Search Results give_dependant_grants




Overview
Explore in AI Chat

Overview

AMW_SECURITY_UTILS_PVT is a private (PVT-classified) PL/SQL package body owned by APPS within the Oracle E-Business Suite environment. In EBS 12.1.1 and 12.2.2, this package forms part of the application's internal security utility layer, specifically dealing with the propagation and maintenance of grants against dependent security objects. The central concept it implements is "dependant grants" — grants on child objects that must be automatically created, updated, or revoked in response to changes on a parent object. The database header indicates the package was authored with a "noship" designation, meaning it is intended for internal subsystem use rather than direct customer invocation.

The package underpins functionality in which assigning a role to a parent object implicitly conveys a corresponding role on a child object through the security role mapping configuration, ensuring consistent authorization semantics across object hierarchies without redundant manual administration.

Key Procedures and Functions

The package exposes five documented program units:

  • GIVE_DEPENDANT_GRANTS — Creates dependent grants on child objects derived from a parent grant. In the documented body excerpt, it reads role mappings for a given parent object and role, resolves the child role (substituting the parent role when the mapping specifies "SAME"), and calls FND_GRANTS_PKG.GRANT_FUNCTION to materialize each child grant on the appropriate child instance set.
  • UPDATE_DEPENDANT_GRANTS — Modifies existing dependent grants, typically when the parent grant's attributes (dates, grantee, or scope) change and the child grants must reflect the new state.
  • REVOKE_DEPENDANT_GRANTS — Removes dependent grants that were previously created for a parent grant, used when a parent grant is revoked or superseded.
  • GET_PARTY_ID — A helper that resolves a party identifier, supporting grantee resolution logic used by the grant routines.
  • CHECK_FUNCTION — A validation utility that verifies a function or role is valid or available in the security model before a grant is attempted.

Tables Accessed

  • AMW_SECURITY_ROLE_MAPPINGS — The configuration table that defines parent-to-child object, role, and instance-set relationships. It supplies the driving cursor for dependent grant expansion.
  • FND_GRANTS — The core grants repository; the package (via FND_GRANTS_PKG) inserts, updates, and deletes grant rows here.
  • FND_USER — Used to resolve grantee identities during grant creation and validation.
  • PLITBLM — An APPS-side table supporting the package's logic, typically referenced for operational bookkeeping or lookups.

Usage Notes

Because this is a PVT package, it is not a public API and should not be called directly by customer extensions. It is invoked internally by the two packages that reference it, and indirectly by grant-management workflows such as those executed from security administration forms or concurrent programs that administer role and object security. When a user or process grants a role on a parent object, the calling layer delegates to GIVE_DEPENDANT_GRANTS; correspondingly, update and revoke operations propagate through UPDATE_DEPENDANT_GRANTS and REVOKE_DEPENDANT_GRANTS. Customizations requiring dependent grant behavior should invoke the supported calling packages rather than this private body, since its interface is subject to change between patch levels of 12.1.1 and 12.2.2.