Oracle Database / Accounts, Security & Access
ORA-28001: coordinate an expired application password change
Password expiry can affect every application component sharing an account. Establish which secret consumers must change together.
Environment and inputs: Oracle Database 19c baseline · SQL*Plus-compatible SQL unless RMAN, DGMGRL, ADRCI or a host shell is specified. Check release, patch level, edition and container first.
Start with this diagnostic
Use the stated SQL, RMAN, DGMGRL or host shell and replace sample names with approved targets. DBA and V$ views need authorized catalog access in the correct container. Do not grant broad privileges for an example.
SELECT username, account_status, expiry_date, profile FROM dba_users WHERE username = 'APP_USER';Read the result
The expiry and profile describe the account in this container. Administrative views do not reveal the password or prove all clients use the same secret reference.
Resolve and verify
Use the approved credential-rotation workflow, update all authorized consumers and recycle their connections safely. Verify both immediate login and later scheduled jobs.
Operational precautions
Do not disable expiry globally or publish a replacement password in a deployment log.