Hello Forum Members,

I am experiencing very interesting problem in my ASP.NET application when I am changing the user password in ORACLE database using "ALTER USER..." command from inside of my code.
Example:
The user "TestUserName" has the current password, let's say "User1".
After I change the password to "User2", I can login into my application with the OLD and with the NEW passwords by some reason?
If I check the password for the current "TestUserName" in the database, it has the newest value ("User2"). From the SQLPlus I can login into the database only with the newest password. But from my application I can still login using both passwords? If I close the application, close the browser and start the application again, I still can login using two passwords. But, if I restart the PC, the old password disappeared. What is going on?

Any suggestions?

Thanks in advance,
-Dmitriy

What do you mean the "old password disappeared"?

-------------------------
I will only tell you how to do it, not do it for you.
Unless, of course, you want to hire me to do work for you.

^^Thats my signature

The "old password disappeared" means I can use only the newest password "User2" after the PC has been restarted. The password "User1" does not work anymore.

In your example, TestUserName, is this a user who is logged into a forum or the username embeded in your query string used to access the database?

-------------------------
I will only tell you how to do it, not do it for you.
Unless, of course, you want to hire me to do work for you.

^^Thats my signature

In my example the "TestUserName" is the value of the variable sUserId I place into the command string. This is the fragment from the code I am using:

 'Begin Transaction here:
                objTransaction = CType(wsDataBasesService.GetMERCURYConnection(), OracleConnection).BeginTransaction()

                sUserId = Trim(txtUserID.Text)
                sPassword = Trim(txtPasswordAgain.Text)

                sCommandText = "ALTER USER " & sUserId & " IDENTIFIED BY " & sPassword & ""
                cmd = New OracleCommand("", CType(wsDataBasesService.GetMERCURYConnection(), OracleConnection))
                cmd.CommandType = CommandType.Text
                cmd.CommandText = sCommandText
                cmd.ExecuteNonQuery()
                ''cmd.Transaction = objTransaction
                cmd.Dispose()
                cmd = Nothing

                'Commit transaction and dispose:
                objTransaction.Commit()
                objTransaction.Dispose()
                objTransaction = Nothing

It doesn't make sense to me since the value for oracle is persisted on that server and it should kick out any attempt to login with an incorrect username and password. Since restarting the PC is the only thing that works, it seems like something is being persisted until you restart the machine, a cookie maybe. In any case there is no reason why this should be happening.

-------------------------
I will only tell you how to do it, not do it for you.
Unless, of course, you want to hire me to do work for you.

^^Thats my signature