Search Results set_org_access

Overview

MO_GLOBAL is the core PL/SQL package in Oracle E-Business Suite that implements the Multi-Org Access Control (MOAC) security architecture. Owned by the APPS schema and classified under the OTHER API category, it governs how operating unit (OU) and security profile context is established, stored, and enforced within a database session. The package provides the underlying mechanism by which Oracle Forms, concurrent programs, and Java-based (JTT) clients restrict data access to the organizations a user is authorized to see.

First shipped alongside the MOAC feature set introduced in EBS 11.5.10 and carried forward through 12.1.1 and 12.2.2, MO_GLOBAL is referenced by over 1,100 other packages, making it one of the most widely depended-upon objects in the applications tier. Any code that reads organization-secured data — from Payables and Purchasing to Order Management and Inventory — ultimately relies on the context that MO_GLOBAL maintains.

Key Procedures and Functions

The package exposes 21 documented procedures and functions. The most commonly encountered include:

• INIT — Initialization routine for the Organization Security Policy. It is the first call made in a session to establish the MOAC environment for a given application short name; an overloaded form accepts a synchronization parameter.
• JTT_INIT — Variant of INIT intended for the JTT Java APIs. In addition to invoking the standard initialization, it sets the ICX session attribute JTTCURRENTORG when the temporary table holds exactly one record.
• SET_POLICY_CONTEXT — Establishes the policy context used by the organization security policy for the current session; a server-side counterpart, SET_POLICY_CONTEXT_SERVER, performs the equivalent operation in server contexts.
• SET_ORG_ACCESS — Builds the organization access list from the MO: Operating Unit and MO: Security Profile profile options, taking the operating unit identifier, security profile identifier, and application short name as inputs.
• SET_ORG_CONTEXT — Wrapper that populates the client-info area with the operating unit context and the organization access list for MOAC.
• CLEAR_CURRENT_ORG_CONTEXT — Clears the current organization context in the database session and resets the JTTCURRENTORG ICX session attribute.
• ORG_SECURITY and ORG_SECURITY_GLOBAL — Functions invoked by the Oracle server during SQL parsing to apply the organization security predicate to qualifying objects.
• CHECK_ACCESS, CHECK_VALID_ORG, GET_VALID_ORG, VALIDATE_ORGID_PUB_API — Validation routines that confirm whether a given organization identifier is accessible to the current user.
• GET_CURRENT_ORG_ID, GET_OU_NAME, GET_OU_COUNT, GET_OU_TAB — Accessors that return the active organization, its name, the number of accessible operating units, and the organization table respectively.
• GET_ACCESS_MODE, IS_MULTI_ORG_ENABLED, IS_MO_INIT_DONE — Status functions that report the current access mode and whether MOAC initialization has completed.

Tables Accessed

MO_GLOBAL reads from and writes to several key tables through APPS synonyms. FND_MO_PRODUCT_INIT and FND_MO_SP_PREFERENCES track product initialization state and security profile preferences. FND_PRODUCT_GROUPS supplies installation-level information, while FND_PROFILE_OPTION_VALUES provides the MO: Operating Unit and MO: Security Profile settings. MO_GLOB_ORG_ACCESS_TMP is the temporary table holding the session's organization access list. PER_ORGANIZATION_LIST and PER_SECURITY_PROFILES supply organization and security profile definitions. DBMS_SESSION and PLITBLM are used to manage session client-info and internal PL/SQL table structures.

Usage Notes

MO_GLOBAL is normally invoked automatically by the EBS framework rather than being called directly. Oracle Forms sessions call INIT through the standard form startup sequence; JTT clients use JTT_INIT; concurrent programs and server-side code rely on SET_POLICY_CONTEXT_SERVER and SET_ORG_ACCESS. Custom code that needs to honor MOAC should call INIT early in the session and SET_ORG_CONTEXT before querying organization-secured views. The presence of SET_POLICY_CONTEXT in the API surface is the mechanism most often referenced when developers search for how to switch operating unit context programmatically, and it should be used in preference to direct manipulation of session attributes.