Search Results xs_data_security_util




Overview
Explore in AI Chat

Overview

The SYS.XS_DATA_SECURITY_UTIL package is a server-side PL/SQL utility belonging to Oracle's Cross-Schema (XS) security infrastructure, which underlies Oracle Label Security and the Virtual Private Database mechanisms relied upon by Oracle E-Business Suite. In the EBS 12.1.1 and 12.2.2 architectures, this package is owned by SYS and classified as a utility (UTIL) API rather than a business-facing application programming interface. Its principal business function is the administration of materialized views that back Access Control List (ACL) data used for data security enforcement. These ACL materialized views (ACLMVs) determine which database principals may access which rows. The package provides the means to schedule, alter, and purge the refresh operations that keep these security-relevant materialized views synchronized with their base tables. Because data security decisions depend on the freshness of ACL data, controlled refresh scheduling is a security-critical operation rather than a performance-tuning convenience.

Key Procedures and Functions

The ETRM metadata documents five procedures and functions within the package specification:

  • SCHEDULE_STATIC_ACL_REFRESH — Schedules an automatic refresh of an ACL materialized view for a given table. The procedure changes the refresh mode of the corresponding ACLMV to ON DEMAND and registers a repeat interval beginning at a specified start date. The source comments identify input parameters covering the owning schema, table name, start date, repeat interval, and comments.
  • ALTER_STATIC_ACL_REFRESH — Alters the refresh mode of an ACLMV for a given table and removes any refresh schedule previously established by SCHEDULE_STATIC_ACL_REFRESH. The only legal refresh-mode values documented are ON DEMAND and ON COMMIT.
  • PURGE_ACL_REFRESH_HISTORY — Removes historical refresh records associated with ACL materialized view maintenance, supporting housekeeping of the refresh audit trail.
  • XS$REFRESH_STATIC_ACL — Performs the actual refresh of a static ACL materialized view; this is the internal worker routine invoked when a scheduled or on-demand refresh is executed.
  • SET_TRACE_LEVEL — Controls the diagnostic trace verbosity for the package. This is the procedure most commonly sought by administrators and developers, since it is used to enable, adjust, or disable tracing when diagnosing ACL refresh behavior. The ETRM metadata does not publish its full parameter list, so its invocation signature should be confirmed against the database package specification before use in custom code.

Tables Accessed

The documented table reference for this package, accessible in EBS through APPS synonyms, is DBMS_MVIEW. This is the Oracle-supplied materialized view management package, invoked by XS_DATA_SECURITY_UTIL to perform refresh operations and to manipulate refresh scheduling for the ACL materialized views. No application-owned tables are documented as direct dependencies in the ETRM excerpt; the package instead operates on ACLMV objects identified at runtime by schema and table name.

Usage Notes

Because this package resides in the SYS schema and governs data-security metadata, it is not exposed through standard EBS forms and is not intended for direct invocation by end users. It is typically exercised by database administrators and by internal Oracle security components. In practice, administrators invoke procedures such as SET_TRACE_LEVEL from SQL*Plus or another privileged client when investigating ACL refresh failures or unexpected security behavior, and they use SCHEDULE_STATIC_ACL_REFRESH or ALTER_STATIC_ACL_REFRESH to govern refresh cadence during maintenance windows. The ETRM metadata notes that the package is referenced by one other package, confirming that it is a supporting component within a larger security framework. Custom code should reference it only with explicit DBA oversight, and parameter signatures should always be verified against the installed package specification for the specific EBS release, since the ETRM documentation publishes only partial parameter details.