SQL> conn iombase/dwf93$6U
Connected.
SQL> ALTER USER IOMBASE IDENTIFIED BY nbipS5$r;
ALTER USER IOMBASE IDENTIFIED BY nbipS5$r
*
ERROR at line 1:
ORA-28221: REPLACE not specified

$ oerr ora 28221
28221, 00000, "REPLACE not specified"
// *Cause:  User is changing password but password verification function is
//          turned on and the original password is not specified and the
//          user does not have the alter user system privilege.
// *Action: Supply the original password.
//
//
$ exit

SQL> select * from dba_profiles;

PROFILE                        RESOURCE_NAME                    RESOURCE LIMIT
------------------------------ -------------------------------- -------- ----------------------------------------
DEFAULT                        COMPOSITE_LIMIT                  KERNEL   UNLIMITED
DEFAULT                        SESSIONS_PER_USER                KERNEL   UNLIMITED
DEFAULT                        CPU_PER_SESSION                  KERNEL   UNLIMITED
DEFAULT                        CPU_PER_CALL                     KERNEL   UNLIMITED
DEFAULT                        LOGICAL_READS_PER_SESSION        KERNEL   UNLIMITED
DEFAULT                        LOGICAL_READS_PER_CALL           KERNEL   UNLIMITED
DEFAULT                        IDLE_TIME                        KERNEL   UNLIMITED
DEFAULT                        CONNECT_TIME                     KERNEL   UNLIMITED
DEFAULT                        PRIVATE_SGA                      KERNEL   UNLIMITED
DEFAULT                        FAILED_LOGIN_ATTEMPTS            PASSWORD 10
DEFAULT                        PASSWORD_LIFE_TIME               PASSWORD 90

PROFILE                        RESOURCE_NAME                    RESOURCE LIMIT
------------------------------ -------------------------------- -------- ----------------------------------------
DEFAULT                        PASSWORD_REUSE_TIME              PASSWORD 1800
DEFAULT                        PASSWORD_REUSE_MAX               PASSWORD 15
DEFAULT                        PASSWORD_VERIFY_FUNCTION         PASSWORD VERIFY_FUNCTION
DEFAULT                        PASSWORD_LOCK_TIME               PASSWORD .0069
DEFAULT                        PASSWORD_GRACE_TIME              PASSWORD 10

16 rows selected.


当用户启用密码复杂性函数时，也就是执行过UTLPWDMG.SQL或在用户所在profile中的PASSWORD_VERIFY_FUNCTION指定了函数的时候，必须在alter user命令的时候使用replace子句，即：
alter user username identified by new_pass replace old_pass;
或者给用户付alter user的系统权限。