Results for “get_predicate”

AI-generated from documented ETRM metadata — verify critical details on the linked pages.

Overview

FND_GENERIC_POLICY is a PL/SQL package in the APPS schema that implements the generic callback function used by Oracle E-Business Suite's Virtual Private Database (VPD) / Row-Level Security framework. Its business purpose is to enforce data security at the database level by dynamically appending a restrictive predicate (a "WHERE clause") to queries executed against synonyms or views that have been secured through the FND data security model. Rather than hard-coding a separate policy function for every secured object, EBS uses this single generic routine; the database invokes it automatically whenever a protected synonym or view is accessed, and the routine resolves the appropriate security predicate for the current user and the object in question.

The package header carries the directive AUTHID CURRENT_USER, meaning the routine executes with the privileges of the invoking user rather than the package owner. Its header revision ($Header: AFSCGPLS.pls 115.1) dates to 2003, and the object remains in use across both the 12.1.1 and 12.2.2 releases. In ETRM metadata it is classified under API classification OTHER and is documented as referenced by zero other packages, confirming that it is a framework callback rather than a routine called directly by application code.

Key Procedures and Functions

FND_GENERIC_POLICY exposes a single documented function:

• GET_PREDICATE — Returns the data security predicate (a VARCHAR2 WHERE-clause fragment) for a given synonym or view. When attached as the policy function to an object, it must be named identically to the synonym or view it secures, and that function name must have its object_id properly registered in FND_FORM_FUNCTIONS. On invocation, GET_PREDICATE looks up the function name in FND_FORM_FUNCTIONS, resolves the underlying database object behind the synonym, and then calls FND_DATA_SECURITY.GET_SECURITY_PREDICATE to obtain the predicate restricting rows to those accessible by the current user for that object and function. The returned clause is applied by the database to filter the result set. Per the source comments, this routine should never need to be called directly by applications code; its name is instead passed to the add_policy() routine when VPD policies are created, so the database invokes it as a callback on synonym or view access.

Tables Accessed

The package reads from two documented tables (accessed through APPS synonyms):

• FND_FORM_FUNCTIONS — queried to locate the function record matching the policy function name and to retrieve the object_id that identifies the underlying secured object. This mapping is the linchpin of the generic mechanism: the function name must equal the synonym/view name and must be registered here.
• FND_OBJECTS — used to resolve the underlying database object associated with the function, so that the correct security predicate can be generated for that object.

These lookups are read-only; the package does not write to these tables. The predicate computation itself is delegated to FND_DATA_SECURITY.

Usage Notes

FND_GENERIC_POLICY is not intended for direct invocation by forms, concurrent programs, or custom code. It is registered as the policy function when a VPD policy is created on a synonym or view—typically through the add_policy() routine—and the database then calls it transparently whenever the secured object is queried. The naming convention is strict: the synonym or view name must exactly match the policy function name used to retrieve the predicate, and that function must have its object_id correctly set in FND_FORM_FUNCTIONS. Misconfiguration of this mapping results in an incorrect or missing security predicate, which can expose or over-restrict data. Custom developers integrating with EBS row-level security should therefore rely on the standard FND data security setup rather than calling GET_PREDICATE directly, and should verify that any secured synonym conforms to the required name-to-function correspondence. The search term "74178ncd policy" does not correspond to any documented attribute of this object; the package's relevance is limited to its role as the generic VPD policy callback.