Change Oracle passwords: SAP R3, Oracle9.2.0.7, Sunsolaris

[Former Member]

Hi Experts,

I need to change the passwords for database users like SYSTEM, SYS, SAPR3 etc.

Can some please correct me if i am wrong:

Login as ora<sid>

brconnect -c -u / -f chpass -o sapr3 -p <newpassword for sapr3>

brconnect -c -u / -f chpass -o system -p <newpassword for system>

brconnect -c -u / -f chpass -o sys -p <newpassword for sys>

1. Are the above sysntax correct.

2. What is the change procedure like (Online, or need to down the system)

3. If we change online, do we need to restart once changes done?

4. If we change while system is down then what could be the state of database, (Mount???)

5. Lastly with user orasid we have to change or SQL prompt.

Please help.. .

rgds

[Former Member]

Hi All,

Thanks for your inputs!!!

I did other way though it is lengthy!

Our SID=P47

1. Logon to the operating system with p47adm

Execute the following:

sqlplus "/as sysdba"

drop table "OPS$P47ADM"."SAPUSER";

CREATE TABLE "OPS$P47ADM".SAPUSER

(USERID VARCHAR2(256), PASSWD VARCHAR2(256));

INSERT INTO "OPS$P47ADM".SAPUSER VALUES ('SAPR3',

'<new_password>');

2. And afterwards, set the new password on Oracle level too, be executing:

ALTER USER SAPR3 IDENTIFIED BY <new_password>;

Regards

[former_member204746]

DO NOT use "@" in your password, this is a known issue, there was even a SAP note about this (which I can't find now...)

[Former Member]

Eric Brunelle,

Thanks for info. That could be the reason yesterday I struggled to impart that password. Later am thro after changing the password to some other but without '@' symbol..

Rgds

[Former Member]

Hi,

There is problem with OPS$USER connecting to the DB and getting password of SAPSCHEMA ID,. this is known problem in oracle 10g after you upgrade it.

You have to create the password in SAPUSER table for SAPSCHEMA-ID using this BRCONNECT command

brconnect -u system/MANAGER -f chpass -o <schema-id> -p sap.

for checking , if the password for SAPSCHEMA-ID is present in SAPUSER tale , connect with root user in sqlplus(sqlplus /)

and then type query

select * from SAPUSER;

if output is 'no rows selected' then you have to create the pwd using brconnect command.

Thanks

Prasanna

[stefan_koehler]

Hello Jalli,

the documentation:

http://help.sap.com/saphelp_nw70/helpdata/en/4f/c3883989676778e10000000a11402f/content.htm

1. Are the above sysntax correct.

No take a look at the link:

brconnect [-u system/<system_password>] –c –f chpass –u <user_name> –p <new_password>

2. What is the change procedure like (Online, or need to down the system)

You can do that online.

3. If we change online, do we need to restart once changes done?

No.

4. If we change while system is down then what could be the state of database, (Mount???)

The database must be opened (normal startup)

5. Lastly with user orasid we have to change or SQL prompt.

Run brconncet as ora

Regards

Stefan

[Former Member]

Hi Stefan,

Thanks for response!!!

Finally

1. I need to use square brackets in the command

2. Will this works with Release 620 (kernel upgraded to 640)

Regds

jalli

[andreas_herzog]

Jalli, plz read sapnote 400.241 carefully...everything you need is explained:

> brconnect -u system/<password> -f chpass -o <sapowner> -p <password>

[meaning: no, you do not use the brackets...these are just options for the command...]

is the correct syntax for changing the password consistently...sapowner is the sap schema-user - could be sapr3 or sapsr3 depending on your database schema...

be sure to take sapnotes 569.302 and 562.863 (point 7.) into account...do not change the passwords while your sap system is still running!

GreetZ, AH

[stefan_koehler]

Hello Andreas,

this is interesting.. the sapnote #400241 is not consistent with the documentation.

For the documentation:

> As of Release 6.10, you can use BRCONNECT to change the passwords for the database users SAP<SAPSID>, SYS, or SYSTEM.

> brconnect -u system/<systempassword> -c -f chpass -u <username> -p <newpassword>

The sapnote #400241:

> Set the password consistently in SAPUSER and in the Oracle DDIC using the following BRCONNECT call (BRCONNECT >= 6.10):

> brconnect -u system/<password> -f chpass -o <sapowner> -p <password>

> do not change the passwords whlie sap system is running!

Can you please explain this? If a work process restarts it gets the data again from table SAPUSER, so why can the password not be changed while the system is running? The OS authentication method is also not influenced.

Regards

Stefan

[fidel_vales]

Hi Stefan,

The password is cached. If you change it while sap is running, SAP will try to connect with the cached password and it fail as the password on the DB has changed.

I have not tested this with the latest kernel (700) but before it worked the mentioned way.

[Former Member]

Hi Fidel Vales

In the following systax (Assume i need to change the password for system which is having old password as manager.

Is it the correct procedure to do:

1. Down SAP appliction

2. Database in open state.

3. Login as ora<sid> and run the command

brconnect -u system/<oldpasswordfor system> -f chpass -o <sapowner> -p <newpasswordfor system>

In the above syntax what is sapowner??? Is it database schema???

regds

[Former Member]

Hi Fidel,

Can you respond immediately. . . As it is urgent. . .

Rgds

[stefan_koehler]

Hello Fidel,

thanks for that information - so the entries in the work process trace file are "fake" and not the truth.

These are the entries of a 6.40 system:

>C Logon as OPS$-user to get SAP<SID>'s password

>C Connecting as /@<SID> on connection 0 (nls_hdl 0) ... (dbsl 640 070208)

>C Starting user session (con_hdl=0,svchp=0x1143ae9c8,srvhp=0x1143aec48,usrhp=0x1143b87e0)

>C Now 'SAP<SID>/<pwd>@<SID>' is connected: con_hdl=0, nls_hdl=0, session_id=329.

Sometimes i don't understand SAP why they are bluffing the customers in some case.

Regards

Stefan

[Former Member]

Hi All,

I tried to change password for sapr3 from sapdba (option m)!!! it is throughing error:

SAPDBA: Error connecting as user SAPR3 with new password.

Press <return> to continue ...

Now when I try to retrieve back it is not connecting to oracle.

When i use Brconnect: following error coming:

brconnect -c -u / -f chpass -o sapr3 -p sap@ttml

prd47e:orap47 4% brconnect -c -u / -f chpass -o sapr3 -p sap@ttml

BR801I BRCONNECT 6.20 (29)

BR280I Time stamp 2008-04-27 15.34.30

BR828I Changing password for database user SAPR3

BR280I Time stamp 2008-04-27 15.34.30

BR301E SQL error -1031 at location password_change-5

ORA-01031: insufficient privileges

BR832E Changing password for user SAPR3 failed

Please help. . .my PRODUCTION server is down

[fidel_vales]

Hi Fidel,
Can you respond immediately. . . As it is urgent. . .
Rgds

I do not think that is of good education demand anything to a person that is spending its free time trying to help.

If it is so urgent I suggest to spend some time reading the documentation as everything is there.

> Is it the correct procedure to do:
> 
> 1. Down SAP appliction 
> 2. Database in open state.
> 3. Login as ora<sid> and run the command
> 
> brconnect -u system/<oldpasswordfor system> -f chpass -o <sapowner> -p <newpasswordfor system>
> 
> In the above syntax what is sapowner??? Is it database schema???

Yes, sapowner is the database schema, for "old" installations is SAPR3, current installations is SAP<DBSID>

[fidel_vales]

>

> Hello Fidel,
> thanks for that information - so the entries in the work process trace file are "fake" and not the truth.
> 
> These are the entries of a 6.40 system:
> >C  Logon as OPS$-user to get SAP<SID>'s password
> >C  Connecting as /@<SID> on connection 0 (nls_hdl 0) ... (dbsl 640 070208)
> >C  Starting user session (con_hdl=0,svchp=0x1143ae9c8,srvhp=0x1143aec48,usrhp=0x1143b87e0)
> >C  Now 'SAP<SID>/<pwd>@<SID>' is connected: con_hdl=0, nls_hdl=0, session_id=329.
> 
> Sometimes i don't understand SAP why they are bluffing the customers in some case.
> 
> Regards
> Stefan

Hi Stefan,

I cannot answer that, I've also seen those entries. But my own experience when I was in primary support with exactly this issue indicate that it is cached. Situation that gave quite some headaches

[fidel_vales]

And now I see this:

>

> Hi All,
> 
> I tried to change password for sapr3 from sapdba (option m)!!! it is throughing error:
> 
> SAPDBA: Error connecting as user SAPR3 with new password.
>         Press <return> to continue ...
> 
> Now when I try to retrieve back it is not connecting to oracle.
> 
> When i use Brconnect: following error coming:
> 
> brconnect -c -u / -f chpass -o sapr3 -p sap@ttml
> prd47e:orap47 4% brconnect -c -u / -f chpass -o sapr3 -p sap@ttml
> BR801I BRCONNECT 6.20 (29)
> 
> BR280I Time stamp 2008-04-27 15.34.30
> BR828I Changing password for database user SAPR3
> BR280I Time stamp 2008-04-27 15.34.30
> BR301E SQL error -1031 at location password_change-5
> ORA-01031: insufficient privileges
> BR832E Changing password for user SAPR3 failed
> 
> Please help. . .my PRODUCTION server is down

The reason it does not work is because you try to change the password with the OPS$ user and this user does NOT have authorizations to do it:

> brconnect -c -u / -f chpass -o sapr3 -p sap@ttml

As mentioned, you have to use the user SYSTEM (or another user with enough authorizations) (mentioned in the FIRST reply from Stefan)