When a user's password in Oracle has expired, is the only way for that user to be able to get in and change their password is by using sqlplus??

I ask this because, what I see happen is this:

When a user tries to login after his password has expired (using sqlplus), sqlplus immediately prompts for a new password. So I can see that oracle initiates a request from the user. Sqlplus seems to handle this nicely - prompts the user and waits for a response. But how can I handle this outside of sqlplus. I see that not even sqlplus worksheet handles this type of request from the database.

My users don't have sqlplus and we've setup a simple web form that allows them to change their password. This works only if their password has not expired. The web form simply asks the user to enter their username, connect_string, old password, new password (and retype new password), and when the "submit" button is pressed, all the web form does is pass the following sql:

connect username/password@connect_string
alter user username identified by new_password replace old_password;

Very simple (as you can see).

But this, again, does not work when the password is expired because Oracle immediately requests for a new password.

Has anyone addressed this? How?