Search Results get_ldap_user_name

Overview

FND_SSO_MANAGER is the Oracle E-Business Suite package body that centralizes integration logic between EBS and an external Lightweight Directory Access Protocol (LDAP) directory service, typically Oracle Internet Directory or Oracle Access Manager. In the 12.1.1 and 12.2.2 releases it underpins single sign-on (SSO) and centralized user provisioning, allowing user accounts, credentials, and session-related behavior to be governed by the directory rather than by EBS alone. The package exposes entry points for user synchronization, login and logout URL resolution, LDAP name resolution, and policy checks that determine whether user creation, update, or password change operations are permitted. The module source constant embedded in the body (fnd.plsql.sso.fnd_sso_manager.) is used for EBS logging through FND_LOG, which is significant when diagnosing SSO failures in a production environment.

Key Procedures and Functions

• SYNCH_USER_FROM_LDAP — The routine returned by the user search term synch_user_from_ldap. It accepts a user name, logs the beginning of processing at statement level when the runtime logging threshold permits, and then delegates to FND_LDAP_WRAPPER.SYNCH_USER_FROM_LDAP, returning a result code that indicates success or failure. It effectively pulls the corresponding directory entry into the EBS user repository.
• ISUSERCREATEUPDATEALLOWED — A policy check that indicates whether external (non-EBS) creation or update of a user account is permissible. It protects administratively sensitive accounts from being overwritten by directory-driven provisioning.
• GETLOGINURL — Resolves the URL used to initiate the SSO login flow. The commented block in the body documents the earlier two-parameter form, superseded per Bug 4043786 by a three-parameter function.
• GETLOGOUTURL — Resolves the URL used when a user logs out of EBS, ensuring the directory session is also terminated so that subsequent access re-prompts for credentials.
• GET_LDAP_USER_NAME — Returns the LDAP-side user name associated with the current EBS context, allowing mappings where the directory name differs from the EBS login name.
• MODPLSQL_CURRENTURL — Returns the current URL for mod_plsql requests, used in constructing redirect targets for SSO login and logout.
• ISPASSWORDCHANGEABLE — Indicates whether the EBS user is permitted to change the password locally, or whether password management must occur in the directory.

Tables Accessed

The package operates against FND_USER, the central EBS user repository. During synchronization and policy evaluation it reads and, where provisioning is allowed, updates user rows. ICX_SESSIONS is referenced for session and SSO session handling, and OWA_UTIL is used for URL encoding and related web utility functions when building login and logout links. Direct access is through APPS synonyms rather than fully qualified schema names.

Usage Notes

FND_SSO_MANAGER is invoked indirectly by the EBS SSO and user management infrastructure rather than by end users. Login and logout flows call the URL functions during the authentication handshake, while synchronization is triggered when directory changes must be reflected in FND_USER, for example during provisioning or a scheduled reconcile. The password-changeable and create/update-allowed checks are consumed by the user maintenance forms and by self-service password screens to decide which fields remain editable. The package is also referenced by twelve other database objects, so customizations should avoid modifying its specification; extensions should wrap the documented procedures instead. Because errors are surfaced through a PL/SQL result code and FND_LOG output, DBAs should raise the FND logging level for fnd.plsql.sso.fnd_sso_manager when troubleshooting synchronization or URL generation issues.