database - password_verify_function not used?

Question

We are attempting to secure an oracle instance and the default password verification function does not meet the exact specifications established.

A new function was written and compiled by sys. This was also set as the "DEFAULT" profiles password_verify_function

alter profile default limit
    password_verify_function custom_function;

However, when a new user is created, the password verification does not seem to occur. I receive no warnings or errors during compilation of the function. This is how the user is being created:

create user stackoverflowexample
    identified by easy
    default tablespace encrypted_ts
    quota unlimited on encrypted_ts
    profile default;

What gotcha's am I not finding/understanding?

Answer 1

无法重现：

CREATE OR REPLACE FUNCTION custom_function (
   username VARCHAR2, password VARCHAR2, old_password varchar2) RETURN BOOLEAN 
AS
BEGIN
  IF password IS NULL OR length(password) < 10 THEN
    RAISE_APPLICATION_ERROR(-20001, 'Password length less than 10.');
  ELSE
    RETURN TRUE;
  END IF;
END custom_function;
/
-- FUNCTION CUSTOM_FUNCTION compiled

ALTER PROFILE DEFAULT LIMIT PASSWORD_VERIFY_FUNCTION custom_function;
-- profile DEFAULT altered.

CREATE USER stackoverflowexample IDENTIFIED BY easy;
-- SQL Error: ORA-28003: password verification for the specified password failed

CREATE USER stackoverflowexample IDENTIFIED BY easy567890;
-- user STACKOVERFLOWEXAMPLE created.