Working...... Error in password verification for APPS

[Aejaz Ahmad]

Hello Erman,

We have recently upgrade our application from 12.2.9 to 12.2.14 and we have implemented  apex24 with ords 24.3. everything is working fine. now we got request to clone the prod to stage, after stage clone completed login and evething working fine. we now tried to change password for apps with FNDCPASS . also password for apps completed sucessfully and autoconfig and othe steps all are done properly,

Now our front sysadmin login is not working , and when we try to change sysadmin password or any password with FNDCPASS we get below error
Working......

Error in password verification for APPS

According to oracle this is bug and they provided patch for this bug . now while applying patch adop phase=prepare . i get error as below ,

cannot complete application logon you may have entered an invalid application passwords , or there may have been a database connect error. internal manager status could not be determined

This is happening because adop connects application and submits program for online patching , please suggets if we can do anything to this suitation .

Thanks
Aejaz

[ErmanArslansOracleBlog]

Follow MOS Note -> ADOP Prepare Phase Fails With <Error determining status of Internal Concurrent Manager , KB625894 and see whether you can proceed with patching.

If you can't solve it even after following the note above, send me the patch# of the patch that you are trying to apply.

[Aejaz Ahmad]

hello,
I have verified the note and found  The error is same for me also .but my APPLSYSPUB is open and i am able to login with APPLSYSPUB user. there is no invalid objects non of the account is expired .


 Patch number [38207032 FND and AD fixes for APEX Schema user integration (Patch)]

$FND_TOP/bin/FNDSVCRG STATUS

Cannot complete applications logon. You may have entered an invalid applications password, or there may have been a database connect error.
Internal Concurrent Manager status could not be determined.

Also:

$ adcmctl.sh status <apps_user>/<apps_password>

You are running adcmctl.sh version 120.19.12020000.7

Cannot complete applications logon. You may have entered an invalid applications password, or
there may have been a database connect error.

Internal Concurrent Manager status could not be determined.

adcmctl.sh: exiting with status 0

Thanks
Aejaz

[Aejaz Ahmad]

+---------------------------------------------------------------------------+
Application Object Library: Version : 12.2

Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.

FNDCPASS:
+---------------------------------------------------------------------------+

Current system time is 05-FEB-2026 11:25:08

+---------------------------------------------------------------------------+

Arguments
 
   FNDCPASS system/***** USER sysadmin *****
+----------------------------------------------------------------------------+
Working...
Error in password verification for APPS

+---------------------------------------------------------------------------+
Concurrent request completed
Current system time is 05-FEB-2026 11:25:09

+---------------------------------------------------------------------------+

[ErmanArslansOracleBlog]

Did you check the following community thread? There a patch is suggested.. Please review it ! ->

https://forums.oracle.com/ords/apexds/post/after-applying-r12-atg-pf-c-delta-12-we-are-getting-cannot-5462

Also review the following blog post -> https://promatis.com/at/en/first-experience-with-e-business-suite-12-2-13-ecc-v11-upgrade/

[Aejaz Ahmad]

Hello .

Solution B: If you're already screwed up
If your instance is already patched and “now broken” you can probably file a SR and mention that you’re running into the bug 36040277; the dev team can then provide you a temporary package that allows to change the APPS Password and thus repair the instance / the Vault.

This is our status . we are already screwed .

I can do re-clone of my staging system , but i want to make sure oracle has some answers to this issue.

Oracle support is not good now a days .

Once  i will get some answer i will update here as well .


Thanks
Aejaz

[Aejaz Ahmad]

Hello,

This note looks like it will resolve the issue but i am unable to find the patch .

issue resolved after applying Oracle suggested patch as per Note 3057946.1

if you can verify from your side ,

Thanks
Aejaz

[ErmanArslansOracleBlog]

Okay. That patch is from one of the references that I sent to you.

Patch analysis:

Bugs Resolved by this Patch
 -------------
35814348
FND_VAULT UPGRADE BLEEDS INTO RUN EDITION FOR NON-EDTION TABLES
36250516
12.2.13 RUP FAILED WITH ERROR ORA-06512: AT APPS.FND_VAULT
36324608
FND_VAULT DATA FIX
36842768
INTERNAL BUG ATG-DEV FND_VAULT

Issue appears in FND_VAULT execution
--------------

ORA-06502: PL/SQL: numeric or value error
ORA-06512: at "APPS.FND_VAULT", line 286
ORA-06512: at "APPS.FND_VAULT", line 259
ORA-06512: at "APPS.FND_VAULT", line 2122
ORA-06512: at "APPS.FND_VAULT", line 2152
ORA-06512: at line 141

Cause:  FND_VAULT table contains inconsistent or invalid data, such as plain text values instead of the expected RAW format.


****** ! Aejaz, Can you check your FND_VAULT table. Do you see any strange data present there _ (such as plain text values instead of RAW format)?

[ErmanArslansOracleBlog]

If you could trace your login issues, you could maybe see the FND_VAULT is failing in the backend..

For instance; in the following note, the same patch is also recommended;

Login Doesn't Work After R12.ATG_PF.C.delta.12 (34776645) Patch And GUEST Password Change, KB291738

Here the note says - > On EBS 12.2 version Login doesn't work after R12.ATG_PF.C.delta.12 (34776645) patch and a GUEST password change. The customer has applied patch 34776645 along with the latest AD and TXK patches. They also changed GUEST password, then they can't login to the applications.
fnd_web_sec.validate_login returns Y for the new GUEST password.
Response in Google Chrome tracing suggest that the application may still be using the old GUEST password which is invalid.
If they change to the old GUEST password, they can login fine, but Forms do not launch.
They tried clearing tmp and cache dir as mentioned in the Doc ID 3013989.1, but it did not help.

So, that patch is a cure for login issues.. There we see.

[ErmanArslansOracleBlog]

Also see the following ->

https://ebs-dba.com/wp/blog/2025/07/20/12-2-14-changing-passwords-and-extending-ebs-with-apex-a-critical-warning/

There is also a reference to that patch in the article above.

And see this MOS note -> Unable To Change Password With Hard To Guess Profile, KB320427

There Oracle says:

1. Please download and review the readme for <Patch 36961988:R12.FND.C> AFTER PATCH 36857308 : AFPASSWD AND FNDCPASS ALLOWING SPECIAL CHARACTERS IN APPS PASSWORD
2. Please apply <Patch 36961988:R12.FND.C> in a Test environment initially before application to any Production instance.
3. Please retest the issue.
4. If the issue is resolved, please migrate the solution as appropriate to other environments.

[ErmanArslansOracleBlog]

So, I would trace the issue and see that the fnd_vault is broken to be sure about it, but in any case, the patch seems promising.. I would patch my environment with it -in the finale..

[Aejaz Ahmad]

Hello Erman,

This is the first post which i saw and found that there is some problem.

This update did not work for me .

UPDATE FND_ORACLE_USERID
   SET READ_ONLY_FLAG='A'
 WHERE READ_ONLY_FLAG='K';

Now oracle has raised bug with development team .Bug 38941933 - ERROR IN PASSWORD VERIFICATION FOR APPS

I will see and wait for them . Actually Problem is i cant apply any patch also i need some temp fix to move forward. its like a deadlock .

Thanks for your update ,

Regards
Aejaz

[Aejaz Ahmad]

FND_VAULT is package and package body and its valid . there is nothing like FND_VAULT Table. FND_VAULT_DATA which has 0 rows .

[ErmanArslansOracleBlog]

That statement is given in MOS: "Applying 12.2.13 RUP(34776655) Failed With ORA-06512: AT APPS.FND_VAULT" -> "The issue is encountered in environments where the FND_VAULT table contains inconsistent or invalid data, such as plain text values instead of the expected RAW format."

So, FND_VAULT_KEYMASTER and FND_VAULT_DATA tables are in the play.

In the patch, we have a datafix -> 36324608 FND_VAULT DATA FIX

That fix is however applicable in cases where you have FND_VAULT initialization problems.

If you have FND_VAULT related corruption, you should see them in the some of logs at least.

Note  ORA-20001: Please Review FND_VAULT.INITIALIZE Output Before Continuing -> says :

"Manually run the script from the patch 36842768:R12.FND.C
In 12.2.13 we discovered a data corruption issue with FND_Vault, the script looks for the indicators of this corruption and fixes known issues.
In this case this is not a known entry for us so we need to verify with the data owner (ISG) if this is simple ASCII data or is it raw binary data.
If this is a simple text password string we can fix the corruption with the script supplied by the patch 36842768:R12.FND.C"

Scripts are under -> p36842768_R12.FND.C_R12_GENERIC (1).zip\36842768\fnd\patch\115\sql but! this is risky. You should know what you are doing.

Anyways, please review the logs and try to find some clues ( clues about the FND_VAULT.initilize or other clues unrelated to that..) In any case, I would consider applying this patch.

[Aejaz Ahmad]

Yes there is one script which some community members have run but its not our issue. after our apex we found this issue . oracle development team is working lets see what they can provide , below is this datafix but i dont want to take risk.



REM $Header: bug36324608.sql 120.0.12020000.2 2024/04/17 22:10:01 emiranda noship $
REM *=======================================================================+
REM |  Copyright (c) 2024, 2024 Oracle Corporation Redwood Shores, California, USA|
REM |                            All rights reserved.                       |
REM +=======================================================================+
REM | FILENAME                                                              |
REM |   bug36324608.sql                                                     |
REM |                                                                       |
REM | DESCRIPTION                                                           |
REM |   **** INTERNAL USE ONLY ****                                         |
REM |   DO NOT RUN THIS SCRIPT UNLESS YOU MEET THE FOLLOWING CONDITIONS.    |
REM |    1. Bug 36324608 - the script AFVLTPCY.sql reports issues with      |
REM |       some entries. If there is no issue reported, running this       |
REM |       script is not needed.                                           |
REM |    2. You have contacted Oracle E-Business Suite Support              |
REM |       Representative and Oracle E-Business Suite Development has      |
REM |       recommended running this script.                                |
REM |                                                                       |
REM | NOTES                                                                 |
REM |   syntax:                                                             |
REM |     sqlplus <appsuser>/<appspwd> @ bug36324608.sql \                  |
REM |              <Service-Name> <Variable-Name>                           |
REM |                                                                       |
REM *=======================================================================*
REM dbdrv: none

WHENEVER SQLERROR EXIT FAILURE ROLLBACK;
WHENEVER OSERROR EXIT FAILURE ROLLBACK;
SET VERIFY OFF
SET SERVEROUTPUT ON SIZE 10000
declare
  l_sec_module   FND_USER_PREFERENCES.MODULE_NAME%type := '&1';
  l_sec_variable FND_USER_PREFERENCES.PREFERENCE_NAME%type := '&2';
  l_msg varchar2(4000);
begin
  l_msg := null;
  dbms_output.put_line('.');
  dbms_output.put_line('. Start => Date/time: ' || TO_CHAR(SYSDATE, 'MON-DD-YYYY / HH24:MI:SS'));
  dbms_output.put_line('. .. Fix Fnd_vault entry: [ ' || l_sec_module ||
          ' , '|| l_sec_variable ||' ]');
  fnd_vault.initialize( l_sec_module, l_sec_variable );
  l_msg := fnd_message.get;
  dbms_output.put_line('. .. .. Message: '|| l_msg);
  commit;
  dbms_output.put_line('. End => Date/time: ' || TO_CHAR(SYSDATE, 'MON-DD-YYYY / HH24:MI:SS'));
  dbms_output.put_line('.');
end;
/
exit;

[ErmanArslansOracleBlog]

After apex? In your first update, you wrote "we configured apex & ords and everything working fine."  

Does this problem appear in PROD or is it only in the newly cloned Stage? If it is on the newly clone Stage, is there a way for re-doing the apex & ords related tasks?

Also ask Oracle development to review the suggested patch (as per Note 3057946.1) for your case.

[Aejaz Ahmad]

Yes , We have configured Apex and ords on PROD system . we tested all things are working fine in prod .

1 month back we upgraded our application to 12.2.14 and We got some issue after 12.2.14 upgrade so payroll team said we want fresh clone which i took and completed the clone , till now i did not change apps password after clone. i verified application started properly and verification  etc done . now i need to change the password on clone system when i did FNDCPASS apps password change its changed the apps password and i ran autoconfig and changed WLS connection  also , when i opened the login sysadmin password showing login failed . i though sysadmin password is wrong i changed via FNDCPASS there i got the "Error in password verification for APPS" .

After that i was not able to login with any user .

since i have issue with payrol team they need quick clone to replicate , i deleted clone and restore fresh backup of prod again . this time i configured clone and did not change apps password or any FNDCPASS password . payrol team did testing and all. now i am free to test what i was facing .

i repeated the same case changed again password via FNDCPASS for apps and again password  was changed normally. now i  again try to change password of XXUSER same error Error in password verification for APPS.

but no i am able to login, but forms are showing "cannot complete login invalid user name and password .

then i raised issue with oracle , oracle provided patch and adop phase=prepare gave same error cannot login username password invalid .

In final i think the issue is in our prod , i am not touching prod until i will find out the solution on staging .

i will not run FNDCPASS on production system until i have complete solution .

This is the issue .

Thanks
Aejaz

[ErmanArslansOracleBlog]

Okay then there is a seed in the system and it exploits this when you run FNDCPASS. Maybe your PROD is infected as well.. (as you said)

Patch is still promising in my opinion.

The cause maybe in the FND_ORACLE_USERID table as well..
Check the records in that table.
The setting of READ_ONLY_FLAG values...

[Aejaz Ahmad]

Read_only_flag is fine there was read only flag 'K' for apex users only

APPS -- U
APPLSYS  -E

APPLSYSPUB -- C

[ErmanArslansOracleBlog]

**It is strange that in your case, the first run of FNDCPASS successfully completes but it breaks the system down.. Logins fails, the subsequent FNDCPASS fail and so on.. So it is the FNDCPASS or something inside the database ( FND_ORACLE_USERID  ) makes it break the system..

Seems like the FNDCPASS or FND_ORACLE_USERID is guilty here. The field /column ENCRYPTED_ORACLE_PASSWORD may be the key here.. The data in it may be broken..

I just share this with you and hope that it will shed some light on the issue and help you find the solution or workaround, but! I m not connected to your instance, that's why I can not be more specific than this.  Follow your SR in parallel

Additional resources:

Retrying the password change (or the first - problem-free password change with AFPASSWD)
-----------------------------------------------
You followed the MOS note below for changing the password right?
-> How to Change Applications Passwords Using Applications Schema Password Change Utility (FNDCPASS or AFPASSWD) - KB300345
What about AFPASSWD? Why not you give it a try?
Don't forget to execute the steps documented under the subsection named -> "For 12.2 only:"

Check the following thread -- just in case
-----------------------------------------------
http://erman-arslan-s-oracle-forum.124.s1.nabble.com/sysadmin-cannot-connect-td10260.html

Review -> FNDCPASS Troubleshooting Guide For Login and Changing Applications Passwords, KB301994