Search Results check_permission

Overview

APPS.JTF_AUTH_SECURITY_PKG is a PL/SQL package belonging to the Oracle E-Business Suite CRM Foundation (JTF) authorization layer. It provides the programmatic interface through which application code evaluates and administers the relationship between users (principals), roles, domains, and permissions. In the Oracle EBS security model, permissions are named capabilities registered against an authorization domain, and they are granted to roles rather than directly to individual users. This package exposes the runtime and administrative hooks needed to query that model: it can determine whether a named user holds a specific permission, and it can attach an existing permission to an existing role.

The package is classified in the ETRM repository as API classification OTHER, with the header revision JTFSEASS.pls 120.2, last shipped in 2005. It is referenced by two other packages within the applications schema, indicating that it is a supporting component consumed by higher-level authorization APIs rather than a top-level entry point. It is not a form-level access control mechanism.

Key Procedures and Functions

The package exposes two documented procedures.

• CHECK_PERMISSION — Determines whether a specified user has been assigned a specified permission within a stated authorization domain. The procedure returns an output flag indicating possession of the permission (one if held, zero otherwise) together with a standard API return status drawn from FND_API, where G_RET_STS_SUCCESS denotes successful completion and G_RET_STS_UNEXP_ERROR denotes an unexpected error, in which case the flag is undefined. The user name and domain name inputs are case insensitive and are upper-cased internally; the domain defaults to CRM_DOMAIN. The permission name input is case sensitive.
• ASSIGN_PERM — Assigns an existing permission to an existing role. It accepts a role name, a permission name, and an application identifier. As with CHECK_PERMISSION, the role name is case insensitive while the permission name remains case sensitive.

Tables Accessed

The package operates against the JTF authorization schema through APPS synonyms. The principal and mapping tables — JTF_AUTH_PRINCIPALS_B, JTF_AUTH_PRINCIPAL_MAPS, and JTF_AUTH_ROLE_PERMS — hold the user, role, and role-to-permission grant records that CHECK_PERMISSION resolves and that ASSIGN_PERM writes. JTF_AUTH_PERMISSIONS_B stores the permission definitions themselves, and JTF_AUTH_DOMAINS_B stores the authorization domains that scope those permissions, including the default CRM_DOMAIN. JTF_AUTH_S1 is a supporting sequence used for key generation on insert. Read access is dominant for CHECK_PERMISSION; ASSIGN_PERM requires insert or update rights against the role-permission mapping tables.

Usage Notes

CHECK_PERMISSION is explicitly documented as unsuitable for access control over the current user. The header comment warns that the API must not be used to decide whether the signed-on user may open a form or perform an action, because results become erroneous when the environment is in maintenance mode (see Bug 2117260). Access control for the current session must instead rely on Oracle EBS function security and the standard menu/form authorization framework. The appropriate use of CHECK_PERMISSION is to interrogate whether another user — for example, an approver, delegate, or workflow participant — has been granted a particular permission. ASSIGN_PERM is an administrative call used by setup utilities, migration scripts, and custom provisioning code to establish role-permission grants without direct DML against the underlying tables. Both procedures are normally invoked from PL/SQL packaged code, concurrent programs, or carefully scoped customizations rather than from ad hoc SQL.