Search Results revoke_dependant_grants




Overview
Explore in AI Chat

Overview

AMW_SECURITY_UTILS_PVT is a private PL/SQL package body owned by APPS that provides the security-granting engine for Oracle E-Business Suite's Application Management Workbench (AMW) and its Integration Repository / ETRM security model. Its central purpose is to translate the role-mapping definitions stored in AMW_SECURITY_ROLE_MAPPINGS into actual menu-based grants on child objects, propagating grants from a parent object and parent role down to the dependent child objects and instance sets that logically inherit them. In effect, the package implements "dependant instance set based grant on child object" semantics, issuing grants automatically whenever a parent grant is created, modified, or removed.

The package is classified as PVT, meaning it is not a public API and is intended to be called only from other AMW security packages. The ETRM metadata records that two other packages reference it, confirming its role as an internal helper that encapsulates the grant/revoke logic shared by the broader security framework. By centralizing this logic, AMW_SECURITY_UTILS_PVT ensures that dependent grants remain consistent with their parent grants and that revocation cascades correctly when a parent grant is withdrawn.

Key Procedures and Functions

  • GIVE_DEPENDANT_GRANTS — Creates dependent grants on child objects in response to a new parent grant. It reads the applicable role mappings, resolves the effective child role name (handling the 'ANY' parent role and 'SAME' child role conventions), and calls FND_GRANTS_PKG.GRANT_FUNCTION for each child object and instance set. The documented header shows parameters for grant GUID, parent object name, parent role, parent primary keys, grantee type and key, and start/end dates, with boolean success and error code outputs.
  • UPDATE_DEPENDANT_GRANTS — Reconciles dependent grants when an existing parent grant changes, ensuring the child grants reflect the new parent role, grantee, or effective-dating information.
  • REVOKE_DEPENDANT_GRANTS — Removes the dependent grants previously created for a parent grant. This is the procedure most commonly associated with the search term "revoke_dependant_grants" and is the counterpart to GIVE_DEPENDANT_GRANTS.
  • GET_PARTY_ID — Resolves the party identifier associated with a user or grantee, supporting grantee resolution during grant processing.
  • CHECK_FUNCTION — Validates whether a function is granted to a given user or role, providing a security check used by callers before or after grant operations.

Tables Accessed

  • AMW_SECURITY_ROLE_MAPPINGS — The driving configuration table. It defines parent-to-child object and role mappings used to determine which dependent grants must be created, updated, or revoked.
  • FND_GRANTS — Stores the base grant records. The package reads existing grants and delegates creation through FND_GRANTS_PKG, which writes to this table.
  • FND_USER — Used for party and user resolution when determining grantee eligibility.
  • PLITBLM — The standard PL/SQL index-by table used internally for bulk operations and cursor processing.

Usage Notes

AMW_SECURITY_UTILS_PVT is invoked indirectly by the AMW security framework rather than by end users. The typical call path originates from a public grant or revoke action — for example, when an administrator assigns a menu or role through an AMW-enabled form, or when a concurrent program processes security synchronization — and the calling package delegates to this private package to propagate or remove the dependent child grants. Because it is a PVT API, custom code should not call these procedures directly; supported integration points are the public security APIs that internally reference this package. The revoke_dependant_grants procedure is most relevant when security administrators need to understand how revoking a parent role removes the automatically generated "AMW_AUTOMATIC_DEPENDANT_GRANT" records on child objects, and troubleshooting those cascades typically begins with the AMW_SECURITY_ROLE_MAPPINGS configuration and the resulting FND_GRANTS rows.