APPFND01502:CannotEncryptApplicationORACLEPassword
15.WhyFNDCPASSFailsWithORA01005UsingUnderscoreorDollarSigninPasswords?
16.FNDCPASSCANNOTDECRYPTForSomeUsers
17.DbLinksAreInvalidAfterChangingTheAppsUserPasswordWithFNDCPASS
18.IsPASSWORD_VERIFY_FUNCTIONCompatiblewithFNDCPASSinEBusinessSuite?
19.ORA29541UnabletoChangePasswordUsingFNDCPASSUtility
20.FNDCPASSUpdatesFND_USER.LAST_LOGON_DATEwithSYSDATE
21.Whyaren'tusersforcedtochange/resetpasswordsduringnextloginafterrunningFNDCPASS?
22.FNDCPASSWasNotAbletoDecryptPasswordforUser'ABC'DuringAPPLSYSPasswordChange
23.FNDCPASSwasnotabletodecryptpasswordfor{UserName}duringAPPLSYSpasswordchange
24.APPFND01496ResultsFromFNDCPASSChaningTheAPPLSYSpassword
25.APPFND1238:Cannotsetvalueforfield:USER.ENCRYPTED_USER_PASSWORD
26.FRM40200ChangingUsersPasswordWithTheSystemAdministratorResponsibility
27."SignonPasswordFailureLimit"IsReachedUnlockingQueries
28.APPFND02704,APPFND01564,ORA01403changepasswordErrorsInCustomSchema
29.FNDInvalidHashmodedetectedforuser_id=&USERIDWhenChangingPassword
30.After12.1.3UpgradeFNDCPASSFails:WasNotAbleToDecryptPasswordForUser'Username'During
ApplsysPasswordChange
31.APPFND01564:ORACLEerror6502inchangepassword
32.UnableToChangeAPPLSYSPasswordUsingFNDCPASSInApplications12.1.3
33.AFPASSWDRelinkFailsWhileApplyingR12PatchWithErrorUndefinedReferenceToìifgcg'
Diagnostics&UtilitiesCommunity:
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrlstate=1036j0ojko_1090&id=1306938.1
1/22
6/21/2015
Document1306938.1
References
APPLIESTO:
OracleApplicationObjectLibraryVersion11.5.9to12.1.3[Release11.5to12.1]
Informationinthisdocumentappliestoanyplatform.
GOAL
ThisisaconsolidationofTopDocumentstoprovideaSingleSourcefortroubleshootingcommonproblemswith
FNDCPASS.
SOLUTION
1.ErrorStartingApplicationServicesAfterChangingAPPSPasswordUsingFNDCPASS
Error:
Cannotcompleteapplicationslogon.Youmayhaveenteredaninvalidapplicationspassword,ortheremayhave
beenadatabaseconnecterror.
Fromtheerror,it'sconfirmedthattheAPPSpassworddidnotchangecorrectly.SometimeswhenchangingtheAPPS
passwordusingFNDCPASSwithanewAPPSpassword,ifabletologintoSQLPLUSastheappsuser,thenit'sthought
thatthepasswordhaschangedcorrectlyIneveryscenario,thisisnottrue.IfabletoconnectthSQLPLUSwiththe
newAPPSpassword,thenitdoesn'tverifynewAPPSpasswordcompletely.ItisjustonetestfornewAPPSpasswords.
Ifabletostartapplicationservicessuccessfully,thenonecanconfirmthattheAPPSpasswordhaschanged
successfully.
PointstokeepinmindwhenchangingtheAPPSpasswordusingtheFNDCPASSutility:
Point1:ChangingAPPSpasswordusingan"alteruser"commandisnotsupportedandshouldnotbeusedfor
changingtheappspasswordinanycase.
Point2:AlwaysuseFNDCPASStochangetheAPPSpassword.ForanimprovedsolutiontoFNDCPASSasof
R12.1.2,clickhere.
Point3:BeforechangingAPPSpassword,itisstronglyrecommendedtotakeabackupofFND_USERand
FND_ORACLE_USERID.
Point4:AlwayscheckFNDCPASSlogforanykindoferror.IfthereisanyerrorintheFNDCPASSlog,thenDO
NOTrunautoconfigortrytochangeconfigurationfilemanually.UntilandunlessFNDCPASSloghasnoerror
pleasedonotrunautoconfigasyouwillgetproblemwhilelogginginoracleapplication.
Point5:IfgettinganyerrorintheFNDCPASSlog,theneitherreplacefromanoriginalbackupwithFND_USER
andFND_ORACLE_USERIDtologintoApplicationsorraiseanSRtosupportwiththeFNDCPASSlog.
1.Ifautoconfigwasnotrun,didnotmakeanychangeinconfigurationfilemanuallyandalsohaveavalidbackupof
2/22
6/21/2015
Document1306938.1
FND_USERandFND_ORACLE_USERIDtable,thenrecoverfromtheoriginalbackup.Startapplicationservices.
IfavalidbackupoftheFND_USERandFND_ORACLE_USERIDtabledoesnotexist,thenanexport/importoftable
FND_USERandFND_ORACLE_USERIDfromaInstancethathasthesamepatchsetlevelmustbeusedbecause
autoconfigwasnotrun.Ifthepatchsetlevelisnotsame,thentheexport/importofthetableswillnotwork.For
example:Iffacingtheissueonanewlyclonedinstance,thenexport/importthesourceinstancefromwhichtheclone
instancewasmade.
2.IfavalidbackupofFND_USERandFND_ORACLE_USERIDtableexists,buthavealreadyrunautoconfigthenthe
applicationservicescannotbestarted.Onceautoconfigisrun,thenreplacingtheoriginalbackupofFND_USERand
FND_ORACLE_USERIDtablewillnotwork.
Inthiscase,abackupoftheFND_USERandFND_ORACLE_USERIDtableisnotvalidbecauseautoconfigwasalready
runandhenceonlytwooptionsleft:
A.Followtheprocedurementionedinthebelownotetoremovedatabasecredentials:
Note419475.1:RemovingCredentialsfromaClonedEBSProductionDatabase
B.Doafreshclone.(Incasetheissueexistsinatestinstance.)
4.Oneshouldabletostartapplicationserviceswithoutanyerror.Ifabletostarttheapplicationserviceswithoutany
error,butstillarenotabletologin,thencheckadirectformslogin:
ForRelease11i:http://<hostname>:<port>/dev60cgi/f60cgi
ForRelease12:http://<hostname>:<port>/forms/frmservlet
Fordirectformslogging,belowparameterinCONTEXTfileshouldbesettoOFF.IfitisnotsettoOFFthenmake
belowchangesandrunautoconfig.
<appserverid_authenticationoa_var="s_appserverid_authentication">OFF</appserverid_authentication>
5.Onceabletologininformsmentionedinstep4,butstillpersonalhomepageloginisnotworking,thenit's
confirmedthattheissueisnowwithpersonelhomepageloginonlyandnoissuewiththeAPPSpassword.
RunAOL/JTest.UsebelowURLtorunAOL/JTest:
http://<hostname>:<port>/OA_HTML/jsp/fnd/aoljtest.jsp
2.LogInFailsWith:YouDon'tHavePermissionToAccess/pls/.../fnd_icx_launch.launchOnThis
Server
TheappsaccountislockedfromrepeatedlyrunningFNDCPASSorloggingintosqlplusasappsusingthewrong
password.
Toimplementthesolution,executethefollowingsteps:
1.Loginassystemownerandrun:
SQL>alterprofileDEFAULTlimitfailed_login_attemptsunlimited
SQL>alteruserappsaccountunlock
Thefirstline(optional)resultsinpreventingrepeatedfailedloginattemptsfromlockingtheaccount.
3/22
6/21/2015
Document1306938.1
Thesecondline(required)simplyunlockstheappsaccount.
2.Restarttheservices.
3.APPFND01564:ORACLEError6550InchangepasswordWithPortal/LoginServer/SSOAfterPatch
APPFND01564:ORACLEerror6550inchangepassword
Cause:changepasswordfailedduetoORA06550:line1,column7:
PLS00201:identifier'FND_SSO_REGISTRATION.IS_OPERATION_ALLOWED'mustbedeclared
ORA06550:line1,column7:
PL/SQL:Statementignored
ORA06512:at"APPS.FND_LDAP_WRAPPER",line1190
Toimplementthesolution,executethefollowingstep:
1.ForinstancesintegratedwithPortal3.0.9fromATG_PF.H.RUP3andabovetheprofileoptionApplicationsSSOLDAP
Synchronization(APPS_SSO_LDAP_SYNC)needstobesetto"Disabled".
4.FNDCPASSNotAbleToDecryptPasswordForAPPLSYSPUBWhenChangingTheAPPSPassword
TheAPPSpasswordappearstohavebeensuccessfullyupdatedandAutoconfigrunswithoutissue.
However,Discovererusershaveauthenticationproblems.
Theissueiscausedbyadatacorruptionissueinthefnd_usertable.
1.UseFNDCPASStoresettheAPPLSYSPUBpassword.
e.g.FNDCPASSapps/<password>0Ysystem/<password>ORACLEAPPLSYSPUBPUB
2.Retestfortheissue.
5.ChangingAPPSPasswordUsingFNDCPASSGives'notabletodecryptpassword'Message
Foundinlog:
FNDCPASSwasnotabletodecryptpasswordfor<testuser1>duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordfor<testuser2>duringapplsyspasswordchange.
Theprofileoption"ApplicationsSSOLoginTypes"issetto'SSO'.
Becausetheprofile"ApplicationsSSOLoginTypes"issetto'SSO',thepasswordismaintainedbyOracleInternet
DirectoryOIDandnotApplications,FNDCPASScannotupdatetheOIDdatadirectly.
TheFND_USERtablerecordhasthevalue'EXTERNAL'intheencryptedpasswordcolumns.
ThiscanbeconfirmedusingthefollowingSQL:
4/22
6/21/2015
Document1306938.1
selectuser_id,encrypted_foundation_password,encrypted_user_password
fromfnd_user
whereuser_name='{UserNamefromFNDCPASSlog}'
1.Settheprofile"ApplicationsSSOLoginTypes"to'Both'or'Local'.
ThenchangetheidentifiedUserpasswordusingtheSecurity/User/Defineform..
2.Ignorethemessageandrememberthatthepasswordismanagedexternally..
Note:
Aslongasthetablevalueis'EXTERNAL',theFNDCPASSutilitywilldisplaythemessagesinthelog.
6.FNDCPASSFailsChangingDatabasePassword:APPFND02704,APPFND01564,ORA01403
Note:Ithasbeenreportedthattheerrormayoccurifthepasswordstartswithanumber.
FNDCPASSapps/*****0Ysystem/****ORACLEHRHR
APPFND02704:UnabletoalteruserHRtochangepassword.
Cause:changepasswordfailedduetoORA01403:nodatafound.
TheSQLstatementbeingexecutedatthetimeoftheerrorwas:andwasexecutedfromthe
file&ERRFILE.
ThedatabaseprofileDEFAULTwaschangedfortheresourcePASSWORD_REUSE_MAX.
1.RevertbacktheresourceofthedatabaseprofileDEFAULTas:
FAILED_LOGIN_ATTEMPTStoUNLIMITED
PASSWORD_REUSE_MAXtoUNLIMITED
PASSWORD_LOCK_TIMEtoUNLIMITED
PASSWORD_GRACE_TIMEtoUNLIMITED
PASSWORD_VERIFY_FUNCTIONtoNULL
2.RerunFNDCPASS.
NOTE:TheissueisnotalwayswithDEFAULTprofile.Itdependsontheprofileassignedtotheuserwherethe
commandisfailing.Checkthiswith:
selectprofilefromdba_userswhereusername=<userwiththeerror>'
Ex:
selectprofilefromdba_userswhereusername='HR'
Afterfindingtheprofile,oneshouldsettheoptionsforthisprofiletoUNLIMITEDASitisnotalwaystheDEFAULT
profile.
5/22
6/21/2015
Document1306938.1
7.FNDCPASSFailsWith'ORA01017:invalidusername/passwordlogondenied
UpgradedtoApplicationsrelease12.0anddatabasefrom10.2.0.2to11.1.0.6
ThedatabaseSEC_CASE_SENSITIVE_LOGONparameterdefaultstoTRUE.Whenthisoccursthepassword
sensitivityconversiondoesnotoccur.Passwordsthatareinputaslowercaseareautomaticallyupdatedasupper
case.
1.SetthedatabaseSEC_CASE_SENSITIVE_LOGONparametertoFALSEintheinit.ora.
2.Runautoconfigontheapplicationtiersandbouncethedatabase.
8.adpatchErrors:TheGivenORACLEPasswordIsNotTheCorrectPassword.
FNDCPASSfailswith:
Working...
APPFND01496:CannotaccessapplicationORACLEpassword
Cause:ApplicationObjectLibrarywasunableaccessyourORACLEpassword.
Action:Contactyoursupportrepresentative.(USER=TWOODS)
Issuecausedbyuserpasswordcorruption,whichresultedinfailurewhenrunningFNDCPASSinanattempttore
encrypttheAPPLSYSpassword.
1.UseFNDCPASStoupdateeachfailingUserpasswordindividually.
FNDCPASSapps/<password>0Ysystem/<password>ORACLE<oracleuser><newpassword>
Ex:FNDCPASSapps/<password>0Ysystem/<password>ORACLEGLGLPASSWORD
2.RerunFNDCPASSagaintosuccessfullyaltertheAPPLSYSpassword:
FNDCPASSapps/<password>0Ysystem/<password>SYSTEMAPPLSYS<newpassword>
Ex:$FNDCPASSapps/<password>0Ysystem/<password>SYSTEMAPPLSYSNEWPASSWORD
NOTE:ChangingtheAPPLSYSpasswordautomaticallychangestheAPPSpasswordtomatchasthesetwomustalways
6/22
6/21/2015
Document1306938.1
agree.
9.APPFND01496ReceivedWhenChangingTheAPPLSYSPasswordWithFNDCPASS
TheALTERcommandwasrunmanuallyagainsttheAPPSuserbeforerunningFNDCPASS.TheAPPSandAPPLSYS
userpasswordsmustbeidentical.
1.RuntheALTERcommandagainsttheAPPSandAPPLSYSusersinsqlplustochangebacktotheoldpasswords:
sql>ALTERUSERAPPLSYSIDENTIFIEDBYXXX
sql>ALTERUSERAPPSIDENTIFIEDBYXXX
2.AfterwardsrunFNDCPASS:
Note:ChangingtheAPPLSYSpasswordautomaticallychangestheAPPSpasswordtomatchasthesetwomustalways
agree.
10.UsingFNDCPASSWithTheALLORACLEOption,WhyDoesn'tItChangeAllUserPasswords?
Toimplementthesolution,referencethefollowing:
UsernamesmustappearintheFND_USERorFND_ORACLE_USERIDtables.TheFNDCPASSutilityandALLORACLE
functionalitywasdesignedforapplicationsusers/schemas.
Thefollowingusernamepasswordsmustbemanuallychanged:
AccountName
ABM
AHM
AMF
CSS
CUE
CUN
DBSNMP
EAA
EVM
7/22
6/21/2015
Document1306938.1
FPT
IBA
IMT
IPD
JUNK_PS
MDSYS
ME
ODM
ODM_MTR
OKB
OKO
OKR
OLAPSYS
ORDPLUGINS
ORDSYS
OUTLN
OWAPUB
OZP
OZS
RHX
RLA
SCOTT
SSOSDK
SYS
VEH
XNC
XNI
XNM
XNS
alteruserXNSidentifiedbypassword
ForIBA,IMT,IPD,ODM_MTR,OKB,OKO,OKR,OLAPSYS,ABM,AHM,VEH,XNC,XNI,XNM,XNS,RHX,RLAschemas
arepartofthe6thcategoryFNDCPASSshouldnotbeused.
Alsodevelopmentmentionedthis:
InternalBug5394202:ARE120.7:ALLSCHEMASPASSWORDNOTGETTINGCHANGEDFNDCPASS
The38userslistedabovedonotexistinFND_ORACLE_USERIDorFND_USER
tables.
FNDCPASSisnotintendedtochangepasswordsforuserswhodonotexistin
thesetables.
FortheuserswhichareabsentinFND_ORACLE_USERID,youcanchangethepasswordusingaltercommand.
11.FndcpassFailswith500InternalServerErrorAfterMigratingDatabaseFromHpUxToLinux
WhenattemptingtologintoaR12instance,aftermigratingthedatabasefromHPtoLinuxfollowingthestepsin
8/22
6/21/2015
Document1306938.1
Note454616.1,thefollowingerroroccurs.
500InternalServerError
oracle.apps.fnd.cache.CacheException
atoracle.apps.fnd.cache.AppsCache.get(AppsCache.java:228)......
Theissuecanbereproducedatwillbyattemptingtologin.
PasswordHashMigration(FNDCPASSUSERMIGRATE)donepriortothedatamigration.
ThecauseofthisissueisthattheFND_USER_PREFERENCEStabledidnotgetexportedproperlyduetopassword
hashmigrationnotbeingcoveredoraccountedforintheexistingprocedure.
1.Exportofthefnd_user_preferencestableseparatelyusing:
$expsystem/<PWD>TABLES=(APPLSYS.FND_USER_PREFERENCES)COMPRESS=YDIRECT=Y
FILE=fnd_user_preferences.dmpLOG=exp_fnd_user_preferences.log
2.ImporttheApplicationsdatabasetarget
3.Importofthefnd_user_preferencestableseparately
$impsystem/<PWD>FILE=fnd_user_preferences.dmp
LOG=imp_fnd_user_preferences.logTABLES=FND_USER_PREFERENCESFROMUSER=APPLSYSIGNORE=Y
4.ResetAdvancedQueues(Note362205.1Section5)
5.Runadgrants(Note362203.1AftertheDatabaseUpgrade)
6.Runadctxprv.sql(Note362203.1AftertheDatabaseUpgrade)
7.CompileInvalidObjectsrunningadadmin
8.ImplementandrunAutoconfig(Note362203.1)
9.GatherStatisticsforSYSschema(Note362203.1AftertheDatabaseUpgrade)
10.CreateConTextandSpatialObjects(Note362205.1Section5)
11.CompileInvalidObjects(Note362205.1Section5)
12.MaintainApplicationsdatabaseobjects(Note362205.1Section5)
13.RestartApplicationsServerProcesses(Note362205.1Section5)
12.FNDCPASSFailswithAPPFND02702andAPPFND02704
FollowedNote.456838.1andfoundanumberofaccountsthataredatabaseuserswithpasswordsequalto
databaseusers,butthosedonotseemtoberegisteredasOracleSchemas/Users.
FNDCPASSendswiththefollowingerror:
APPFND02702:ABMisnotavalidoracleuser
Thelistincludes:ABM,AMF,CSS,CUE,CUN,EAA,EVM,FPT,IBA,IMT,IPD,ME,OKB,OKO,OKR,OZP,OZS,
RHX,RLA,VEH,XNC,XNI,XNM,XNS.
AlsotriedtochangepasswordforEDWREPuserwhichisnotaDatabaseuserbutisdefinedasOracle
Schema/UserandFNDCPASSerroredwith:
9/22
6/21/2015
Document1306938.1
APPFND02704:UnabletoalteruserEDWREPtochangepassword
1.EDWREPisnotinthetableDBA_USERSnorinFND_USER,sothereisnopasswordtochangeforthisuserasthere
isnopossibleconnectiontothisuser.ThisisexplainedinOrionNote431272.1.EDWREPcanbeignoredasitisnot
anOracleusernoranAPPSuser(FND_USER).
2.Thelistofothersusersprovided(ABM,...)isnotinthetablefnd_oracle_userid,soitcannotbechangedwith
FNDCPASS,that'sthenormalbehavior.
Note461904.1explainsthatABMisnowobsoleted.
SomeApplications/Productsareobsoletedinrelease12:
cun,amf,jts,xni,oko,okb,ahm,imt,veh,rla,rhx,ozs,ozp,iba,cue,okr,fpt,xns,xnc,xnm,css,me,zfa,zsa,rcm,
ipd,evm,abm,eaa
Asobsoleted,usingthealtercommandcanbeusedtosafelychangethepasswordoftheaboveusers.
13.APPFND00434UnabletoChangePasswordUsingFNDCPASSUtility
Whenattemptingtochangethepasswordofanyapplication/databaseuserusingFNDCPASS,thefollowingerror
occurs:
Error:
APPFND00434:AFPRCP:Failedtoinitializeprofileoptionvalues:FDWHOAMIenvironmentvariablecontains
invalidvalue5foruserID
SteptoReproduce:
Changepasswordofapplicationuser"VISION"usingbelowFNDCPASScommand:
FNDCPASSapps/apps0Ysystem/managerUSERVISIONWELCOME
Seededapplicationuser"APPSMGR"isnotpresentinFND_USERtable.USER_IDofapplicationuser"APPSMGR"is
5.Thatiswhywhenyouaretryingtochangethepasswordofanyapplication/databaseuserusingFNDCPASS
utilitytheniterrorsoutwithinvalidvalue5foruserID(seetheerror).
Toimplementthesolution,pleaseexecutethefollowingsteps:
1.IfabackupoftheFND_USERtableexists,thenrestoretherecordforUSER_ID=5fromthebackuptabletothe
existingFND_USERtable.
ConnecttoSQLPLUSasAPPSuser:
SQL>insertintoFND_USERselect*fromFND_USER_BAKwhereUSER_ID=5
WhereFND_USER_BAKisbackuptableofFND_USERtable.
10/22
6/21/2015
Document1306938.1
IfabackupoftheFND_USERtabledoesnotexist,thenthedataforthe'APPSMGR'usermustbeinsertedusingthe
belowSQL:
ConnecttoSQLPLUSasAPPSuser:
SQL>INSERTINTOFND_USER(
USER_ID,
USER_NAME,
LAST_UPDATE_DATE,
LAST_UPDATED_BY,
CREATION_DATE,
CREATED_BY,
LAST_UPDATE_LOGIN,
ENCRYPTED_FOUNDATION_PASSWORD,
ENCRYPTED_USER_PASSWORD,
SESSION_NUMBER,
START_DATE,
END_DATE,
DESCRIPTION)
VALUES(5,'APPSMGR',TO_DATE('10/27/20046:00:51PM','MM/DD/YYYYHH:MI:SSPM'),0,TO_DATE('05/21/1987
6:00:51PM','MM/DD/YYYYHH:MI:SSPM'),1,0,'INVALID','INVALID',0,TO_DATE('01/01/19516:00:51
PM','MM/DD/YYYYHH:MI:SSPM'),NULL,'Userforroutinemaintenanceactivitiesscheduledasconcurrentrequests.
Shouldbeusedforprescheduledrequestsandforrequestssubmittedatthetimeofpatchingapplications.')
SQL>Commit
2.Retesttheissue.
3.Migratethesolutionasappropriatetootherenvironments.
DONOTdeleteanyseededdatafromanyofseededtable.Forexample:'APPSMGR'isaseededapplicationuser
andshouldnotdeletethisrecordfromtheFND_USERtable.Deletionofseededrecordsfromanyseededtableis
notsupported.
14.FNDCPASSGives:APPFND01502:CannotEncryptApplicationORACLEPassword
APPFND01502:CannotencryptapplicationORACLEpassword
ApplicationObjectLibrarywasunableencryptyourORACLEpassword.
Action:Contactyoursupportrepresentative.(ORACLEUSER=APPS_SERV)
Thetablefnd_oracle_useridcontainrowsforschemasthatdoesnotexist.Thoserowsmustbedeleted
fromthetable.
1.Executethefollowingselectstatement:
select*fromfnd_oracle_userid
whereoracle_usernamenotin
11/22
6/21/2015
Document1306938.1
(selectusernamefromall_users)
Ifthisreturnsanyrows,thendeletethem.
15.WhyFNDCPASSFailsWithORA01005UsingUnderscoreorDollarSigninPasswords?
UsingtheUnderscore(_)orDollarSign($)aswellasParentheses()andComma(,)willcausethefollowing
errortobegenerated:
RoutineAFPCSQencounteredanORACLEerror.ORA01005:nullpasswordgivenlogondenied
Reviewyourerrormessagesforthecauseoftheerror.(=<POINTER>)
Onlyalphanumericcharactersshouldbeforpasswords.Bug5239293UNABLEUSETHEPUNCTUATIONMARKIN
FNDCPASSUTILITYhasbeenloggedtoaddressusingspecialcharacterssuchasthe_,#,and$.
16.FNDCPASSCANNOTDECRYPTForSomeUsers
Gettingerrormessageslike:
FNDCPASSCANNOTDECRYPT(USER=CONCURRENTMANAGER)
FNDCPASSCANNOTDECRYPT(USER=ANONYMOUS)
FNDCPASSCANNOTDECRYPT(USER=APPLSYSPUB)
Patch(5846796)wascreatedtofixthefnd_web_sec.validate_passwordtousetheSIGNON_PASSWORD_CASE
profilesettingforestablishingnewpasswordcriteria.
AccordingtoDevelopmentPatch5846796willnotbeavailablestandalone.
1.Customersshouldapply11i.ATG_PF.H.delta.6(RUP6)Patch5903765forthisissue.
Workaround
TheerrormessagesshoulddisappearsettingtheSystemProfile'PasswordCaseOption'to'Insensitive'.
17.DbLinksAreInvalidAfterChangingTheAppsUserPasswordWithFNDCPASS
1.SincechangingtheappspasswordallthedblinksshouldhavethenewAPPSpassword.Run
AutoConfigafterchangingtheAPPSpasswordandthiswillupdateall.Pleasenotethatthereisnoneedtorun
autoconfigeachtimeFNDCPASSisrun,onlyifchanginganyofthefollowingusers:
APPLSYS
APPS
12/22
6/21/2015
Document1306938.1
APPS_MRC
APPLSYSPUB
PORTAL30&PORTAL30_SSO(ForOracleLoginServerandPortal3.0.9withEBusinessSuite11i)
18.IsPASSWORD_VERIFY_FUNCTIONCompatiblewithFNDCPASSinEBusinessSuite?
1.Logaservicerequestrequestingtoattachittotheexistingenhancement.Oncethisisdone,theservicerequestwill
beclosedasit'sunknownwhentheenhancementwillbeintegratedintoApplications.
2.FollowEnhancementRequest:Bug3363011.
19.ORA29541UnabletoChangePasswordUsingFNDCPASSUtility
Oracleerror29541:ORA29541:classAPPS.oracle/apps/fnd/security/WebSessionManagerProccouldnotbe
resolvedhasbeendetectedinFND_WEB_SEC.VALIDATE_PASSWORD
1.UnzipRDBMS$ORACE_HOME/rdbms/jlib/servlet.jartoatemporarylocation.
2.cdtothe<templocation>/javax/servlet
loadjavausys/<syspwd>vfrServletRequest.class
3.cdtothe<templocation>/javax/servlet/http
loadjavausys/<syspwd>vfrHttpServletRequest.class
4.Iftheaboveloadissuccessful,thentrytocompilethefollowingjavaclassesinthisorder:
/69cdcac5_URLTools
/9bcc02c9_GenericFileManager
/98ca471e_GenericFileManager
/7ef1f61b_AppsContext
/be1b2bb2_ErrorStack
/4cc59dc8_AppsException
/4f323587_DataVerificationExce
/b3e79110_HTTPData
/50e4719a_AolSecurity
/3906534f_WebSessionManagerProc
Forexample:
SQL>connapps/apps
Connected.
SQL>alterjavaclass"/69cdcac5_URLTools"resolve
Javaaltered.
5.Retesttheissue.
13/22
6/21/2015
Document1306938.1
20.FNDCPASSUpdatesFND_USER.LAST_LOGON_DATEwithSYSDATE
TheFND_USER.LAST_LOGON_DATEtableisgettingresetwithSYSDATEwhenFNDCPASScommandisrunto
changetheappspasswordonthedatabase.
ChangingAPPS,APPLSYSandOracleAppsschemapasswordsisupdatingFND_USER.LAST_LOGON_DATEfor
ApplicationUsers.
egFNDCPASSapps/<pass>0Ysystem/<pass>SYSTEMAPPLSYS<newpass>
1.TheofficialfixisincludedinRUP7Patch6241631.
Asaworkaround,pleasedisablethetrigger:
1.Connecttotheappsschemausingsqlplus.
2.AltertriggerFND_USER_RESETDISABLE
21.Whyaren'tusersforcedtochange/resetpasswordsduringnextloginafterrunningFNDCPASS?
Thisisexpectedfunctionality.FNDCPASSdoesnotforcetheusertoresettheirpasswordsduringthenextlogin.
Userswantingtoreset/changetheirpasswordsuponchangeshoulddosothroughtheFNDSCAUS.fmb(DefineUser)
form.WhenapasswordischangedintheDefineUserform,theuserisforcedtoresettheirpassword.
22.FNDCPASSWasNotAbletoDecryptPasswordforUser'ABC'DuringAPPLSYSPasswordChange
Whenattemptingtoruncommand'FNDCPASSapps/XXX0Ysystem/XXXSYSTEMAPPLSYSXXX',
thefollowingerroroccurs:
ERROR
FNDCPASSwasnotabletodecryptpasswordforuser'GCC'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'APPS'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'APPLSYS'duringapplsyspasswordchange.
Debuglineofcode(fnd_preference.remove)wasfoundinasqlscriptthatranduringtheupgradeprocess
patch/115/sql/afsecctx.sql.ThiscausestheerrormessagewhenrunFNDCPASStochangeAPPSpasswordafter
upgradingto12.1.3.
ThisisjustifiedinBug8764069POSTUSERMIGRATETOHASHPASSWORDS,AFTER12.1UPG,FNDCPASSFAILS
DECRYPT
14/22
6/21/2015
Document1306938.1
1.DownloadandreviewthereadmeforPatch8764069.
2.ApplyPatch8764069inatestenvironment.
3.Confirmthefollowingfileversions:
<FND_TOP>/patch/115/sql/afsecctx.sql120.3.12010000.2
Youcanusethecommandslikethefollowing:
stringsa$FND_TOP/patch/115/sql/afsecctx.sql|grepi'$Header'
4.Retesttheissue.
WORKAROUND
1.ChangepasswordofAllOracleApplicationsUsers(FND_USER)accordingtoNote419475.1RemovingCredentials
fromaClonedEBSProductionDatabase.
2.Retesttheissue.
23.FNDCPASSwasnotabletodecryptpasswordfor{UserName}duringAPPLSYSpasswordchange
ThepasswordswereupdatedbyamethodotherthantheDefineUserformorFNDCPASS.ThisisNOTsupported.
RerunFNDCPASSforthespecificfailed{UserName}.
Examples:
FNDCPASSapps/<pwd>0Ysystem/<passwrd>ORACLEGL<NEWPASSWORD>
FNDCPASSapps/<pwd>0Ysystem/<passwrd>USERJOEUSER<NEWPASSWORD>
24.APPFND01496ResultsFromFNDCPASSChaningTheAPPLSYSpassword
AFTERmanuallyusingthe'alteruser'insqlplusthefollowingerroroccursinthelogforeveryapplicationuser
account:
ERROR
TheAPPLSYS(APPS)passwordbecamecorruptedusingALTERUSERbecauseanapplicationssessionwasnot
maintainedatthesametime.ThisappssessionisnecessarytochangetheAPPLSYSpasswordin:
'Security>Oracle>Register'WHILEbeinginSQL*PLUSastheSYSTEMuser.
15/22
6/21/2015
Document1306938.1
ThesupportedmethodisuseofFNDCPASS.
1.RestoretheFND_ORACLE_USERIDandFND_USERtablesfromabackup.
2.ThenrunFNDCPASStochangetheAPPLSYSpassword.Ex.
FNDCPASSapps/<appspassword>0Ysystem/<systempassword>SYSTEMAPPLSYSWELCOME
25.APPFND1238:Cannotsetvalueforfield:USER.ENCRYPTED_USER_PASSWORD
Whenattemptingtochangeauserpassword,theerrorbelowisgenerated:
APPFND1238:Cannotsetvalueforfield:USER.ENCRYPTED_USER_PASSWORD.
Reviewyourerrormessages(Help>Diagnostics>DisplayDatabaseError...)toseethecauseoftheerror.
EncryptedAPPLSYSpasswordwascorrupted.
RunFNDCPASSonthedatabasetierandchangetheAPPLSYSpasswordtoitsoriginalpasswordvalue.
Forexample:
NOTE:ChangingtheAPPLSYSpasswordautomaticallychangestheAPPSpasswordtomatchasthesetwomustalways
agree.
26.FRM40200ChangingUsersPasswordWithTheSystemAdministratorResponsibility
UnabletochangeauserspasswordwiththeSystemAdministratorresponsibility.Thepasswordfieldisnot
accessibleandthefollowingmessageappearsatthebottomofthewindow:
FRM40200Fieldisprotectedagainstupdate
Thefnd_user.encrypted_user_passwordcolumn='EXTERNAL'.
InFND_USER,ifthefnd_user.encrypted_user_passwordcolumn='EXTERNAL',then:
1.TheChangePasswordmenuentryshouldbedisabledontheFormsmenu.
2.ThePasswordfieldshouldbedisabledontheUsersform.
ThisisexpectedbehaviorforthecolumnbeingsettoEXTERNAL.
16/22
6/21/2015
Document1306938.1
1.UseFNDCPASStochangethepasswordasrequired.
Example:FNDCPASSapps/<password>0Ysystem/<password>USERVISIONWELCOME
2.Reference:Note303621.1HowtoChangeandWhichAppsDatabaseUsersPasswordsCanBeChangedinaMulti
NodeAppsInstallation?
27."SignonPasswordFailureLimit"IsReachedUnlockingQueries
Q1:Auseraccountislockedafter"SignonPasswordFailureLimit"isreached.Canitbeunlockedwithoutresetting
thepassword?
Q2:Aftertheaccountislockedbecauseof"SignonPasswordFailureLimit",canitbeautomaticallyunlockedafter
24hrs(oraset#ofhrs)?
Toimplementthesolution,pleaseexecutethefollowingstep:
A1.No.Toelaborate:
'SignonPasswordFailureLimit'invalidatestheuseraccountbyupdatingthefnd_userencryptedpasswordcolumns
withvalueINVALID.Inordertoreinstate(unlock)theaccounttheseINVALIDpasswordvaluesmustbeagain
populatedwithencryptedvalues.ThisONLYhappenswhenthepasswordisreset.
A2.No.Toelaborate:
ThereisnosuchautomaticfunctionalitywithinEBusinessSuiteAppstodothis.Thereinstatement(unlocking)ofthe
applicationuseraccountmustbedonebyresettingthepasswordwhichisdonebytheadministratoreitherthruthe
FNDSCAUS(Security>User>Define)formorbyFNDCPASS.
28.APPFND02704,APPFND01564,ORA01403changepasswordErrorsInCustomSchema
Whenattemptingtomodifyacustomschema's(XXINT)passwordwithFNDCPASS,thefollowingerrormessage
occurred:
APPFND02704:UnabletoalteruserXXINTtochangepassword.
Cause:changepasswordfailedduetoORA01403:nodatafound.
FNDdoesnotsupportcasesensitivepasswordsforORACLEaccounts.FNDexpectsdatabaselevelpasswordstobe
inuppercase.TheSQLReferencemanual,underObjectNamingRules,statesthatpasswordscanonlycontain
alphanumericcharactersfromyourdatabase'scharactersetandthecharacters_,$,and#.
Using$and#isstronglydiscouraged.
When"HardtoGuess"functionalityisactivated,thepasswordcannotcontainrepeatingcharacters.(Byrepeating
characters,itismeant*consecutively*repeatingcharacters.Henceoracleopassesthiscriteria,whileoracleedoes
not.)TheORACLEpasswordisconvertedtoalluppercaseinternallyandthen"HardtoGuess"isvalidated,if
enabled.
17/22
6/21/2015
Document1306938.1
Onlyusesinglecase(uppersuggested)passwordsforORACLEpasswords.Ifthe"HardtoGuess"functionalityis
activated,verifythattheselectedpasswordmeetsalltherequirements.
29.FNDInvalidHashmodedetectedforuser_id=&USERIDWhenChangingPassword
Occurswhen:
1.GotoNavigatorMenuEdit>Preference>ChangePassword.
2.EnterOldPasswordandNewPassword/Reenterpassword.
3.PressOKButton.
Thisissuehasbeenfixedinthefile"fndsrc/securityfdspwd.lc"inversion"115.33"
Thisisexplainedinthefollowingbug:
BUG73042201OFF:6658428:ATGRUP6:11.5.10.2:UNABLETORESETPASSWORDAFTERIMPLEMENTINGNON
REVERSIBLEHASHPASSWD(FNDCPASS)
1.DownloadandreviewthereadmeandprerequisitesforPatch7304220.
2.Ensurethatyouhavetakenabackupofyoursystembeforeapplyingtherecommendedpatch.
3.Applythepatchinatestenvironment.
4.PleaselogaServiceRequestforsupporttopostyouthepassword.
5.Retesttheissue.
WORKAROUNDS
1.a.TheSSWA/FrameworkPreferencespage.
b.Security>Define>Userform.
OR
2.FNDCPASSapps/<password>0Ysystem/<password>USER<username><password>.
30.After12.1.3UpgradeFNDCPASSFails:WasNotAbleToDecryptPasswordForUser'Username'
DuringApplsysPasswordChange
Symptoms
In12.1.3,WhenattemptingtochangepasswordusingFNDCPASSthefollowingerrorisencountered.Another
symptomcouldbe,FNDCPASSfailswithUnabletoconnectasapplsys.
FNDCPASSapps/<apps_passwd>0Ysystem/managerSYSTEMAPPLSYS<NewPasswd>
ERROR
FNDCPASSwasnotabletodecryptpasswordforuser'EDWREP'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'CTXSYS'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'PORTAL30_SSO'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'PORTAL30'duringapplsyspasswordchange.
18/22
6/21/2015
Document1306938.1
FNDCPASSwasnotabletodecryptpasswordforuser'XNB'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'ZFA'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'ZSA'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'APPS'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'APPLSYS'duringapplsyspasswordchange.
Cause
ThecauseofthisproblemhasbeenidentifiedandverifiedinanunpublishedBug11845888.Afterupgradeto12.1.3,
applythePatch11845888beforechangingthepasswordtoavoidtheseproblems.ThisfixestheissuesinFNDCPASS
andissueswithusernamelength.
1.DownloadandreviewthereadmeandprerequisitesforPatch11845888.
2.Ensurethatyouhavetakenabackupofyoursystembeforeapplyingtherecommendedpatch.
3.Applythepatchinatestenvironment.
4.Confirmthefollowingfileversions
afspwd.o120.5.12010000.8
fdscpwd.o120.24.12010000.8
Youcanusethecommandslikethefollowing:
stringsa$FND_TOP/bin/FNDCPASS|grepafspwd
stringsa$FND_TOP/bin/FNDCPASS|grepfdscpwd
5.Retesttheissueandmigratetoappropriateenvironments.
AfterthePatchisapplied,thefollowingerrorsmightstilloccur.Thebelowmessagescanbeignored.Thoseare
oracleseededuserstobeusedbytheFNDLOAD.Theydonothavelogincapabilities,Soitisnormalthattheyare
shownintheFNDCPASSlogfiles.
FNDCPASSwasnotabletodecryptpasswordforuser'INDUSTRYDATA'duringapplsyspasswordchange.
FNDCPASSwasnotabletodecryptpasswordforuser'ORACLE12.0.0'duringapplsyspasswordchange.
19/22
6/21/2015
Document1306938.1
12.0customerscanapplyequivalentPatch11854373
31.APPFND01564:ORACLEerror6502inchangepassword
WhenattemptingtorunFNDCPASS,thefollowingerroroccurs.
ERROR
FNDCPASSapps/pwd0Ysystem/pwdUSERsysadminpwd
Currentsystemtimeis25JUN201201:42:24
++
Cause:changepasswordfailedduetoORA06502:PL/SQL:numericorvalueerror:characterstring
buffertoosmall
ORA06512:at"APPS.FND_WEB_SEC",line1372
ORA06512:atline1.
TheSQLstatementbeingexecutedatthetimeoftheerrorwas:begin:r:=
fnd_web_sec.change_password(:u,:p)endandwasexecutedfromthefile&ERRFILE.
Thelikelycauseforthiserroristhattheprofileoptionvaluefor'SIGNON_PASSWORD_CASE'iswronglysetto
INSENSITIVE,itshouldbesettovalue1.Possiblevaluesare:INSENSITIVE1andSENSITIVE2.
Tocheckthevalueofthisprofileoptiondothefollowiing:
1.SQL>selectprofile_option_id,application_idfromfnd_profile_optionswhere
profile_option_name='SIGNON_PASSWORD_CASE'
Thenfromtheprofile_option_idreturned
2.SQL>selectprofile_option_value,level_id,level_valuefromfnd_profile_option_values
whereprofile_option_id=[VALUERETURNEDFROMABOVEQUERY]andapplication_id=0
IfPROFILE_OPTION_VALUEreturnedisINSENSITIVE(1),thenexecutethefollowingsteps:
1.Declare
valueBoolean
Begin
value:=FND_PROFILE.SAVE('SIGNON_PASSWORD_CASE','1','SITE')
End
2.Retrythefndcpass
32.UnableToChangeAPPLSYSPasswordUsingFNDCPASSInApplications12.1.3
20/22
6/21/2015
Document1306938.1
Patch11845888deliversanewoptionthatthecustomercancontrolwhetherornottheywanttoperformtheinvalid
check.TheOSvariable:FND_CHECK_INVALIDwascreatedtoactivate/inactivatethisnewfunctionality.Thatiswhen
onerunstheFNDCPASSthoserecordsaremarked,sotheprogramwillnotprocesstheinvalidrecordsagain,meaning
thenexttimethatFNDCPASSrunsitwillnotshowthoserecordsinthereport.
ToActivatetheoptionsettheenvironmentvariablebeforerunningFNDCPASS:
exportFND_CHECK_INVALID=TRUE
ToInactivatetheoptionUnsettheenvironmentvariablebeforerunningFNDCPASS:
exportFND_CHECK_INVALID=FALSE
OR
Commentitout#orunsetFND_CHECK_INVALID.
33.AFPASSWDRelinkFailsWhileApplyingR12PatchWithErrorUndefinedReferenceToìifgcg'
OnOracleApplications12.1.3,
whenapplyingR12.1patchesrelinkingAFPASSWD,thefollowingerroroccurs:
Relinkingmodule'AFPASSWD'inproductfnd...
12362384/fnd/lib/afpsslbm.c:(.text+0x51c):multipledefinitionof`ShowUsage'
APPL_TOP/fnd/12.0.0/lib/afpasswd.o:8974458/fnd/lib/a
fpasswd.c:(.text+0x0):firstdefinedhere
APPL_TOP/fnd/12.0.0/lib/libfnd.a(afwaol.o):In
functionàfwtogi':
5069629/fnd/src/sqf/afwaol.c:(.text+0x11):undefinedreferencetoìifgcg'
5069629/fnd/src/sqf/afwaol.c:(.text+0x56):undefinedreferencetoìifwru'
APPL_TOP/fnd/12.0.0/lib/libfnd.a(afwaol.o):In
functionàfwfmdi':
5069629/fnd/src/sqf/afwaol.c:(.text+0x91):undefinedreferencetoìifgcg'
5069629/fnd/src/wnd/afwdev.c:(.text+0xbe3):undefinedreferencetoùigrsw'
5069629/fnd/src/wnd/afwdev.c:(.text+0xbfe):undefinedreferencetoùioarc'
5069629/fnd/src/wnd/afwdev.c:(.text+0xc21):undefinedreferencetoùigrsa'
...
5069629/fnd/src/wnd/afwdev.c:(.text+0x3768):undefinedreferencetoùioim'
collect2:ldreturned1exitstatus
make:***[/APPL_TOP/fnd/12.0.0/bin/AFPASSWD]Error1
Donewithlinkoffndexecutable'AFPASSWD'onWedOct315:52:12EDT2012
Cause
Theissueiscausedbythefollowingsetup:
Incorrectversionoffileafwdev.c
Thiscauseisoutlinedinthefollowingnotes/bugs:
Bug13954129INCOMPLETEINFORMATIONSHOWNINDELIVERYTOSCREENIFSUBMITREQUESTBYCOPYING
ThiscanoccurforotherR12.1patchesneedingtorelinkAFPASSWD.
Solution
1.Ensurethatyouhavetakenabackupofyourenvironment.
2.DownloadandreviewthereadmeofPatch13855823.
21/22
6/21/2015
Document1306938.1
3.Applythepatchinatestinstanceandretesttheissue.
Diagnostics&UtilitiesCommunity:
Diagnostics
PleaseaccesstheEbusinessSecuritysectiononsecuritydiagnosticsforthelatestreleasesasreflectedin
Document421245.1EBusinessSuiteDiagnosticsReferencesforR12.
UtilitiesCommunity
VisittheUtilitiescommunityforhelpfromindustryexpertsortoshareknowledge.
NOTE:437260.1HowtoChangeApplicationsPasswordsusingApplicationsSchemaPasswordChangeUtility
(FNDCPASSorAFPASSWD)
NOTE:431272.1EDWREPAndODMSchemasDoesNotExistInDDA_USERSTable.
BUG:5239293UNABLEUSETHEPUNCTUATIONMARKINFNDCPASSUTILITY
NOTE:461904.1CantheABMSchemaand/orEAASchemaandObjectsBeDroppedinR12?
BUG:8764069POSTUSERMIGRATETOHASHPASSWORDS,AFTER12.1UPG,FNDCPASSFAILSDECRYPT
NOTE:1377670.1After12.1.3UpgradeFNDCPASSFailsWithErrorWasNotAbleToDecryptPasswordForUser
'Username'DuringApplsysPasswordChange
NOTE:303621.1HowtoChangeandWhichAppsDatabaseUsersPasswordsCanBeChangedinaMultiNodeApps
Installation?
NOTE:362203.1OracleApplicationsRelease11iwithOracle10gRelease2(10.2.0)
NOTE:362205.110gRelease2Export/ImportProcessforOracleApplicationsRelease11i
NOTE:419475.1RemovingCredentialsfromaClonedEBSProductionDatabase
BUG:12985552FNDCPASSWASNOTABLETODECRYPTPASSWORDFORUSER'USERNAME'DURINGAPPLSYSPAS
NOTE:456838.1WhenRunningFNDCPASSwithALLORACLEOptionWhyDoesn'tItChangeAllUserPasswords?
Didn'tfindwhatyouarelookingfor?
22/22

FNDCPASS Troubleshooting

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

FNDCPASS Troubleshooting

Hochgeladen von

Copyright:

Verfügbare Formate

6/21/2015

Das könnte Ihnen auch gefallen