Search Results audit_update_role

Overview

SYS.XS_ADMIN_INT is the internal administrative interface package for Oracle's Real Application Security (XS) framework, which is embedded within the Oracle E-Business Suite database tier and shipped in the SYS schema. In the EBS 12.1.1 and 12.2.2 environments, this package provides the low-level primitives used to create, manage, and remove security entities — users, roles, and their associated ACLs, scopes, and proxy grants — that underpin the XS security model. It is declared with AUTHID CURRENT_USER, meaning that all SQL operations it performs execute under the privileges of the invoking user rather than the package owner. This design enforces that callers must themselves possess the necessary system privileges (captured by the SPRIV_* constants) before any administrative action succeeds.

The package abstracts the referential complexity of the XS data model. Because security objects reference one another through role grants, inheritance chains, scope ACLs, and protection instance sets, deleting or invalidating an entity can have cascading effects. XS_ADMIN_INT centralizes that logic so that higher-level administrative APIs and dictionary views behave consistently.

Key Procedures and Functions

• GET_ENTITY_ID — Resolves the unique numeric identifier associated with a named security entity (user, role, or related object), allowing callers to translate external names into internal keys before performing further operations.
• CREATE_ENTITY — Creates a new security entity within the XS repository. The OBJ_WITH_STATUS_* constants (NOT_EXISTS, EXISTS, EXTERNAL) govern how the routine treats pre-existing or externally managed objects.
• DELETE_ENTITY — Removes a security entity. Its return value uses DELETE_SUCCESS, WARN_DEP_EXISTS, and WARN_CONSTRAINTS_EXISTS to signal success or to warn that dependent objects or constraints block deletion.
• CREATE_DEPENDENCY — Registers a dependency relationship between two security objects. The ROLE_GRANT_PROXY_DEP, SC_INHERIT_DEP, SCOPE_ACL_DEP, ACL_INHERIT_DEP, PROTECT_INST_SET_DEP, GRANT_DENY_PRNC_DEP, and ROLE_ROLESET_DEP constants enumerate the seven dependency types. This is the routine a user targets when searching for "create_dependency," and it is the mechanism by which the integrity of grants, inheritance, and proxy relationships is tracked.
• DELETE_DEPENDENCY — Removes a previously registered dependency link, typically invoked during revocation or cleanup of a security object.
• INVALIDATE_ENTITY — Marks a security entity as invalid, forcing dependent sessions or cached privilege evaluations to be refreshed.
• CHECK_PERMISSION — Evaluates whether a principal holds a particular privilege against an object, supporting authorization decisions at runtime.
• ADMIN_AUDIT — Records administrative actions into the XS audit trail using the AUDIT_CREATE_USER, AUDIT_UPDATE_ROLE, AUDIT_GRANT_ROLE, AUDIT_ADD_PROXY, and related action codes, providing accountability for security changes.

Tables Accessed

The ETRM metadata does not enumerate specific base tables accessed through APPS synonyms; the package operates against the XS data dictionary owned by SYS, which stores entity definitions, dependency relationships, ACL and scope assignments, proxy grants, and audit records. Because these are SYS-owned metadata tables, direct DML is restricted, and interaction occurs only through this package and its companion APIs.

Usage Notes

XS_ADMIN_INT is an internal interface and is not intended for direct invocation by EBS application code. It is referenced by fourteen other packages, which layer product-facing administrative operations on top of these primitives. In practice, it is invoked indirectly when administrators create or maintain users and roles, when security grants are established or revoked, and when audit records are written for those changes. Custom code should avoid calling XS_ADMIN_INT directly, as its signatures and constants are Oracle-internal and subject to change between release levels. Any dependency creation in a custom extension should be routed through supported XS or EBS security APIs.