Search Results jtf_auth_s1




Overview
Explore in AI Chat

Overview

The APPS.JTF_AUTH_SECURITY_PKG package body implements the authorization and permission-checking layer of the Oracle E-Business Suite CRM Foundation (JTF) security model. Its role is to resolve whether a given application user, acting within a named security domain, holds a specific permission through one or more assigned roles. In Oracle EBS 12.1.1 and 12.2.2 this package underpins the role-based access control (RBAC) framework used across CRM modules such as Oracle Sales, Service, and Trade Management, where access to functions, resources, and data is granted indirectly through roles rather than directly to users. The source header (JTFSEASB.pls 120.2) indicates the file is a shipped, release-controlled object, and the package is classified as a generic API (OTHER) in the ETRM 12.2.2 repository.

Key Procedures and Functions

  • CHECK_PERMISSION — The primary authorization routine. It accepts a user name, an optional domain name (defaulting to CRM_DOMAIN), and a permission name, and returns a numeric flag through x_flag together with an FND API return status. Internally it upper-cases the user and domain names and executes a single aggregate COUNT(*) across the six JTF authorization tables to determine whether an unbroken chain exists from the user principal to a role principal and onward to the named permission within the specified domain. A positive count yields x_flag := 1; otherwise x_flag := 0. The procedure is deliberately permissive in its exception handling: on TOO_MANY_ROWS it returns success with the flag set to 1, and on any other error it returns fnd_api.g_ret_sts_unexp_error.
  • ASSIGN_PERM — The maintenance counterpart, documented with parameters for role name, permission name (PERM_NAME — the object matched by the "perm_name" search), and application identifier. It resolves the supplied role name to upper case and, using an internal count, establishes (or verifies) the association between the role and the permission so that CHECK_PERMISSION subsequently recognizes the grant. It writes into the authorization mapping tables rather than merely querying them.

Tables Accessed

All access is performed through APPS synonyms. JTF_AUTH_PRINCIPALS_B stores principals (users and roles), and JTF_AUTH_PRINCIPAL_MAPS records the parent/child relationships that link a user to the roles granting that user privileges. JTF_AUTH_ROLE_PERMS maps roles to permissions, while JTF_AUTH_PERMISSIONS_B holds the permission definitions keyed by PERMISSION_NAME. JTF_AUTH_DOMAINS_B provides the domain partition (DOMAIN_NAME) that scopes the grant, typically CRM_DOMAIN. JTF_AUTH_S1 is referenced as an auxiliary security table. The package is referenced by two other packages, confirming its role as a shared dependency in the CRM security stack.

Usage Notes

CHECK_PERMISSION is typically invoked from Forms-level security checks, from server-side PL/SQL in CRM module code, and from custom extensions that need to enforce the same RBAC decisions as the standard application. Because it returns rather than raises on most conditions, callers should always test x_return_status before trusting x_flag. Domain-scoped checks should pass p_domain_name explicitly when operating outside CRM_DOMAIN. ASSIGN_PERM is intended for administrative or setup routines that establish role-permission grants; direct DML against the JTF_AUTH tables is not recommended. Note that permission names are matched case-sensitively against the stored value even though user and domain names are upper-cased by the package.