Search Results view_all

Overview

APPS.HR_SECURITY is the core PL/SQL package that implements Oracle E-Business Suite security profile enforcement for Human Resources and related Oracle iRecruitment functionality. Its principal business purpose is to determine, at runtime, which organizations, people, positions, payrolls, and assignment records a given database session is permitted to see. The package resolves the identity of the current session, establishes the applicable security profile, and constructs the SQL predicate fragments that restrict queries against HR and related tables accordingly.

The central concept is the security profile. In HR security, security profile 0 is the seeded "view all" profile — it grants unrestricted access to all HR records. The package exposes a dedicated function, VIEW_ALL, to evaluate whether a session is operating under that unrestricted profile. All other profiles restrict access via the lists maintained in the security profile setup tables (organizations, people, positions, and payrolls). The header comments note that the package historically stored context in client_info but now caches it as a package global variable, and that all functions must assert at least the WNPS level. The package is referenced by 1,475 other packages, confirming it as a foundational dependency across the HR schema.

Key Procedures and Functions

The ETRM metadata documents 24 procedures and functions. The most significant include:

• GET_HR_SECURITY_CONTEXT — returns the security_profile_id cached for the current session; documented as HR development internal use only.
• GET_SECURITY_PROFILE — returns the security profile for the current user. For an APPS schema it returns the cached global value or 0 (the default "view all" profile if none is set); for a read-only schema it returns the profile associated with the reporting_oracle_username or raises an error; for a custom schema it returns the seeded "view all" profile (0).
• GLOBALS_NEED_REFRESHING — returns TRUE or FALSE indicating whether the HR globals have fallen out of synchronization with the FND globals, typically after a responsibility change.
• VIEW_ALL — the function most relevant to the current search; determines whether the session operates under the unrestricted "view all" security profile.
• GET_SEC_PROFILE_BG_ID and GET_PERSON_ID — resolve the business group and person context for restricted profiles.
• ADD_ASSIGNMENT, ADD_PERSON, ADD_ORGANIZATION, ADD_POSITION, ADD_PAYROLL — populate the in-memory restriction lists used to build security predicates.
• RESTRICT_ON_INDIVIDUAL_ASG and RESTRICT_BY_SUPERVISOR_FLAG — control restriction logic at the individual assignment and supervisory-hierarchy level.
• DELETE_LIST_FOR_BG, DELETE_PER_FROM_LIST, DELETE_ORG_FROM_LIST, REMOVE_PERSON — clear or prune the cached restriction lists.
• SHOW_RECORD, SHOW_PERSON, SHOW_BIS_RECORD — evaluate whether a specific record, person, or BIS record is visible under the active profile.

Tables Accessed

The package reads and writes the following documented tables via APPS synonyms:

• PER_SECURITY_PROFILES — the definition table for security profiles; source of the profile identifier and its attributes.
• PER_ORGANIZATION_LIST, PER_PERSON_LIST, PER_POSITION_LIST, PAY_PAYROLL_LIST — the profile restriction lists for organizations, people, positions, and payrolls respectively.
• PER_ALL_PEOPLE_F — used to resolve person records and to validate visibility of individuals.
• HR_ORGANIZATION_INFORMATION and ORG_ACCESS — support organization-level security resolution.
• FND_USER and FND_ORACLE_USERID — resolve the current user and the reporting/schema-level identity that maps to a profile.
• IRC_REC_TEAM_MEMBERS — supports iRecruitment recruiting-team visibility.
• PLITBLM — a PL/SQL index-by-table used within the package for in-memory list manipulation.

Usage Notes

HR_SECURITY is invoked implicitly by HR forms, concurrent programs, and virtually all HR report logic. Standard Oracle HRMS forms call the package during form initialization and after responsibility changes to establish the security context; GLOBALS_NEED_REFRESHING triggers re-resolution when the FND and HR globals diverge. Concurrent managers use GET_SECURITY_PROFILE to bind the "reporting" schema to its associated profile. Because it is referenced by 1,475 dependent packages, custom code that queries HR or PER tables should rely on this package rather than re-implementing security predicates. The presence of VIEW_ALL allows callers to short-circuit expensive restriction logic when a session is known to have unrestricted access, which is the standard optimization pattern in this package's consumers.