title: ALTER USER x identified by y replace z, only permission?
body: <p><strong>Background</strong></p>
  
  <p>We have a web-application which logs into an Oracle database as a generic application user, however for historical reasons we have all of our user-users stored as Oracle database users (we authenticate against the Oracle database to log them onto the web-application). We have other, Oracle Forms, applications which use the database user more directly (they cannot be removed).      </p>
  
  <p>I am trying to allow users to change their own password via the web-application generic-user. </p>
  
  <p><strong>Question</strong></p>
  
  <p>How do I grant the web-application generic user the ability to alter specific user's passwords without granting it the ability to alter super-users' passwords? If someone stole the web-application's credentials somehow we want damage limitation.     </p>
  
  <p>The Oracle Database kind of supports this via the:    </p>
  
  <pre><code> alter user user123 identified by new_password123 replace old_password123;   
  </code></pre>
  
  <p>Which would work great for our purposes as we ask users for their old password when altering it to a new password. </p>
  
  <p>However with or without the "replace" syntax we need to grant the same permission, "alter user," which grants that generic web-application user far too much power (e.g. change ANY user's password, even without knowing the old one).   </p>
  
  <p>So is there some way of setting permissions up so you can change any password you want but ONLY if you know the old password?     </p>