Results for “security_flag”

2 results




Overview
Explore in AI Chat

AI-generated from documented ETRM metadata — verify critical details on the linked pages.

Overview

IBC_CITEM_PERMISSIONS_V is a security-definer style view owned by the APPS schema in Oracle E-Business Suite 12.1.1 and 12.2.2. It belongs to the IBC – Content Manager product, which underlies the iStore/Content Manager content item repository. The view resolves the effective permission set applicable to content items (IBC_CONTENT_ITEMS) for the currently connected application user, joining grant definitions from IBC_GRANTS and grant-group assignments in IBC_OBJECT_GRANT_GROUPS across the directory-node-to-content-item hierarchy.

Rather than exposing raw grant rows, the view filters grants by ACTION = 'ALLOW', applies inheritance rules (INHERITED_FLAG = 'N' or CASCADE_FLAG = 'T'), and suppresses grants overridden by a more restrictive RESTRICT entry at a lower GRANT_LEVEL. Grantee matching is delegated to IBC_UTILITIES_PVT.CHECK_CURRENT_USER, which evaluates GRANTEE_USER_ID, GRANTEE_RESOURCE_ID, and GRANTEE_RESOURCE_TYPE against the session. Anonymous grants (both grantee columns null) are always visible. The view is therefore a session-sensitive reporting and integration surface: results change depending on who queries it and whether the site profile option IBC_USE_ACCESS_CONTROL is enabled.

Underlying Base Objects

The documented referenced objects are FND_GLOBAL (package), FND_OBJECTS, IBC_CONTENT_ITEMS, IBC_DIRECTORY_NODES_B, IBC_GRANTS, IBC_OBJECT_GRANT_GROUPS, IBC_UTILITIES_PVT (package), JTF_RS_GROUPS_DENORM, JTF_RS_GROUP_MEMBERS, and JTF_RS_RESOURCE_EXTNS — the latter three resolving resource/group membership used by the grantee check. The FND_OBJECTS synonym appears twice in the driving query, aliased GRANTED_AT (restricted to OBJ_NAME = 'IBC_DIRECTORY_NODE') and GRANTED_TO (OBJ_NAME = 'IBC_CONTENT_ITEM'), reflecting that grants are anchored on directory nodes and projected onto content items through DIRECTORY_NODE_ID = INSTANCE_PK1_VALUE.

IBC_OBJECT_PERMISSIONS and FND_LOOKUP_VALUES participate only in the UNION branch that runs when IBC_USE_ACCESS_CONTROL = 'N'. That branch bypasses grant evaluation entirely and derives PERMISSION_CODE from the lookup type recorded on IBC_OBJECT_PERMISSIONS for LANGUAGE = 'US'. The result is a single rowset in which each content item is paired with the permission codes available to the calling user.

Key Columns

  • OBJECT_ID — identifier of the FND_OBJECTS row the permission applies to; the join key back to object-level metadata.
  • PERMISSION_CODE — the permission granted (from IBC_GRANTS in the access-controlled branch, from FND_LOOKUP_VALUES.LOOKUP_CODE otherwise).
  • CONTENT_ITEM_ID — primary identifier of the content item, from the CI.* projection.
  • ITEM_REFERENCE_CODE — application-defined reference used to locate the item in the repository.
  • CONTENT_TYPE_CODE — classification of the content item.
  • DIRECTORY_NODE_ID — the directory node under which the item is filed and against which grants are evaluated.

Common Use Cases and Queries

Typical use is enumeration of the permissions the current session holds over a given content item, or discovery of all content items reachable at a given permission level. Security-aware extracts should always be executed in the context of the target user, since CHECK_CURRENT_USER is evaluated at run time.

List permissions for a specific content item:

  • SELECT permission_code FROM apps.ibc_citem_permissions_v WHERE content_item_id = :p_item_id;

Locate items by reference code and content type:

  • SELECT content_item_id, item_reference_code FROM apps.ibc_citem_permissions_v WHERE permission_code = 'VIEW' AND content_type_code = :p_type;

Because the view is a UNION of an access-controlled and a non-controlled path, performance depends heavily on the profile setting and on the CHECK_CURRENT_USER call; queries that pin CONTENT_ITEM_ID or OBJECT_ID and run with IBC_USE_ACCESS_CONTROL = 'Y' are the most predictable.