Search Results grant_role_guid

Overview

AMW_SECURITY_PUB is the public application programming interface for the Oracle E-Business Suite security model that governs role-based access grants. Its name derives from the former Application Management Workspace (AMW) family of packages, which provides the shared security infrastructure used by EBS applications to record, maintain, and evaluate authorization grants between roles and secured objects. In release 12.1.1 and 12.2.2 the package remains the supported entry point for creating and removing grants and for generating the SQL predicates that enforce row-level and function-level security at runtime.

The package operates against the FND_GRANTS model, in which a grant associates a role with an object (such as a menu, function, or business object), optionally scoped to a specific instance. The public API classification indicates that the package is intended for invocation by other application code rather than being an internal implementation detail, and it is referenced by seven other packages within the E-Business Suite.

Key Procedures and Functions

• GRANT_ROLE_GUID — Creates a grant and returns its unique grant identifier (GUID). Two overloads are documented: one accepting a full instance descriptor (instance type, instance set identifier, and five instance primary key values), and a simplified overload accepting an object key. Both accept the role name, object name, party identifier, start and end dates, and standard API versioning and return-status parameters. The first overload also includes a flag controlling whether existing grants are checked before creation.
• REVOKE_GRANT — Removes an existing grant identified by its grant GUID, returning status and error code information to the caller.
• SET_GRANT_DATE — Updates the effective start and end dates of an existing grant identified by its grant GUID, allowing the validity window of an authorization to be adjusted without recreating the grant.
• GET_SECURITY_PREDICATE — Constructs a SQL predicate fragment that expresses the security restrictions applicable to a given function, object, instance type, and user. The caller specifies the desired statement form, including VPD (row-level security), EXISTS-based existence checks, or other usage, and may supply a table alias for the generated predicate.

Tables Accessed

The package reads and writes the core security and identity tables exposed through APPS synonyms. FND_GRANTS stores the grant records created, modified, and revoked by the API. FND_OBJECTS and FND_OBJECT_INSTANCE_SETS define the securable objects and their instance scopes, while FND_MENUS, FND_FORM_FUNCTIONS, and FND_COMPILED_MENU_FUNCTIONS supply the menu and function hierarchy used when resolving function-level security. FND_USER and WF_LOCAL_ROLES resolve the acting user and role definitions, and HZ_PARTIES supplies the party context for party-scoped grants. DUAL is referenced for single-row evaluations in the predicate generation logic.

Usage Notes

AMW_SECURITY_PUB is typically invoked from PL/SQL rather than directly from a form, although it may be called by forms-based administration screens and concurrent programs that maintain role assignments. The standard calling pattern requires an API version, returns a status string and error code, and, for creation and lookup operations, returns the grant GUID used by subsequent revoke or date-change calls. Because grant creation can be tuned with the existing-grant check flag, callers performing bulk or idempotent loads should set that parameter deliberately to avoid duplicate grants. The predicate generation function is most often consumed by dynamic SQL builders and VPD policies that must restrict query results to the objects a given user is authorized to see. Custom code should treat all procedures as public interfaces, respect the documented argument semantics, and never update the underlying FND tables directly, since doing so bypasses the validation and GUID management performed by this package.