Search Results sync_roles_one_resp_secgrp

Overview

FND_USER_RESP_GROUPS_API is the Oracle E-Business Suite PL/SQL API responsible for maintaining the association between application users and the responsibilities and security groups assigned to them. Physically, this relationship is stored in FND_USER_RESP_GROUPS, but since Release 12 the assignment record is also the source of truth for the workflow role that grants a user access to a responsibility in a given security group. The package therefore performs two related jobs: it validates and writes user/responsibility/security group assignments, and it keeps the WF_LOCAL_ROLES role store synchronized with those assignments so that Oracle Workflow, Approvals, and function security evaluate the same access data as the EBS sign-on layer.

The package embeds the role naming convention FND_RESP|SECGRPKEY|APPSNAME|RESPKEY, which is what makes the identity of an assignment reproducible and comparable across the application. Several routines exist purely to generate or compare that name, and the package also exposes controlled upgrade entry points used when converting pre-R12 responsibility assignments into the role-based model. The object is a public API and is referenced by 28 other packages, so its contract is deliberately narrow and its validations are central rather than duplicated in calling code.

Key Procedures and Functions

• ASSIGNMENT_EXISTS — Determines whether a user already holds a specified responsibility/security group combination, allowing callers to avoid duplicate inserts.
• ASSIGNMENT_CHECK — Performs the full set of business validations for a proposed assignment before it is written.
• VALIDATE_SECURITY_CONTEXT — Confirms that the security context supplied with an assignment is valid for the responsibility.
• ROLE_NAME_FROM_RESP and ROLE_NAME_FROM_RESP_NO_EXC — Build the workflow role name from responsibility, application, and security group identifiers; the second variant suppresses exceptions so it can be used in lookups that must not fail.
• LOCK_ASSIGNMENT, INSERT_ASSIGNMENT, UPDATE_ASSIGNMENT — The low-level data manipulation routines that serialize access and create or modify the assignment row.
• UPLOAD_ASSIGNMENT and LOAD_ROW — Higher-level entry points that accept a complete assignment definition, validate it, and persist it, with LOAD_ROW following the standard EBS loader pattern used by bulk data tools.
• SYNC_ROLES_ONE_RESP_SECGRP, SYNC_ROLES_ALL_SECGRPS, SYNC_ROLES_ALL_RESPS, SYNC_ROLES_ALL_RESP_SECGRPS, SYNC_ROLES_ALL_SECGRPS_INT — The role synchronization family. These routines reconcile WF_LOCAL_ROLES with the current assignment data, from a single responsibility/security group pair up to a full system-wide resynchronization; the _INT variant is the internal worker used by the public wrappers.
• ONE_TIME_FURG_TO_WF_UPGRADE and UPGRADE_RESP_ROLE — One-time migration routines that convert existing responsibility assignments into workflow roles during the Release 12 upgrade path.

Tables Accessed

The package reads FND_USER, FND_RESPONSIBILITY, FND_RESPONSIBILITY_TL, FND_SECURITY_GROUPS, FND_SECURITY_GROUPS_TL, FND_APPLICATION, and FND_LANGUAGES to resolve and validate the user, responsibility, application, and security group involved in an assignment, including translated names. It writes the assignment itself into the user/responsibility/security group table and mirrors the resulting role into WF_LOCAL_ROLES, the Workflow directory that drives routing and approvals. WF_PARAMETER_LIST_T is used to pass parameter sets into workflow role maintenance, and DUAL supports scalar lookups and profile evaluation inside the validation logic.

Usage Notes

The package is normally invoked indirectly. The Users form and the responsibility assignment screens call it when a user is granted or revoked a responsibility, and the Release 12 upgrade and role synchronization concurrent programs call the SYNC_ROLES_* and ONE_TIME_FURG_TO_WF_UPGRADE routines to rebuild workflow roles. Custom integrations that provision users should call UPLOAD_ASSIGNMENT or LOAD_ROW rather than inserting into the assignment table directly, because only the API performs the security group validation and the matching WF_LOCAL_ROLES update. After any bulk change to assignments, the appropriate SYNC_ROLES routine should be run; a targeted call to SYNC_ROLES_ONE_RESP_SECGRP is sufficient when a single responsibility/security group pairing has changed, while SYNC_ROLES_ALL_RESP_SECGRPS is reserved for cases where the role store has become inconsistent.