How-toOracle E-Business SuiteSystem Administration / Security

How to change the APPS password in Oracle EBS with FNDCPASS

Question
How to change the APPS password in Oracle EBS using FNDCPASS

Also searched as

  • FNDCPASS syntax APPLSYS SYSADMIN USER
  • change APPS password R12.2 AFPASSWD
  • reset SYSADMIN password oracle apps
  • FNDCPASS ORACLE schema password change GL

Short answer

Use FNDCPASS with the APPLSYS mode to change the APPLSYS and APPS passwords together, ORACLE mode for a product schema such as GL, and USER mode for a front-end user such as SYSADMIN. In R12.2 the APPS change must also be applied to the WebLogic data sources, or the application tier cannot connect.

Applies to: Oracle E-Business Suite 11i, R12.1 and R12.2 (R12.2 has extra steps for WebLogic and the adop file systems)

Change the APPS password safely

  1. 1Schedule downtime and tell users: all services connect as APPS, so a mismatch stops everything.
  2. 2Stop the application tier services, or at least concurrent managers and OACore, so no process holds the old password.
  3. 3Back up the FND_ORACLE_USERID and FND_USER data and note the current passwords in your secure vault.
  4. 4On the application tier, run FNDCPASS apps/<oldpwd> 0 Y system/<systempwd> SYSTEM APPLSYS <newpwd>.
  5. 5Update the new password in the places that store it, which in R12.2 includes the WebLogic data source configuration for the EBS domain.
  6. 6Start the services, then test a login, a form that opens, and a concurrent request that completes.
  7. 7Record the change and confirm any external integrations that use the APPS account are updated.

The four FNDCPASS modes

FNDCPASS takes the connect string for APPS, the 0 and Y flags, then a second login and a mode. SYSTEM mode is used with the DBA login system/<pwd>. In APPLSYS mode it changes the APPLSYS password and also the APPS password, because APPS is tied to APPLSYS in the Applications password scheme. ORACLE mode changes one product schema password, for example GL or AP, and USER mode changes an application user password such as SYSADMIN.

Changing only APPS directly in the database with ALTER USER leaves FND_ORACLE_USERID out of sync and breaks the product schema password lookups. Always use FNDCPASS or the supported utility for the version you run.

Passwords are validated against the database password profile, so a password that violates the profile can fail the whole change. Pick one that meets the complexity rules and avoids characters that the shell treats specially.

FNDCPASS apps/<pwd> 0 Y system/<systempwd> SYSTEM APPLSYS <newpwd>
FNDCPASS apps/<pwd> 0 Y system/<systempwd> ORACLE GL <newpwd>
FNDCPASS apps/<pwd> 0 Y USER SYSADMIN <newpwd>

R12.2 specifics: WebLogic data source and AFPASSWD

R12.2 adds a WebLogic tier. The EBS domain has JDBC data sources that store the APPS password, so after FNDCPASS you must update those data sources. Oracle's documented approach uses the Oracle WebLogic administration console or the supported scripts in the Oracle E-Business Suite documentation for the release, followed by a restart of the managed servers.

R12.2 also provides AFPASSWD as the supported utility to change passwords, including support for the multi-tier case where the password must be changed consistently. Use the method named in the current Oracle note for your patch level, and follow the order exactly.

Because R12.2 has two file systems for online patching, check that nothing in the patch file system is holding connections open during the change, and do not change passwords during an active adop cycle.

Resetting a user password

To reset SYSADMIN or another user whose password is lost, FNDCPASS USER mode changes the password directly and works even if the user form is not reachable. When you can still log in as an administrator, the Users form under Security > User > Define lets you set a new password and require a change on next login by clearing the password expiry fields.

The user-facing rules come from profile options such as Signon Password Length and Signon Password Hard To Guess, plus the Password Lifespan Days setting. A reset that is rejected is usually breaking one of these rules.

Do not share the SYSADMIN password between people. Create named administrator accounts with the System Administrator responsibility and keep SYSADMIN for emergencies.

SELECT user_name, start_date, end_date, password_lifespan_days FROM apps.fnd_user WHERE user_name = 'SYSADMIN';

Where else the APPS password lives

Even after a clean FNDCPASS run, other components may hold the old password. Typical places are database links from other databases, custom scripts and cron jobs, BI or reporting tools that connect directly, integration middleware, and wallet or credential stores.

Search your deployment repositories and scheduler definitions for the APPS account before the change. Anything found should move to a service account with only the privileges it needs, rather than continuing to use APPS.

After the change, check the alert log and the Apache and WebLogic logs for ORA-01017 invalid username or password messages, which show which component still has the old value.

Common pitfalls

  • !Changing APPS with ALTER USER instead of FNDCPASS, leaving FND_ORACLE_USERID out of sync.
  • !Skipping the WebLogic data source update in R12.2 so the application tier cannot connect.
  • !Changing the password during an active adop patching cycle.
  • !Using shell special characters in the password and having the command parsed incorrectly.
  • !Leaving custom scripts and integrations connecting as APPS with the old password.
  • !Not recording the old and new values in a vault before the change.

How an ERP-grounded AI assistant handles this

An assistant grounded in your EBS environment can list which users and database links reference the APPS account, show password profile settings and expiry for administrator users, and draft a change checklist for your release. It never needs the password itself and does not run FNDCPASS. The change stays a controlled human step.

See ERPray

Frequently asked questions

Does FNDCPASS APPLSYS change the APPS password too?

Yes. In APPLSYS mode it changes the APPLSYS password and the APPS password together, since they are linked in the Applications password scheme. After the change you must update every component that stores the APPS password.

Can I just use ALTER USER APPS IDENTIFIED BY?

No. That changes the database account but not the Applications records in FND_ORACLE_USERID, so the application cannot validate product schema passwords afterward. Use FNDCPASS, or AFPASSWD where your release supports it.

How do I recover a lost SYSADMIN password?

Run FNDCPASS in USER mode with the APPS login to set a new SYSADMIN password directly, then log in and create named administrator accounts. If you cannot run FNDCPASS, a DBA can use the supported database procedure for your release.

What breaks if I forget the data source in R12.2?

The managed servers keep trying the old password and the application tier fails to connect, so logins and forms stop working. The WebLogic logs show ORA-01017 errors. Update the data sources and restart the managed servers.

Related

How-to

SQL to Find Responsibilities Assigned to a User in Oracle EBS

Join FND_USER to FND_USER_RESP_GROUPS on USER_ID, then to FND_RESPONSIBILITY_TL on RESPONSIBILITY_ID and APPLICATION_ID to get the responsibility name, filtering the END_DATE columns to show only currently active assignments. This is the standard query DBAs and support teams use instead of clicking through System Administrator > Security > User > Define for every user.

Advanced

How the adop Patching Cycle Works in Oracle EBS 12.2

adop, AD Online Patching, applies patches to the offline patch edition of the file system while users keep working on the current run edition, then switches editions in a short cutover window. A standard cycle runs prepare, apply, finalize, cutover and cleanup, each invoked as its own adop phase= command.

Error fix

Oracle EBS Concurrent Manager Will Not Start: How to Fix It

A concurrent manager that will not start in Oracle EBS is almost always one of three things: the node registered in FND_NODES no longer matches the actual hostname (common after cloning), stale OS processes are blocking a fresh start, or the database and listener the manager connects to are unreachable. Check the internal manager log, verify the node name, clear stale processes, and restart with adcmctl.sh.

How-to

How to use FNDLOAD to migrate lookups, profiles and menus between Oracle EBS instances

FNDLOAD is the command line utility that downloads AOL setup data into a flat .ldt file using a .lct configuration file, and uploads that file into another instance. The pattern is the same for every object: pick the correct .lct, download with the entity name, review the .ldt, then upload on the target as the APPS user.

Error fix

Fix FRM-40735: WHEN-VALIDATE-RECORD Trigger Raised Unhandled Exception ORA-06508

FRM-40735 with ORA-06508 almost always means a PL/SQL package used by the form was recompiled while your session still held the old cached state, or the trigger's own exception handling does not trap a real data error. Exit the form completely and re-enter it; if the error repeats for all users, recompile invalid objects on the database and check for a bad custom trigger.

Error fix

Fix Oracle EBS Workflow Notification Mailer Not Sending Emails

When EBS notifications stop reaching inboxes, check the mailer status in Oracle Applications Manager (OAM) Workflow Manager first - a Suspended or Error status almost always points at an SMTP or IMAP connectivity or credential problem introduced by a mail server change, not at Workflow itself. Fix the mail server configuration, restart the mailer component, and requeue the backlog.

AI for ERP

AI for Oracle E-Business Suite, Without Leaving On-Prem

Add AI to Oracle E-Business Suite 12.2 without moving off-prem. Query concurrent programs, interface tables, and AP/PO data with a private LLM. See how.

AI for ERP

AI for Oracle EBS in Aerospace and Defense Manufacturing

AI on Oracle EBS for aerospace and defense manufacturers: project manufacturing, serial control, and ITAR segregation handled without a cloud dependency.

Stuck on Oracle E-Business Suite?

Talk to engineers who work inside Oracle E-Business Suite every week, and who build private AI that answers these questions from your own ERP data.

Talk to an ERP engineerBrowse ERP Help
All ERP Help articles