Search Results fnd_sso_manager




Overview
Explore in AI Chat

Overview

FND_SSO_MANAGER is a public PL/SQL package in the APPS schema that provides the central abstraction layer for login and logout management within Oracle E-Business Suite. Its primary purpose is to shield EBS applications from the differences between native EBS authentication and Single Sign-On (SSO) deployments integrated with Oracle Internet Directory (OID). The package header, last revised under version 120.3, is registered in ETRM with the display name "SSO Manager" under the FND product and the business entity category FND_SSO_MANAGER. It exposes seven documented procedures and functions that cover user synchronization from LDAP, delegated user administration controls, and the generation of login and logout URLs.

Key Procedures and Functions

The package provides the following documented entry points:

  • SYNCH_USER_FROM_LDAP — Accepts an FND_USER.user_name and retrieves the corresponding user information from Oracle Internet Directory. It checks whether a matching TCA person party exists; if not, one is created, and if it does exist, the record is updated from OID. The procedure treats OID as the source of truth for user attributes.
  • ISUSERCREATEUPDATEALLOWED — A function intended for applications operating under delegated user administration. It indicates whether the current deployment permits applications to create or update users. In SSO/OID-integrated or native deployments where user provisioning is centralized, this returns a value that allows callers to suppress local user maintenance. The central provisioning APIs raise an exception if applications attempt user creation or updates when the deployment has disabled them.
  • GETLOGINURL — Returns the appropriate login URL for the deployment, allowing callers to redirect users to the correct authentication entry point.
  • GETLOGOUTURL — Returns the corresponding logout URL, supporting clean session termination in both native and SSO configurations.
  • GET_LDAP_USER_NAME — Retrieves the LDAP user name associated with an EBS user, supporting identity correlation between FND_USER and the directory.
  • MODPLSQL_CURRENTURL — Provides the current URL within the MOD_PLSQL (Apache/mod_plsql) context, used by the login and logout redirect logic.
  • ISPASSWORDCHANGEABLE — Indicates whether the password may be changed through EBS, which is relevant when password management is delegated to the directory rather than maintained locally.

Tables Accessed

Through APPS synonyms, the package references the following documented objects:

  • FND_USER — The core EBS user repository. It supplies the user_name input for SYNCH_USER_FROM_LDAP, is consulted for LDAP user name correlation, and underpins the delegated user administration checks performed by ISUSERCREATEUPDATEALLOWED.
  • ICX_SESSIONS — The session management table used in conjunction with login and logout processing, including URL generation and session lifecycle handling.
  • OWA_UTIL — The Oracle Web Agent utility package, used for URL and web-context handling within the MOD_PLSQL layer.

Usage Notes

FND_SSO_MANAGER is invoked by EBS infrastructure rather than by end users directly. It is referenced by twelve other packages, indicating broad use across the login, logout, and user-provisioning flows. Typical invocation points include the EBS login and logout pages, SSO redirect handling, and user maintenance forms that must determine whether local user creation or password changes are permitted. The user-supplied search string referencing an Account/Login URL reflects the external SSO login endpoint that EBS redirects to; GETLOGINURL and GETLOGOUTURL are the package functions responsible for producing such redirect targets. Custom code integrating with EBS authentication should call these functions rather than hard-coding URLs, and should honor the result of ISUSERCREATEUPDATEALLOWED before attempting any user record manipulation.