Search Results get_pwd_enc_mode

Overview

FND_WEB_SEC is the Oracle E-Business Suite security package that underpins authentication, password management, and Oracle schema provisioning for the Applications framework. In EBS 12.1.1 and 12.2.2, it is owned by APPS and classified by ETRM as an OTHER API, meaning it is exposed for controlled use but is not a general-purpose business API. Its scope is the FND_USER business entity, and its responsibilities span validating local (non-SSO) user credentials, maintaining login audit trails, encrypting and re-encrypting passwords, and creating or migrating the underlying Oracle database users associated with EBS application accounts. The package header carries the internal header revision AFSCJAVS.pls 120.11.12010000.1 and is referenced by 37 other packages, reflecting its role as a foundational dependency for the AOL/Foundation security stack. Much of the package is explicitly marked for AOL internal use only; Oracle directs callers to documented wrappers such as fnd_user_pkg.validatelogin to insulate custom code from undocumented underlying changes. The metadata identifies 33 documented procedures and functions.

Key Procedures and Functions

The documented entry points fall into several functional groups:

• Authentication: VALIDATE_LOGIN tests a username and password without updating audit tables, returning 'Y' or 'N'. UNSUCCESSFUL_LOGIN records failed authentication attempts. These routines apply only to local users, not SSO-enabled accounts.
• User and password lifecycle: CREATE_USER provisions a new EBS user; CHANGE_PASSWORD and CHANGE_GUEST_PASSWORD modify credentials; VALIDATE_PASSWORD enforces password rules; UPDATE_NO_REUSE and UPDATE_NO_REUSE_FUNCTION maintain the password history used to prevent reuse.
• Encryption: ENCRYPT, URLENCRYPT, GET_PWD_ENC_MODE, GET_ENCRYPTED_PASSWORDS, GET_REENCRYPTED_PASSWORD, and SET_REENCRYPTED_PASSWORD manage the encrypted representation of passwords.
• Oracle schema provisioning: CREATE_ORACLE_USER creates the database account corresponding to an EBS user; GET_REENCRYPTED_ORACLE_PWD and CVT_REENCRYPTED_ORACLE_PWD handle the encrypted Oracle password; START_USER_MIGRATE initiates migration of users; UPGRADE_WEB_PASSWORD supports password format upgrades.
• Support utilities: GET_OP_VALUE retrieves configuration values used by the security logic.

Tables Accessed

The package reads and writes the core Foundation security tables through APPS synonyms:

• FND_USER and FND_USER_S — user definitions and their secure (encrypted) password columns.
• FND_ORACLE_USERID and FND_ORACLE_USERID_S — mapping between EBS users and Oracle database schemas, supporting CREATE_ORACLE_USER.
• FND_UNSUCCESSFUL_LOGINS — failed login audit records written by UNSUCCESSFUL_LOGIN.
• FND_USER_PREFERENCES — user-level preferences consulted during authentication.
• FND_LANGUAGES — language context used in derived logic.

Supporting dictionary and package dependencies include DUAL, USER_TABLES, DBMS_LOCK, DBMS_SQL, DBMS_SESSION, DBMS_UTILITY, DBMS_RANDOM, and DBMS_OBFUSCATION_TOOLKIT (the last used for the legacy encryption routines).

Usage Notes

FND_WEB_SEC is invoked primarily by the EBS sign-on flow, by Oracle's own AOL packages, and by the concurrent programs that provision and migrate users. Custom code that needs to authenticate credentials should call the supported wrapper fnd_user_pkg.validatelogin rather than validate_login directly, because the underlying routines are documented as AOL internal use only. CREATE_ORACLE_USER and the re-encryption routines are relevant during user migration and password algorithm upgrades, and should not be called ad hoc in production. Because the package touches the encrypted password columns of FND_USER_S and FND_ORACLE_USERID_S, any direct invocation must run as APPS with the correct encryption mode established via GET_PWD_ENC_MODE. In 12.1.1 and 12.2.2 the implementation is unchanged in substance, though the header dates it to 2008; the cited dependencies remain valid across both releases.