Search Results hz_dss_util_pub




Overview
Explore in AI Chat

Overview

HZ_DSS_UTIL_PUB is a public PL/SQL package in the APPS schema that supports the Oracle E-Business Suite Trading Community Architecture (TCA) Data Sharing and Security (DSS) framework. Its role is to provide shared utility services that determine, assign, and enforce data security group membership for parties, party sites, contact points, locations, and related TCA entities. The package operates within Oracle EBS 12.1.1 and 12.2.2 and is classified as a public (PUB) API, indicating it is intended for invocation by other application modules and Oracle's own TCA public packages rather than being restricted to internal use.

The DSS model restricts a user's visibility of customer, supplier, and contact records to the data sharing groups to which the user has been granted access. HZ_DSS_UTIL_PUB centralizes the logic that resolves those group memberships, evaluates the business criteria that define each group, and assigns records into the appropriate group. Because the package is referenced by sixteen other packages in the APPS schema, it functions as a foundational dependency for TCA party, site, contact point, relationship, and import processing routines.

Key Procedures and Functions

The documented 12.2.2 metadata identifies seven procedures and functions:

  • GET_GRANTED_GROUPS — Returns the set of DSS groups to which a user has been explicitly granted access, derived from the FND_GRANTS and related foundation tables. It is typically the entry point for determining the security profile of the current session.
  • DETERMINE_DSS_GROUP — Evaluates the criteria associated with a DSS scheme or entity and determines the group or groups into which a given record should fall.
  • ASSIGN_DSS_GROUP — Writes the resolved group assignment back to the secured entity records so that subsequent queries and access checks honor the group membership.
  • GENERATE_PREDICATE — Constructs the SQL predicate (WHERE clause fragment) that restricts a query to the entities a user is permitted to see. This predicate is used by TCA views and APIs to enforce row-level security.
  • GET_DISPLAY_NAME — Resolves the display name associated with a DSS group or related entity for presentation in user interface contexts.
  • SWITCH_CONTEXT — Changes the security context used by calling programs, allowing logic to execute on behalf of a specific user or group during batch or administrative processing.
  • TEST_INSTANCE — A diagnostic utility used to validate that the DSS configuration for a given instance is correctly established.

Tables Accessed

HZ_DSS_UTIL_PUB reads and writes several TCA DSS tables. HZ_DSS_GROUPS_B stores the group definitions, HZ_DSS_CRITERIA and HZ_DSS_SCHEME_FUNCTIONS hold the rules and functions that define group membership, and HZ_DSS_ENTITIES and HZ_DSS_SECURED_ENTITIES map secured records to their resolved groups. HZ_CLASS_CODE_DENORM and HZ_CODE_ASSIGNMENTS provide classification data used in criteria evaluation. HZ_CONTACT_POINTS and HZ_LOCATIONS supply entity records subject to security. The package also accesses Oracle Foundation tables — FND_USER, FND_GRANTS, FND_OBJECTS, FND_OBJECT_INSTANCE_SETS, FND_FORM_FUNCTIONS, and FND_COMPILED_MENU_FUNCTIONS — to resolve the current user's privileges and menu-based access rights.

Usage Notes

HZ_DSS_UTIL_PUB is invoked indirectly through TCA public APIs such as HZ_PARTY_V2PUB, HZ_CONTACT_POINT_V2PUB, HZ_LOCATION_V2PUB, HZ_PARTY_SITE_V2PUB, HZ_RELATIONSHIP_V2PUB, and HZ_CLASSIFICATION_V2PUB, each of which calls the utility to resolve or enforce DSS group membership. It is also referenced by the HZ_IMP_LOAD_* interface programs that populate TCA entities from external sources, and by HZ_DUP_PVT and HZ_UI_UTIL_PKG. Custom code should not call this package directly unless replicating documented Oracle behavior, since the supported interface for party and contact point maintenance is the V2PUB family. Administrators should verify group assignment using TEST_INSTANCE after DSS configuration changes, and must ensure FND_GRANTS and object instance set data are correctly maintained, as incorrect privileges will cause the generated predicates to restrict visibility unexpectedly.