Gradual Database Password Rollover for Applications
You are not getting downtime for your business-critical or customer-facing application and you still need to change the password for the SoX compliance? so here is the solution, change database passwords without downtime!
Starting from Oracle Database 21c, we can change the database password without any application downtime.
To explain this new feature, let's consider a simple application running on 3 nodes and load balanced using software of hardware load balancer.
Typically, in a normal scenario, if you have to change the database schema password, you need to bringdown application services from all 3 app nodes, change the password in the database, change the config password in app nodes (or vault) and start the application services in all 3 app nodes.
Now, you don't need downtime of the application - here is how you can do it.
1) DBA need to associate a profile having a non-zero limit for the PASSWORD_ROLLOVER_TIME password profile parameter, with an application schema. That means, when you are changing the password, your old and new password will be active for the specified time in PASSWORD_ROLLOVER_TIME.
2) Change the config file in all 3 App nodes or vault. Till now, the application will use the old password.
3) Restart the App nodes one by one (There will not be any downtime to colleagues as, at any point of time during the restart of app services, the remaining least 2 nodes will be serving the requests), once the application is restarted, it will pick up the new password.
Please note that when the rollover time is expired, the old password can not be used. That means, we have to complete all the above 3 steps within the time mentioned in PASSWORD_ROLLOVER_TIME.
So, to conclude, you can adhere to SoX compliance requirements and also keep your business-critical or customer-facing application up and running!
