Integrigy, the security specialist company has recommended that APPLSYSPUB user should have only the following grants:
INSERT ON FND_UNSUCCESSFUL_LOGINS
INSERT ON FND_SESSIONS
EXECUTE ON FND_DISCONNECTED
EXECUTE ON FND_MESSAGE
EXECUTE ON FND_PUB_MESSAGE
EXECUTE ON FND_SECURITY_PKG
EXECUTE ON FND_SIGNON
EXECUTE ON FND_WEBFILEPUB
SELECT ON FND_APPLICATION
SELECT ON FND_APPLICATION_TL
SELECT ON FND_APPLICATION_VL
SELECT ON FND_LANGUAGES_TL
SELECT ON FND_LANGUAGES_VL
SELECT ON FND_LOOKUPS
SELECT ON FND_PRODUCT_GROUPS
SELECT ON FND_PRODUCT_INSTALLATIONS
These permissions are set in –
To check permissions –
SELECT * FROM dba_tab_privs
where grantee = 'APPLSYSPUB'
I opened $FND_TOP/admin/sql/afpub.sql and checked it:
REM Sample Syntax: START afpub applsys fnd applpub pub
which is incorrect because there is no user called applpub, so I changed it to :
@afpub applsys fnd applsyspub pub
The script was executed without issues. But in a minute or so, I was informed that none of the forms were opening and users were getting an error window like this:
APP-FND-01564: ORACLE error 980 in fdulictx
Cause: fdulictx failed due to ORA-00980 synonym translation is no longer valid
The SQL statement being executed at the time of the error was:
select LANGUAGE_CODE,DESCRIPTION, INSTALLED_FLAG
from FND_LANGUAGES_VL
where INSTALLED_FLAG in ('I','B')
order by LANGUAGE_CODE
and was executed from the file &ERRFILE.
On pressing Ok, a new error window would show this message:
FRM-10221: Cannot read file $AU_TOP/resource/stub/FNDM...
I realised that I should not have run that script when the instance was up and running. After informing users, I immediately shutdown the instance, started adadmin and ran "Recreate GRANTS and synonyms" after which I ran "Compile APPS schema". Once these tasks were complete, I restarted all the services. The problem had disappeared. While running "Recreate grants and synonyms", I saw that afpub.sql was being called by it. So, if you do "Recreate grants and synonyms" with adadmin, the security recommendation is automatically implemented.
Posts
