Search Results set_host_acl

Overview

DBMS_NETWORK_ACL_ADMIN is a SYS-owned PL/SQL package that provides the programmatic interface for administering Oracle Database network access control lists (ACLs). Within Oracle E-Business Suite 12.1.1 and 12.2.2, it governs which database users and PL/SQL programs may initiate outbound network connections — for example, issuing HTTP requests via UTL_HTTP or sending mail via UTL_SMTP — and to which hosts, ports, and IP ranges those connections are permitted. Because EBS itself relies on outbound calls for functionality such as Payments, iSupplier, XML Gateway, and various integrations, the ACL configuration managed by this package is a prerequisite for any such call to succeed on a locked-down database. The EXECUTE privilege on the package is granted only to the DBA role by default, reflecting its privileged administrative nature. The package defines a rich set of named exceptions and PRAGMA EXCEPTION_INIT bindings (for example ace_already_exists −24243, acl_not_found −46114, invalid_host −24244, and privilege_not_granted −01927) that allow callers to trap precise failure conditions. It also exposes an IP_ADDR_MASK constant in the form '([[:digit:]]+\.){3}[[:digit:]]+' used to validate IPv4 address patterns.

Key Procedures and Functions

The 22 documented entry points group into ACL lifecycle, privilege management, assignment, and query operations.

• CREATE_ACL — creates a new named ACL with an initial privilege assignment.
• DROP_ACL — removes an existing ACL.
• ADD_PRIVILEGE / DELETE_PRIVILEGE — grant or revoke a privilege (typically connect or resolve) for a principal within an ACL.
• ASSIGN_ACL / UNASSIGN_ACL — bind or unbind an ACL to a host, optionally restricted by port and IP range.
• ASSIGN_WALLET_ACL / UNASSIGN_WALLET_ACL — associate or disassociate an ACL with an Oracle Wallet for credential-based connections.
• CHECK_PRIVILEGE / CHECK_PRIVILEGE_ACLID — test whether a given user holds a specified privilege, either by host or by numeric ACL identifier.
• APPEND_HOST_ACE / APPEND_HOST_ACL — add an access control entry or additional host rules to an existing host ACL.
• REMOVE_HOST_ACE — delete a specific ACE from a host ACL.
• APPEND_WALLET_ACE / APPEND_WALLET_ACL / REMOVE_WALLET_ACE — the equivalent ACE-level and ACL-level operations for wallet-based access.
• SET_HOST_ACL / SET_WALLET_ACL — assign an ACL to a host or wallet with a complete specification.
• GET_HOST_ACLIDS / GET_WALLET_ACLID — retrieve the ACL identifiers currently associated with a host or wallet.

Tables Accessed

The ETRM metadata lists no application tables referenced through APPS synonyms; the package operates directly on the SYS-owned ACL data dictionary views and base tables (principally the underlying ACL$, ACE$, and related ACL metadata), which reside in the database data dictionary rather than the EBS schema. These structures record the defined ACLs, their access control entries, and the host, port, and wallet assignments. Reads and writes therefore occur against dictionary objects owned by SYS.

Usage Notes

The package is normally invoked directly from SQL*Plus or a DBA script by a user holding the DBA role, not from EBS forms or concurrent programs, since it is not an application-layer API. Administrators use it to provision connectivity required by integrations; for example, enabling an outbound HTTP call to an endpoint such as a host referenced in a URL like "192.168.0.100/logout.php" requires first creating or appending a host ACL covering that address and port, then granting connect privilege to the calling schema. In EBS 12.2.x, where edition-based redefinition and stricter security baselines apply, ACL changes should be scripted and version-controlled as part of environment build. The documented package metadata records it as referenced by one other package. Because errors are surfaced through the documented exceptions, custom deployment scripts should include handlers for the enumerated error codes to make failures diagnosable.