Results for “xs_diag”

AI-generated from documented ETRM metadata — verify critical details on the linked pages.

Overview

SYS.XS_DIAG is a diagnostic utility package belonging to Oracle's Cross-Scheme (XS) security infrastructure, the framework that underpins Oracle Label Security and the fine-grained access control mechanisms embedded in the database tier of Oracle E-Business Suite. In EBS 12.1.1 and 12.2.2 the package is owned by SYS and is declared with AUTHID CURRENT_USER, meaning that all validation executions run with the privileges of the invoking schema rather than the definer. This design allows administrators and support engineers to interrogate the consistency of security policies, principals, rolesets, and access control lists without requiring elevated SYS credentials.

The package's business purpose is validation rather than enforcement. It inspects metadata held in the XS data dictionary, comparing policy and object definitions against internal expectations, and records each inconsistency it discovers into a validation table (XS$VALIDATION_TABLE) up to a caller-specified error limit. The API classification recorded in the ETRM repository is OTHER, reflecting its role as an internal diagnostic facility rather than a documented end-user interface.

Key Procedures and Functions

The documented API exposes seven validation procedures and functions, all sharing a common error-limit parameter that caps the number of inconsistencies written to the validation table. A package-level exception, EXCP_INVALID_MSG_MAX, is raised when the maximum message count is set below one.

• VALIDATE_PRINCIPAL — confirms that a named principal (user or group) is correctly registered and consistent within the XS security model.
• VALIDATE_ROLESET — checks the integrity of a named roleset and its associated role memberships.
• VALIDATE_SECURITY_CLASS — verifies the definition of a security class, including its hierarchy and labeling attributes.
• VALIDATE_ACL — validates an access control list, ensuring the ACL entries are complete and internally consistent.
• VALIDATE_DATA_SECURITY — performs the broadest check, offering three validation styles: policy against all applied tables, policy against a specific table, or all policies applied to a specific table. When table_owner is omitted, the current schema is assumed.
• VALIDATE_NAMESPACE_TEMPLATE — inspects namespace templates for structural correctness.
• VALIDATE_WORKSPACE — checks workspace definitions used for policy authoring and staging.

Tables Accessed

The package writes identified inconsistencies into XS$VALIDATION_TABLE, inserting one row per detected problem until the caller-supplied error_limit is reached. The excerpt provided does not enumerate the base XS dictionary tables read by each validation routine; these are implicitly the policy, principal, roleset, ACL, and namespace metadata tables owned by SYS in the XS schema. No APPS synonyms for referenced tables are documented in the ETRM metadata.

Usage Notes

XS_DIAG is invoked programmatically rather than through standard EBS forms. It is most commonly executed by DBAs and Oracle Support during troubleshooting of label security, data security policies, or ACL misconfiguration, frequently from SQL*Plus or a diagnostic script running as a user with EXECUTE privilege on the package. The ETRM record notes that it is referenced by one other package, confirming its role as a supporting library. Because it uses AUTHID CURRENT_USER, results depend on the invoking schema's visibility of the target objects, making explicit qualification of table_owner advisable in multi-schema environments.