Search Results compare_service_tickets

Overview

FND_HTTP_TICKET is a server-side PL/SQL package that implements the ticket mechanism used by Oracle E-Business Suite to authenticate and secure HTTP requests that originate outside a normal Applications session. Its primary business function is to generate, validate, refresh, and expire opaque security tokens ("tickets") that are passed between the EBS middle tier, external components, and self-service or portal-style pages. A ticket binds a ticket value to an operation name, an optional argument, a creation timestamp, and an expiry timestamp, so that a later request can be authorized without re-establishing a full Oracle Applications login. The package body source carries the header $Header: AFSTCKTB.pls 120.1 2005/07/02, confirming its lineage as a long-standing Applications Technology (FND) utility.

Key Procedures and Functions

The package exposes 18 documented program units in ETRM, organized into three functional families.

• Ticket creation: CREATE_TICKET, CREATE_TICKET_STRING, SET_SERVICE_TICKET. CREATE_TICKET generates a random 16-byte RAW value via FND_CRYPTO.RANDOMBYTES, computes the expiry date from the P_LIFESPAN, and inserts the row before returning the RAW ticket. CREATE_TICKET_STRING wraps the RAW result in FND_CRYPTO.ENCODE using the URL encoding scheme so that it can be embedded in a URL or form parameter. SET_SERVICE_TICKET establishes a ticket for a named HTTP service.
• Ticket validation: CHECK_TICKET, CHECK_TICKET_STRING, CHECK_ONETIME_TICKET, CHECK_ONETIME_TICKET_STRING, COMPARE_SERVICE_TICKETS, COMPARE_SERVICE_TICKET_STRINGS, GET_SERVICE_TICKET, GET_SERVICE_TICKET_STRING. The CHECK_TICKET_STRING function is the string-form counterpart to CHECK_TICKET, accepting a URL-encoded ticket and confirming that it exists, has not expired, and matches the expected operation. CHECK_ONETIME_TICKET_STRING adds single-use semantics. The COMPARE_* functions perform a constant-time comparison of two ticket values or their encoded forms, and the GET_SERVICE_TICKET_STRING function retrieves the encoded ticket associated with a service.
• Ticket lifecycle: UPDATE_TICKET, UPDATE_TICKET_STRING, DESTROY_TICKET, DESTROY_TICKET_STRING, PURGE_TICKETS. UPDATE_* extends or refreshes a ticket's expiry, DESTROY_* removes a ticket explicitly, and PURGE_TICKETS deletes expired rows in bulk.

Tables Accessed

The package reads and writes two application tables through APPS synonyms. FND_HTTP_TICKETS stores the core ticket rows, holding the TICKET RAW value, the OPERATION and ARGUMENT columns, and the START_DATE and END_DATE range that defines the ticket's validity window. FND_HTTP_SERVICE_TICKETS stores tickets that are scoped to a named HTTP service, supporting the SET_/GET_SERVICE_TICKET family. The body also references UTL_RAW indirectly through the FND_CRYPTO utility for random byte generation and encoding. Every CREATE_TICKET call performs an autonomous-transaction insert and commit so that the ticket exists independently of the caller's transaction.

Usage Notes

FND_HTTP_TICKET is generally invoked from other PL/SQL packages, from Oracle Application Framework (OAF) pages, and from JSP or servlet components that need to hand a one-time credential to a web request. Typical patterns are the generation of a ticket for a drill-down link, the validation of that ticket in the target page, and destruction of the ticket once consumed. ETRM records that the package is referenced by nine other packages, indicating broad internal use across technology-stack utilities. Custom code should mirror this pattern: create a ticket, pass the encoded string, validate with CHECK_TICKET_STRING (or the one-time variant), and destroy it afterwards. PURGE_TICKETS is normally scheduled as a housekeeping concurrent program to prevent FND_HTTP_TICKETS and FND_HTTP_SERVICE_TICKETS from accumulating stale rows.