Oracle 11g: Default case-sensitive passwords

January 8, 2008 by Michael

ORA-01017: invalid username/password; logon denied

Yiipiee… Although i created my schema with the usually scripts we use, i got a logon denied… Switching context from Oracle Forms 6 to Reports 6… (Please, don’t say anything about legacy apps).

I didn’t notify that passwords are now case-sensitive in a Oracle database (which is a good thing), because of two reasons: I created the user via SQL*Plus and there is a environment variable called “sqlcase” that converts, if set to upper or lower, all SQL code to the according case. Bummer! Even quoted literals are converted… Stupid shit, i think. But in my case, this thing was set to mixed, so i ended up with a lower case password as with 11g “sec_case_sensitive_logon” is set to true as default:

SQL> SHOW parameter sec_case_sensitive_logon
NAME                     TYPE    VALUE
------------------------ ------- -----
sec_case_sensitive_logon BOOLEAN TRUE

Now with forms things are different, again. Forms runtime don’t convert the lowercase password in the connect string so i could log in but it converts the password to uppercase if you switch contexts to Reports runtime which couldn’t connect and ended up with the ORA-01017. Weird stuff, as everything else worked as expected, although Forms and Reports 6 are ages old compared to 11g.

In the end, i changed to user to a an uppercase password, so the password passed from Forms to reports is the right one. I didn’t set sec_case_sensitive_logon to false, as i think, its way better to have standard password handling and to me, this means case-sensitive and nothing else.

I found some valuable information on this topic in the following blog: Mark A. Williams :: Blog, didn’t know about that sqlcase shit before.

For more information see:

No comments yet

Post a Comment

Your email is never published. We need your name and email address only for verifying a legitimate comment. For more information, a copy of your saved data or a request to delete any data under this address, please send a short notice to from the address you used to comment on this entry.
By entering and submitting a comment, wether with or without name or email address, you'll agree that all data you have entered including your IP address will be checked and stored for a limited time by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110-4929, USA. only for the purpose of avoiding spam. You can deny further storage of your data by sending an email to, with subject “Deletion of Data stored by Akismet”.
Required fields are marked *