Results for “ibc_grants”

AI-generated from documented ETRM metadata — verify critical details on the linked pages.

Overview

The IBC_GRANTS table is a core security and authorization repository within the Oracle E-Business Suite IBC - Content Manager module. As documented in the ETRM metadata, it stores all permissions granted for a particular object, effectively acting as the assignment ledger that binds a grantee (a user or a resource) to a permission on a specific object. The table resides in the IBC schema and is marked VALID, with the primary key IBC_GRANTS_PK defined on GRANT_ID.

From a Data Vault modeling perspective, the FK structure mined from this table suggests a link classification: IBC_GRANTS connects independent entities — the object (FND_OBJECTS), the grantee user (FND_USER), the grant group (IBC_GRANT_GROUPS), and the security group (FND_SECURITY_GROUPS) — through foreign key relationships, rather than holding descriptive attributes of a single business entity. This heuristic should be treated as a modeling suggestion rather than a rigid architectural mandate.

Key Information Stored

The documented physical schema for 12.2.2 contains 17 columns. The most significant are summarized below.

• GRANT_ID — The surrogate primary key (IBC_GRANTS_PK) uniquely identifying each permission record.
• OBJECT_ID — Foreign key to FND_OBJECTS, identifying the object to which the permission applies; this is the central business-key candidate binding a grant to a target.
• PERMISSION_CODE — Encodes the specific permission being granted (for example, read, write, or administrative access) on the referenced object.
• GRANTEE_USER_ID — Foreign key to FND_USER, indicating the user receiving the grant.
• GRANTEE_RESOURCE_ID and GRANTEE_RESOURCE_TYPE — Identify non-user grantees (such as roles or resources) when the grantee is not a direct user.
• GRANT_GROUP_ID — Foreign key to IBC_GRANT_GROUPS, allowing multiple grants to be organized and inherited through a group construct.
• ACTION and GRANT_LEVEL — Define the operation permitted and the scope or granularity of the grant.
• CASCADE_FLAG — Indicates whether the grant propagates to subordinate objects.
• SECURITY_GROUP_ID — Foreign key to FND_SECURITY_GROUPS, isolating grants within the correct operating unit or security context.
• OBJECT_VERSION_NUMBER — Supports optimistic locking for concurrent updates through the OAF framework.
• CREATED_BY, CREATION_DATE, LAST_UPDATED_BY, LAST_UPDATE_DATE, LAST_UPDATE_LOGIN — Standard EBS audit columns tracking who created and last modified each grant.

Common Use Cases and Queries

Typical scenarios include auditing who holds permissions on a given object, reporting effective access for a user, and diagnosing why a user can or cannot view content in the Content Manager. A representative query joins the principal entities:

SELECT g.GRANT_ID, o.OBJECT_NAME, u.USER_NAME, g.PERMISSION_CODE, g.GRANT_LEVEL
FROM IBC_GRANTS g, FND_OBJECTS o, FND_USER u
WHERE g.OBJECT_ID = o.OBJECT_ID
AND g.GRANTEE_USER_ID = u.USER_ID
AND g.SECURITY_GROUP_ID = :p_security_group;

Additional reporting use cases include aggregating grants by GRANT_GROUP_ID to review inherited permissions, and filtering by CASCADE_FLAG to understand which grants propagate to child objects.

Related Objects

The following objects are most significant, derived from the documented foreign key relationships:

• FND_OBJECTS — joined via IBC_GRANTS.OBJECT_ID; defines the secured object.
• FND_USER — joined via IBC_GRANTS.GRANTEE_USER_ID; the user grantee.
• IBC_GRANT_GROUPS — joined via IBC_GRANTS.GRANT_GROUP_ID; the grant grouping construct.
• FND_SECURITY_GROUPS — joined via IBC_GRANTS.SECURITY_GROUP_ID; the security context.
• FND_OBJECT_INSTANCES — the object instance layer to which content-level grants are commonly resolved.
• IBC_GRANT_RESOURCES / IBC_PERMISSIONS — supplementary Content Manager tables describing resources and permission definitions referenced by GRANTEE_RESOURCE_ID and PERMISSION_CODE.