Search Results check_user_role

Overview

APPS.AMW_SECURITY_PUB is the public security engine of the Oracle E-Business Suite Application Management Workspace (AMW) framework. It centralizes role-based access control by resolving grants, roles, and instance sets into SQL predicates that can be applied at runtime to restrict records visible to a user. The package body maintains internal constants such as C_TYPE_SET, C_TYPE_GLOBAL, C_TYPE_INSTANCE, and C_TYPE_UNIVERSAL to classify grant types, and it exposes a small set of public entry points that forms, concurrent programs, and other PL/SQL packages call when they need to enforce or query security. In Oracle EBS 12.1.1 and 12.2.2, AMW_SECURITY_PUB is the underlying mechanism that bridges FND_GRANTS, role definitions, and Virtual Private Database (VPD) style filtering. Users searching for "check_user_role" typically encounter this package because role checking and predicate generation are performed here, even though the documented public API centers on GRANT_ROLE_GUID, REVOKE_GRANT, SET_GRANT_DATE, and GET_SECURITY_PREDICATE.

Key Procedures and Functions

• GRANT_ROLE_GUID — Creates or records a role grant identified by a GUID, associating a user or principal with a role so that the grant can later be resolved into a security predicate. It is the primary write-side entry point for establishing access.
• REVOKE_GRANT — Removes an existing grant, effectively withdrawing the access previously conferred through GRANT_ROLE_GUID. It backs administrative screens and cleanup routines that must terminate a user's role assignment.
• SET_GRANT_DATE — Adjusts the effective date attributes of a grant, supporting time-bound or scheduled access windows so that grants can be activated or expired without deleting the underlying record.
• GET_SECURITY_PREDICATE — Generates the SQL predicate fragment that restricts a query according to the current user's grants, roles, and instance sets. The body caches inputs such as the function name, object name, grant instance type, user name, statement type, table alias, and bind order in package-level globals (for example g_gsp_predicate, g_gsp_table_alias, g_gsp_with_binds) to avoid redundant computation within a session. It also respects a predicate buffer size limit (c_pred_buf_size, c_vpd_buf_limit) inherited from earlier database versions.

Tables Accessed

The package reads and writes several APPS synonyms that form the security data model. FND_GRANTS stores the grant records manipulated by GRANT_ROLE_GUID, REVOKE_GRANT, and SET_GRANT_DATE. FND_USER and WF_LOCAL_ROLES provide the user and role identities referenced by those grants, while HZ_PARTIES links to party-level principals in Oracle Receivables and Trading Community. FND_OBJECTS and FND_OBJECT_INSTANCE_SETS define the secured objects and the instance sets used to scope grants, particularly for C_TYPE_INSTANCE and C_TYPE_SET grants. FND_MENUS, FND_FORM_FUNCTIONS, and FND_COMPILED_MENU_FUNCTIONS support function and menu security checks, and DUAL is used for singleton lookups. Internal helper caches such as get_object_id() and get_function_id() reduce repeated lookups against these tables.

Usage Notes

AMW_SECURITY_PUB is invoked whenever AMW-based pages, dashboards, or dependent packages must enforce row-level security. Administrators trigger the grant, revoke, and date procedures through AMW setup forms, while developer code and other PL/SQL packages call GET_SECURITY_PREDICATE to retrieve a predicate for dynamic SQL or VPD policies. Because it is referenced by seven other packages, changes should be treated as impact-bearing. Customizations should use the public procedures rather than the internal caches, and callers should be aware that predicate generation is session-cached and sensitive to the object, alias, and bind order supplied.