Search Results hz_dss_grants_v




Overview
Explore in AI Chat

Overview

HZ_DSS_GRANTS_V is a security-related view owned by the APPS schema in Oracle E-Business Suite, delivered under the Receivables (AR) product family. It is part of the Oracle Data Security System (DSS) framework used by Oracle Customers Online and Trading Community Architecture (TCA) components to evaluate which grants, users, and responsibilities have been extended access to a specific DSS data object. The view exposes, for each grantee, a set of flag columns that indicate whether the grantee holds view, insert, update, or delete privileges against the DSS object named HZ_DSS_GROUPS. In practice, HZ_DSS_GRANTS_V is queried at runtime by DSS-driven application logic and by administrators performing security audits, so that access decisions are made against live FND_GRANTS and FND_MENUS data rather than a cached or duplicated grant table. The view is recorded as VALID in ETRM and reports directly against the underlying foundation security tables through synonyms.

Underlying Base Objects

The view is defined over three foundation objects referenced through APPS synonyms: FND_GRANTS, FND_MENUS, and FND_OBJECTS. FND_GRANTS serves as the driving table in the FROM clause and supplies OBJECT_ID, GRANTEE_TYPE, GRANTEE_KEY, and PROGRAM_TAG. FND_OBJECTS is joined to FND_GRANTS on OBJECT_ID and is filtered so that OBJ_NAME equals 'HZ_DSS_GROUPS', which restricts the result set to grants belonging to that single DSS object. FND_MENUS is not joined in the outer query; instead it is referenced inside four correlated scalar subqueries, each of which matches GV.MENU_ID to MV.MENU_ID and tests the menu name against a specific privilege menu. Each subquery is additionally capped with ROWNUM=1 to force a single-row result and prevent duplicate-row errors. The outer query uses SELECT DISTINCT, and the grantee set is limited to GRANTEE_TYPE values of 'USER', 'GLOBAL', and 'GROUP'.

Key Columns

The view exposes seven columns. DSS_GROUP_CODE carries the PROGRAM_TAG value from FND_GRANTS and identifies the DSS program or group context of the grant. DSS_GRANTEE_TYPE holds the grantee category, being one of USER, GLOBAL, or GROUP. DSS_GRANTEE_KEY holds the identifier for the specific grantee within that category. The four remaining columns are privilege flags derived from the correlated subqueries: VIEW_FLAG is populated with 'Y' when a matching grant exists for the HZ_DSS_SELECT menu; INSERT_FLAG corresponds to HZ_DSS_INSERT; UPDATE_FLAG corresponds to HZ_DSS_UPDATE; and DELETE_FLAG corresponds to HZ_DSS_DELETE. Each flag returns a null value when no matching menu grant is found, so consumers must treat null as "no privilege" rather than as an absence of data.

Common Use Cases and Queries

Typical uses include auditing who may view or modify DSS group definitions, troubleshooting access failures reported by DSS-enabled pages, and reconciling grant data after role or menu changes. A simple listing of all grantees and their effective privileges:

  • SELECT DSS_GROUP_CODE, DSS_GRANTEE_TYPE, DSS_GRANTEE_KEY, VIEW_FLAG, INSERT_FLAG, UPDATE_FLAG, DELETE_FLAG FROM APPS.HZ_DSS_GRANTS_V ORDER BY DSS_GRANTEE_TYPE, DSS_GRANTEE_KEY;
  • Filtering for users holding update rights: SELECT DSS_GRANTEE_KEY FROM APPS.HZ_DSS_GRANTS_V WHERE DSS_GRANTEE_TYPE = 'USER' AND UPDATE_FLAG = 'Y';
  • Detecting grantees with no privileges assigned: SELECT DSS_GRANTEE_KEY FROM APPS.HZ_DSS_GRANTS_V WHERE VIEW_FLAG IS NULL AND INSERT_FLAG IS NULL AND UPDATE_FLAG IS NULL AND DELETE_FLAG IS NULL;

Because FND_MENUS is referenced in the context of the user's search for "fnd_menus", it is worth noting that the privilege semantics of this view depend entirely on the menu names defined in FND_MENUS. Changes to the HZ_DSS_SELECT, HZ_DSS_INSERT, HZ_DSS_UPDATE, or HZ_DSS_DELETE menu definitions, or the grants that reference them, are reflected immediately in the view output. Queries should therefore be run with the APPS schema or an account holding SELECT privilege on FND_GRANTS, FND_MENUS, and FND_OBJECTS.