How-toOracle E-Business SuiteSystem Administration / Security

How to change the APPS password in Oracle EBS with FNDCPASS

Question

How to change the APPS password in Oracle EBS using FNDCPASS

Also searched as

FNDCPASS syntax APPLSYS SYSADMIN USER
change APPS password R12.2 AFPASSWD
reset SYSADMIN password oracle apps
FNDCPASS ORACLE schema password change GL

Short answer

Use FNDCPASS with the APPLSYS mode to change the APPLSYS and APPS passwords together, ORACLE mode for a product schema such as GL, and USER mode for a front-end user such as SYSADMIN. In R12.2 the APPS change must also be applied to the WebLogic data sources, or the application tier cannot connect.

Applies to: Oracle E-Business Suite 11i, R12.1 and R12.2 (R12.2 has extra steps for WebLogic and the adop file systems)

Change the APPS password safely

1Schedule downtime and tell users: all services connect as APPS, so a mismatch stops everything.
2Stop the application tier services, or at least concurrent managers and OACore, so no process holds the old password.
3Back up the FND_ORACLE_USERID and FND_USER data and note the current passwords in your secure vault.
4On the application tier, run FNDCPASS apps/<oldpwd> 0 Y system/<systempwd> SYSTEM APPLSYS <newpwd>.
5Update the new password in the places that store it, which in R12.2 includes the WebLogic data source configuration for the EBS domain.
6Start the services, then test a login, a form that opens, and a concurrent request that completes.
7Record the change and confirm any external integrations that use the APPS account are updated.

The four FNDCPASS modes

FNDCPASS takes the connect string for APPS, the 0 and Y flags, then a second login and a mode. SYSTEM mode is used with the DBA login system/<pwd>. In APPLSYS mode it changes the APPLSYS password and also the APPS password, because APPS is tied to APPLSYS in the Applications password scheme. ORACLE mode changes one product schema password, for example GL or AP, and USER mode changes an application user password such as SYSADMIN.

Changing only APPS directly in the database with ALTER USER leaves FND_ORACLE_USERID out of sync and breaks the product schema password lookups. Always use FNDCPASS or the supported utility for the version you run.

Passwords are validated against the database password profile, so a password that violates the profile can fail the whole change. Pick one that meets the complexity rules and avoids characters that the shell treats specially.

FNDCPASS apps/<pwd> 0 Y system/<systempwd> SYSTEM APPLSYS <newpwd>

FNDCPASS apps/<pwd> 0 Y system/<systempwd> ORACLE GL <newpwd>

FNDCPASS apps/<pwd> 0 Y USER SYSADMIN <newpwd>

R12.2 specifics: WebLogic data source and AFPASSWD

R12.2 adds a WebLogic tier. The EBS domain has JDBC data sources that store the APPS password, so after FNDCPASS you must update those data sources. Oracle's documented approach uses the Oracle WebLogic administration console or the supported scripts in the Oracle E-Business Suite documentation for the release, followed by a restart of the managed servers.

R12.2 also provides AFPASSWD as the supported utility to change passwords, including support for the multi-tier case where the password must be changed consistently. Use the method named in the current Oracle note for your patch level, and follow the order exactly.

Because R12.2 has two file systems for online patching, check that nothing in the patch file system is holding connections open during the change, and do not change passwords during an active adop cycle.

Resetting a user password

To reset SYSADMIN or another user whose password is lost, FNDCPASS USER mode changes the password directly and works even if the user form is not reachable. When you can still log in as an administrator, the Users form under Security > User > Define lets you set a new password and require a change on next login by clearing the password expiry fields.

The user-facing rules come from profile options such as Signon Password Length and Signon Password Hard To Guess, plus the Password Lifespan Days setting. A reset that is rejected is usually breaking one of these rules.

Do not share the SYSADMIN password between people. Create named administrator accounts with the System Administrator responsibility and keep SYSADMIN for emergencies.

SELECT user_name, start_date, end_date, password_lifespan_days FROM apps.fnd_user WHERE user_name = 'SYSADMIN';

Where else the APPS password lives

Even after a clean FNDCPASS run, other components may hold the old password. Typical places are database links from other databases, custom scripts and cron jobs, BI or reporting tools that connect directly, integration middleware, and wallet or credential stores.

Search your deployment repositories and scheduler definitions for the APPS account before the change. Anything found should move to a service account with only the privileges it needs, rather than continuing to use APPS.

After the change, check the alert log and the Apache and WebLogic logs for ORA-01017 invalid username or password messages, which show which component still has the old value.

Try it here, free

Oracle EBS FND_USER_PKG Script Generator (Create User, Add Responsibility, Reset Password)

Open full tool

Generates four FND_USER_PKG blocks for Oracle EBS R12 (CREATEUSER, ADDRESP, CHANGEPASSWORD, DELRESP) plus SQL to verify the user and responsibility rows.

Fill in

User name

Initial / new password

Must meet your SIGNON_PASSWORD_LENGTH, SIGNON_PASSWORD_HARD_TO_GUESS and related profile rules.

Email address

Employee PERSON_ID (or NULL)

PER_ALL_PEOPLE_F.PERSON_ID, unquoted. Leave NULL for non-employees.

Start date

Responsibility application short name

Responsibility key

FND_RESPONSIBILITY.RESPONSIBILITY_KEY, not the display name.

Security group key

Assignment description

End date for removal (Block 4)

Used only in the commented ADDRESP call in Block 4 for a future end date; DELRESP itself end-dates as of today.

Generated code

Free, optional. Reopen it on any device.

Download:

Block 1: create the user

BEGIN
  FND_USER_PKG.CREATEUSER(
    x_user_name            => UPPER('JSMITH'),
    x_owner                => NULL,
    x_unencrypted_password => 'Welcome#2026',
    x_start_date           => TO_DATE('2026-10-22', 'YYYY-MM-DD'),
    x_email_address        => 'jsmith@example.com',
    x_employee_id          => NULL);
  COMMIT;
END;
/

Block 2: add a responsibility

BEGIN
  FND_USER_PKG.ADDRESP(
    username       => UPPER('JSMITH'),
    resp_app       => 'INV',
    resp_key       => 'XX_INV_INQUIRY',
    security_group => 'STANDARD',
    description    => 'Added by script, ticket CHG-1042',
    start_date     => TO_DATE('2026-10-22', 'YYYY-MM-DD'),
    end_date       => NULL);
  COMMIT;
END;
/

Block 3: reset the password

SET SERVEROUTPUT ON
DECLARE
  l_ok BOOLEAN;
BEGIN
  l_ok := FND_USER_PKG.CHANGEPASSWORD(
            username    => UPPER('JSMITH'),
            newpassword => 'Welcome#2026');
  IF l_ok THEN
    COMMIT;
    DBMS_OUTPUT.PUT_LINE('Password changed');
  ELSE
    ROLLBACK;
    DBMS_OUTPUT.PUT_LINE('Password change failed: ' || FND_MESSAGE.GET);
  END IF;
END;
/

Block 4: end-date a responsibility

-- DELRESP end-dates the assignment (it does not delete the row)
BEGIN
  FND_USER_PKG.DELRESP(
    username       => UPPER('JSMITH'),
    resp_app       => 'INV',
    resp_key       => 'XX_INV_INQUIRY',
    security_group => 'STANDARD');
  COMMIT;
END;
/

-- To end-date on a future date (2026-12-31) instead, call ADDRESP again with end_date set:
-- FND_USER_PKG.ADDRESP(username => UPPER('JSMITH'), resp_app => 'INV', resp_key => 'XX_INV_INQUIRY',
--   security_group => 'STANDARD', description => 'Added by script, ticket CHG-1042',
--   start_date => TO_DATE('2026-10-22', 'YYYY-MM-DD'), end_date => TO_DATE('2026-12-31', 'YYYY-MM-DD'));

Verification SQL

SELECT u.user_id, u.user_name, u.start_date, u.end_date, u.email_address,
       u.employee_id, u.password_date, u.last_logon_date
FROM   fnd_user u
WHERE  u.user_name = UPPER('JSMITH');

SELECT u.user_name, r.responsibility_key, r.responsibility_name,
       d.start_date, d.end_date
FROM   fnd_user_resp_groups_direct d
JOIN   fnd_user u
       ON u.user_id = d.user_id
JOIN   fnd_responsibility_vl r
       ON  r.responsibility_id = d.responsibility_id
       AND r.application_id    = d.responsibility_application_id
WHERE  u.user_name = UPPER('JSMITH')
ORDER  BY r.responsibility_name;

Run as APPS in a session that is not inside a running request. Confirm parameter names with SELECT object_name, argument_name, position FROM all_arguments WHERE owner = 'APPS' AND package_name = 'FND_USER_PKG' AND object_name IN ('CREATEUSER','ADDRESP','CHANGEPASSWORD','DELRESP'). Whether the user is forced to change the password at next login depends on PASSWORD_DATE; check it with the verification SQL rather than assuming.

Script your joiner-mover-leaver process

Send us your access request form; we map it to FND_USER_PKG calls with approvals and an audit trail for your instance.

Optional. The tool and every export work without this. No spam.

Common pitfalls

!Changing APPS with ALTER USER instead of FNDCPASS, leaving FND_ORACLE_USERID out of sync.
!Skipping the WebLogic data source update in R12.2 so the application tier cannot connect.
!Changing the password during an active adop patching cycle.
!Using shell special characters in the password and having the command parsed incorrectly.
!Leaving custom scripts and integrations connecting as APPS with the old password.
!Not recording the old and new values in a vault before the change.

How an ERP-grounded AI assistant handles this

An assistant grounded in your EBS environment can list which users and database links reference the APPS account, show password profile settings and expiry for administrator users, and draft a change checklist for your release. It never needs the password itself and does not run FNDCPASS. The change stays a controlled human step.

See ERPray

Frequently asked questions

Does FNDCPASS APPLSYS change the APPS password too?

Yes. In APPLSYS mode it changes the APPLSYS password and the APPS password together, since they are linked in the Applications password scheme. After the change you must update every component that stores the APPS password.

Can I just use ALTER USER APPS IDENTIFIED BY?

No. That changes the database account but not the Applications records in FND_ORACLE_USERID, so the application cannot validate product schema passwords afterward. Use FNDCPASS, or AFPASSWD where your release supports it.

How do I recover a lost SYSADMIN password?

Run FNDCPASS in USER mode with the APPS login to set a new SYSADMIN password directly, then log in and create named administrator accounts. If you cannot run FNDCPASS, a DBA can use the supported database procedure for your release.

What breaks if I forget the data source in R12.2?

The managed servers keep trying the old password and the application tier fails to connect, so logins and forms stop working. The WebLogic logs show ORA-01017 errors. Update the data sources and restart the managed servers.

How-to

SQL to Find Responsibilities Assigned to a User in Oracle EBS

Join FND_USER to FND_USER_RESP_GROUPS on USER_ID, then to FND_RESPONSIBILITY_TL on RESPONSIBILITY_ID and APPLICATION_ID to get the responsibility name, filtering the END_DATE columns to show only currently active assignments. This is the standard query DBAs and support teams use instead of clicking through System Administrator > Security > User > Define for every user.

Advanced

How the adop Patching Cycle Works in Oracle EBS 12.2

adop, AD Online Patching, applies patches to the offline patch edition of the file system while users keep working on the current run edition, then switches editions in a short cutover window. A standard cycle runs prepare, apply, finalize, cutover and cleanup, each invoked as its own adop phase= command.

Error fix

Oracle EBS Concurrent Manager Will Not Start: How to Fix It

A concurrent manager that will not start in Oracle EBS is almost always one of three things: the node registered in FND_NODES no longer matches the actual hostname (common after cloning), stale OS processes are blocking a fresh start, or the database and listener the manager connects to are unreachable. Check the internal manager log, verify the node name, clear stale processes, and restart with adcmctl.sh.

How-to

How to use FNDLOAD to migrate lookups, profiles and menus between Oracle EBS instances

FNDLOAD is the command line utility that downloads AOL setup data into a flat .ldt file using a .lct configuration file, and uploads that file into another instance. The pattern is the same for every object: pick the correct .lct, download with the entity name, review the .ldt, then upload on the target as the APPS user.

Error fix

Fix FRM-40735: WHEN-VALIDATE-RECORD Trigger Raised Unhandled Exception ORA-06508

FRM-40735 with ORA-06508 almost always means a PL/SQL package used by the form was recompiled while your session still held the old cached state, or the trigger's own exception handling does not trap a real data error. Exit the form completely and re-enter it; if the error repeats for all users, recompile invalid objects on the database and check for a bad custom trigger.

Error fix

Fix Oracle EBS Workflow Notification Mailer Not Sending Emails

When EBS notifications stop reaching inboxes, check the mailer status in Oracle Applications Manager (OAM) Workflow Manager first - a Suspended or Error status almost always points at an SMTP or IMAP connectivity or credential problem introduced by a mail server change, not at Workflow itself. Fix the mail server configuration, restart the mailer component, and requeue the backlog.

AI for ERP

AI for Oracle E-Business Suite, Without Leaving On-Prem

Hosting Oracle EBS 12.2 on-prem or in a private cloud? Add a private LLM over concurrent programs, interface tables and AP/PO data without moving to Fusion.

AI for ERP

AI for Oracle EBS in Aerospace and Defense Manufacturing

AI on Oracle EBS for aerospace and defense manufacturers: project manufacturing, serial control, and ITAR segregation handled without a cloud dependency.

Stuck on Oracle E-Business Suite?

Talk to engineers who work inside Oracle E-Business Suite every week, and who build private AI that answers these questions from your own ERP data.

Talk to an ERP engineer Browse ERP Help

All ERP Help articles

ArchRay builder

Design the on-prem AI stack for Oracle E-Business Suite: model, GPUs, RAG pipeline, guardrails

See memory, speed and cost as you swap parts, then export the diagram. Free, in your browser.

Open the builder

New to Oracle E-Business Suite? Start with the Oracle E-Business Suite guide and toolkit, or plan with Oracle EBS Roadmap Planner, Training Path Builder, ERP Certification Study Planner.

Keep exploring

Free tools

ERP fixes and how-tos

Runs with your ERP

AI on your ERP

Integrations

Software

Oracle E-Business SuiteOracle E-Business Suite explained for manufacturers: modules, deployment, integration options, strengths, limits and alternatives to weigh before you commit.

TermsOracle EBS Concurrent Program

How to change the APPS password in Oracle EBS with FNDCPASS

Change the APPS password safely

The four FNDCPASS modes

R12.2 specifics: WebLogic data source and AFPASSWD

Resetting a user password

Where else the APPS password lives

Fill in

Block 1: create the user

Block 2: add a responsibility

Block 3: reset the password

Block 4: end-date a responsibility

Verification SQL

Script your joiner-mover-leaver process

Common pitfalls

How an ERP-grounded AI assistant handles this

Frequently asked questions

Related

SQL to Find Responsibilities Assigned to a User in Oracle EBS

How the adop Patching Cycle Works in Oracle EBS 12.2

Oracle EBS Concurrent Manager Will Not Start: How to Fix It

How to use FNDLOAD to migrate lookups, profiles and menus between Oracle EBS instances

Fix FRM-40735: WHEN-VALIDATE-RECORD Trigger Raised Unhandled Exception ORA-06508

Fix Oracle EBS Workflow Notification Mailer Not Sending Emails

AI for Oracle E-Business Suite, Without Leaving On-Prem

AI for Oracle EBS in Aerospace and Defense Manufacturing

Stuck on Oracle E-Business Suite?

Keep exploring

Free tools

ERP fixes and how-tos

Runs with your ERP

AI on your ERP

Integrations

Software

Fill in

Block 1: create the user

Block 2: add a responsibility

Block 3: reset the password

Block 4: end-date a responsibility

Verification SQL

Script your joiner-mover-leaver process