Results for “jtf_auth_principal_maps”

AI-generated from documented ETRM metadata — verify critical details on the linked pages.

Overview

JTF_AUTH_PRINCIPAL_MAPS is a core authorization mapping table owned by the JTF schema (CRM Foundation) in Oracle E-Business Suite 12.1.1 and 12.2.2. Its purpose is to grant roles to users within the Oracle EBS application security model. It does so by establishing a parent-child relationship between principal records: a user principal is recorded as the parent (JTF_AUTH_PARENT_PRINCIPAL_ID) of a role principal (JTF_AUTH_PRINCIPAL_ID), scoped to a specific authorization domain (JTF_AUTH_DOMAIN_ID). This structure enables domain-scoped role assignment, allowing the same user to hold different roles across different domains without ambiguity.

From a Data Vault modeling perspective, the metadata classifies this table heuristically as a link table. This reflects its nature as an associative structure connecting multiple hub entities — user principals, role principals, domains, and applications — rather than storing descriptive attributes about any single entity. In practice, this table functions as the authorization backplane that the JTF authentication and authorization framework consults at runtime to resolve effective user privileges.

Key Information Stored

The table contains 13 documented columns. The most significant include:

• JTF_AUTH_PRINCIPAL_MAPPING_ID — the surrogate primary key, enforcing uniqueness via the JTF_AUTH_PRINCIPAL_MAP_PK constraint. It is also referenced by the unique index JTF_AUTH_PRINCIPAL_MAPS_U1 alongside ZD_EDITION_NAME, making it the business-key candidate.
• JTF_AUTH_PRINCIPAL_ID — the role principal being granted (the child). Foreign key to JTF_AUTH_PRINCIPALS_B.
• JTF_AUTH_PARENT_PRINCIPAL_ID — the user principal receiving the role (the parent). Also a foreign key to JTF_AUTH_PRINCIPALS_B.
• JTF_AUTH_DOMAIN_ID — the authorization domain scoping the grant. Foreign key to JTF_AUTH_DOMAINS_B.
• APPLICATION_ID — the application context for the mapping. Foreign key to FND_APPLICATION.
• SECURITY_GROUP_ID — associates the row with a security group. Foreign key to FND_SECURITY_GROUPS.
• OBJECT_VERSION_NUMBER — optimistic locking column used by the ORM layer for concurrent update control.
• CREATED_BY, CREATION_DATE, LAST_UPDATED_BY, LAST_UPDATE_DATE, LAST_UPDATE_LOGIN — standard audit columns capturing who created and last modified each mapping, and when.
• ZD_EDITION_NAME — the editioning column used to support Edition-Based Redefinition (EBR) in 12.2.x.

Common Use Cases and Queries

This table is primarily consumed by the JTF authorization engine, but DBAs and developers query it directly to troubleshoot role assignments, audit privilege grants, and reconcile domain-scoped access. Typical queries include retrieving all roles granted to a given user, or all users holding a specific role within a domain. For example:

• Resolve effective roles for a user: SELECT JTF_AUTH_PRINCIPAL_ID FROM JTF_AUTH_PRINCIPAL_MAPS WHERE JTF_AUTH_PARENT_PRINCIPAL_ID = :user_id AND JTF_AUTH_DOMAIN_ID = :domain_id;
• Identify who holds a role: SELECT JTF_AUTH_PARENT_PRINCIPAL_ID FROM JTF_AUTH_PRINCIPAL_MAPS WHERE JTF_AUTH_PRINCIPAL_ID = :role_id;
• Audit recent grants by joining to JTF_AUTH_PRINCIPALS_B for principal names and filtering on LAST_UPDATE_DATE.

Reporting scenarios frequently join this table to FND_APPLICATION to confirm which application context a grant belongs to, and to FND_SECURITY_GROUPS when auditing cross-group access.

Related Objects

The table participates in several documented foreign-key relationships that define its integration footprint:

• JTF_AUTH_PRINCIPALS_B — referenced twice, by JTF_AUTH_PRINCIPAL_ID and JTF_AUTH_PARENT_PRINCIPAL_ID. This is the primary source for resolving principal names for both users and roles.
• JTF_AUTH_DOMAINS_B — referenced by JTF_AUTH_DOMAIN_ID; defines the domain scope for each grant.
• FND_APPLICATION — referenced by APPLICATION_ID; identifies the owning application.
• FND_SECURITY_GROUPS — referenced by SECURITY_GROUP_ID; ties the mapping to a security group context.
• JTF_AUTH_PRINCIPAL_DOMAINS and related JTF authorization views — commonly joined to translate domain identifiers into meaningful names for reporting and diagnostics.