Search Results show_payroll

Overview

APPS.HR_SECURITY is the core PL/SQL security engine of Oracle Human Resources in Oracle E-Business Suite 12.1.1 and 12.2.2. It implements row-level and person-level access control by resolving the security profile assigned to the current user, responsibility, and business group, and then translating that profile into in-memory lists of permitted people, assignments, organizations, positions, and payrolls. Every HRMS form, concurrent process, and self-service page that displays person or assignment data relies on this package to decide which rows the session is entitled to see. The package maintains session-scoped global state—user, responsibility, security group, person, and effective date—and caches the resolved profile so that security decisions can be answered quickly without repeated database round trips. A companion section supports BIS/Discoverer reporting so that ad hoc queries respect the same security model as the forms.

Key Procedures and Functions

• GET_HR_SECURITY_CONTEXT — returns the current security context (user, responsibility, security group, person) for the session.
• GET_SECURITY_PROFILE — retrieves the security profile row applicable to the current user/responsibility combination.
• GLOBALS_NEED_REFRESHING — determines whether cached globals must be rebuilt, typically because the session, user, or responsibility changed.
• GET_SEC_PROFILE_BG_ID — returns the business group associated with the active security profile.
• GET_PERSON_ID — returns the person identifier for the current session context.
• VIEW_ALL — indicates whether the profile grants unrestricted (view-all) access, corresponding to the internal VIEW_ALL_PROFILE constant.
• SHOW_RECORD — validates general record visibility against the current profile.
• SHOW_PERSON — determines whether a given person is visible to the session.
• SHOW_BIS_RECORD — the BIS/Discoverer variant of record visibility checking.
• ADD_PERSON / ADD_ASSIGNMENT / ADD_ORGANIZATION / ADD_POSITION / ADD_PAYROLL — populate the in-memory security lists with the respective entities permitted by the profile.
• REMOVE_PERSON / DELETE_PER_FROM_LIST / DELETE_ORG_FROM_LIST / DELETE_LIST_FOR_BG — remove entries from the cached lists when the profile or business group changes.
• RESTRICT_ON_INDIVIDUAL_ASG — applies the profile’s restriction rules to individual assignments.
• RESTRICT_BY_SUPERVISOR_FLAG — enforces the supervisor-based restriction option of the security profile.

Tables Accessed

The package reads PER_SECURITY_PROFILES to resolve the active profile, and populates the security list tables PER_PERSON_LIST, PER_POSITION_LIST, and PER_ORGANIZATION_LIST as well as the ORG_ACCESS repository. Person data is validated against PER_ALL_PEOPLE_F. Organization hierarchy attributes are read from HR_ORGANIZATION_INFORMATION, and payroll scope is derived from PAY_PAYROLL_LIST. Recruitment team membership is checked through IRC_REC_TEAM_MEMBERS, and user identity through FND_USER and FND_ORACLE_USERID. The PLITBLM table is used for PL/SQL index-by-table handling. Writes are directed primarily at the list tables that persist the resolved security sets for the business group.

Usage Notes

HR_SECURITY is invoked automatically by HRMS forms, self-service pages, and concurrent programs through FND_GLOBAL.APPS_INITIALIZE and the standard security initialization sequence; developers rarely call it directly. Custom code that queries HRMS tables directly should invoke SHOW_PERSON or the list-population routines to respect the same security model, because bypassing it can expose unauthorized rows. The package is referenced by approximately 1,475 other packages in a standard 12.2.2 environment, confirming its role as a foundational dependency. The cached g_icx_session_id global allows the person list to be rebuilt on session switch even when user and responsibility remain unchanged. The presence of RESTRICT_ON_INDIVIDUAL_ASG and RESTRICT_BY_SUPERVISOR_FLAG explains why users sometimes see only a subset of people within an organization, a frequent support topic when searches for SHOW_PAYROLL or payroll-scoped data unexpectedly return no rows.