Search Results ext_auth_passwd_change_warn

Overview

The APPS.FND_SSO package is the Oracle E-Business Suite single sign-on integration layer that allows EBS to delegate user authentication, password validation, and password change operations to an external authentication provider. In releases 12.1.1 and 12.2.2 it is the package that bridges the EBS Applications authentication model and third-party or customer-built identity management infrastructures, including Oracle Access Manager, Oracle Single Sign-On, LDAP directories, or custom HTTP-based authentication services.

The package is a specification-only package body declared with AUTHID DEFINER, meaning it executes with the privileges of its APPS owner rather than the invoking user. Its header dates to an early release ($Header: afssos.pls 115.7 2002/12/04) but the same specification remains registered under ETRM in 12.2.2. Its API classification is OTHER, indicating that it is a supporting internal interface rather than a public, supported extension point.

Key Procedures and Functions

• AUTHENTICATE_USER — a function that validates a supplied user name and password against the external authentication provider and returns a PLS_INTEGER status code. It raises EXT_AUTH_FAILURE_EXCEPTION, EXT_AUTH_UNKNOWN_EXCEPTION, or EXT_AUTH_SETUP_EXCEPTION on error, and returns constants such as EXT_AUTH_SUCCESS (0), EXT_AUTH_RESET_PASSWD_EXPIRED (-4), EXT_AUTH_PASSWD_CHANGE_WARN (-5), and EXT_AUTH_PASSWD_EXPIRED (-6).
• GET_CONFIGURATION — a procedure that returns the SSO configuration parameters as a PLS/SQL collection of name/value pairs (ext_config type), allowing callers to inspect the settings supplied by the external authentication provider. It may raise EXT_NOT_SUPPORTED_EXCEPTION or EXT_AUTH_SETUP_EXCEPTION.
• CHANGE_PASSWD — a procedure that propagates a password change from EBS to the external provider, accepting the user name plus the old and new passwords. It raises EXT_CHANGE_PASSWD_EXCEPTION and EXT_NOT_SUPPORTED_EXCEPTION when the provider cannot honour the request.
• GET_AUTHENTICATION_NAME — a function returning a VARCHAR2 identifying the external authentication scheme in use, so that EBS can display or log which provider handled the session. It raises EXT_AUTH_SETUP_EXCEPTION if the configuration is incomplete.

Tables Accessed

The ETRM metadata lists no direct table references through APPS synonyms for FND_SSO. This is consistent with its design: the package is a thin abstraction layer that dispatches to the configured external authentication provider rather than reading or writing EBS application tables itself. Profile option values governing SSO behaviour are resolved by the FND profile mechanism before or alongside these calls, and any persistence of configuration is performed by the external provider or its adapter, not by this package.

Usage Notes

FND_SSO is not intended for direct invocation by customers. It is called internally by the EBS authentication framework — typically from login processing on the sign-on pages, the FND user management forms, and password-change flows — when an external authentication provider has been configured. Because it is AUTHID DEFINER and undocumented as a public API, customisations should treat it as a stable but unsupported dependency and avoid calling its procedures directly from bespoke code. Organisations integrating an external identity store should configure the supported SSO profiles and provider adapters rather than replacing or wrapping this package, since the exception and return-code contract is relied upon by the calling framework across both 12.1.1 and 12.2.2.