Search Results get_k_access




Overview
Explore in AI Chat

Overview

OKE_K_SECURITY_PKG is an Oracle E-Business Suite PL/SQL package owned by the APPS schema that provides the security and access-control framework for Oracle Contracts (OKE) and related contract authoring data. Its central role is to resolve which users, employees, and roles are permitted to view or transact against a given contract header or contract line. Because contract records are secured through the Oracle Application Object Library (AOL) security model, the package bridges generic EBS user/function/menu definitions with contract-specific access rules, allowing secured views and forwarder views to return only the rows a given session is authorized to see.

The package is classified as OTHER rather than as a public API, indicating it is intended primarily for internal consumption by Oracle-delivered views and concurrent programs rather than as a supported integration interface. It is reachable through APPS synonyms and operates on top of PA, OKC, and FND base tables. In 12.1.1 and 12.2.2 the package status is VALID, and it depends only on SYS.STANDARD and the PL/SQL runtime, meaning its logic is self-contained and does not cascade other PL/SQL dependencies.

Key Procedures and Functions

The documented interface exposes nine callable units, broadly grouped into access resolution and role resolution, plus assignment-date maintenance and a function-level gate:

  • GET_K_ACCESS — returns the access level or access set applicable to a contract.
  • GET_USER_K_ACCESS — determines the contract access granted to a specific application user.
  • GET_EMP_K_ACCESS — determines the contract access granted to a specific employee (HR person), which is essential where access is granted by employee rather than by login.
  • GET_K_ROLE — resolves the security role associated with contract access.
  • GET_USER_K_ROLE — returns the role held by a named user.
  • GET_EMP_K_ROLE — returns the role held by a named employee.
  • SET_ASSIGNMENT_DATE — records or updates the effective date associated with a security assignment.
  • GET_ASSIGNMENT_DATE — retrieves that effective date for evaluation of time-bound access.
  • FUNCTION_ALLOWED — validates whether a function (as defined in FND_FORM_FUNCTIONS) is permitted for the current context.

These units are consumed collectively by the secured views, so the results are typically cached or reused within a single view query rather than being called individually by end users.

Tables Accessed

The package reads and, where noted, writes against the following documented objects via APPS synonyms:

  • FND_USER — identifies the application user whose access is being evaluated.
  • FND_FORM_FUNCTIONS and FND_MENU_ENTRIES — provide the AOL function and menu hierarchy used by FUNCTION_ALLOWED to decide whether a secured contract function is exposed.
  • OKC_K_HEADERS_ALL_B — the base contract header table supplying the contract instance being secured.
  • OKE_K_HEADERS — the OKE contract header reference used to tie security evaluation to the contract record.
  • PA_PROJECT_PARTIES — supplies party and party-role relationships from Projects, which are a common grant mechanism for contract access.

Collectively these tables let the package map a user or employee to a party/role, and then to a contract, and finally to an AOL function authorization.

Usage Notes

OKE_K_SECURITY_PKG is referenced by twelve other objects. The principal consumers are the secured contract views, including OKE_K_ALL_ACCESS_BASIC_V, OKE_K_ALL_ACCESS_V, OKE_K_HEADERS_FWDN_V, OKE_K_HEADERS_ORGNZR_V, OKE_K_HEADERS_SECURE_HV, OKE_K_HEADERS_SECURE_V, OKE_K_LINES_FWDN_V, OKE_K_LINES_SECURE_HV, and OKE_K_LINES_SECURE_V. It is also called by OKC_UTIL, OKE_K_SECURED_VIEWS_PKG, and WIP_SFCB_UTILITIES. Practically, this means security is enforced at the view layer: forms and concurrent programs query the secured views, which in turn invoke this package. Custom code should query the secured views rather than calling the package directly, because the package is unsupported for direct invocation and its results depend on session context. Use it for troubleshooting access discrepancies, not for building new integrations.