EM 13.5 RU1 with Database Password Rotation
We’re happy to introduce the release of a new database password rotation feature available with Oracle Enterprise Manager (EM) 13.5 RU1. Now, administrators can save more time and decrease risk by automating password changes periodically rather than completing the task manually.
In previous releases, automated password rotation was available only for the default database monitoring (dbsnmp) user using the job type, “Change the Password for the Database Monitoring User”. In this release, EM has expanded automated password rotation capabilities to include non-monitoring database users (e.g., user credentials used for patching databases). The new feature is available using a new job type, “Change the Password for a Database User”. It changes the password of a user in the target database as well as in EM’s Named Credentials that reference that user. You are given the option to either auto-generate a new password or explicitly state your own password.
Since the feature is available as a job, this provides you flexibility in scheduling when and how often passwords should be changed. The job can be run against many databases at a time, greatly reducing the time it would take to complete the password rotation task. This is especially beneficial when working with hundreds or thousands of databases.
How To Use Database Password Rotation Job?
You must have the following EM privileges to use this job. The first two target privileges are on the database targets that the job will execute on. The third privilege is used to edit the Named Credentials that reference the non-monitoring database user.
- CONNECT_TARGET
- CONFIGURE_TARGET
- EDIT_CREDENTIAL
- CREATE_JOB
Database Password Rotation Steps:
- On the EM menu, navigate to the Job tab and then to Activity
- From the Activity page, click on the “Create Job” button
- Select the “Change the Password for a Database User” option

- Specify a job name and select targets:
- Targets can be individual databases or a group containing databases.

- Define the job parameters:
- The “Database User” field refers to the user whose password will be changed.
- You are given the option to auto-generate a new password or specify your own password.
- To auto-generate a new password, set the “Auto-Generate New Password” field to Yes.
- Note: If you use the auto-generate password option, then the new password will be known only inside EM. Hence if you are using a database user outside of EM, we suggest using the option to specify your own password instead of using the auto-generate password option.
- To specify your own password, set the “Auto-Generate New Password” field to No and enter a new password. If the job type is intended for more than one-time use, the user specified password must be updated after each execution of the job to another known value.

- Define a job schedule for the job:
- To align with your enterprise’s password rotation policy, you can specify a repeating schedule for this job.
- Hit submit to schedule the job. The database password will change after the job is successfully executed.

Conclusion
Use the “Change the Password for a Database User” job to simplify the task of changing passwords against your fleet of databases, greatly diminishing the possibility of a missed password rotation that could occur from human error.
Periodic password rotation is crucial to sustain a stable database and is useful in avoiding password exploits. Take advantage of automation and get started now with this new feature!
For more information and a detailed step-by-step guideline on how to use this job, see this documentation.
For other details on the key enhancements available with all EM 13.5 Release Updates, see: