Oracle EBS Security Under Control: Automated Audits with FND Tables

1. Security Model Overview

Oracle EBS security is built on a multi-layer authorization model:

  • FND_USER → user identity

  • FND_RESPONSIBILITY → functional access

  • FND_USER_RESP_GROUPS → assignment mapping

Unlike database roles, EBS responsibilities bypass DB-level privileges, making periodic audits critical.

2. Why SYSADMIN Access Is Technically Dangerous

The SYSADMIN responsibility provides:

  • Full access to AOL

  • User creation/modification

  • Concurrent program control

  • Profile option overrides

From a technical standpoint:

  • SYSADMIN users can disable auditing

  • Modify menu exclusions

  • Alter request sets impacting business logic

Hence, SYSADMIN access should be minimal and traceable.

3. Script Objective

The ebs_security_audit.sh script automates:

  • Identification of active SYSADMIN assignments

  • Detection of generic/system users

  • Validation of user lifecycle controls

This removes dependency on manual UI-based reviews.

4. Script Logic Breakdown

📜 SYSADMIN User Identification

select fu.user_name
from fnd_user fu, fnd_user_resp_groups urg
where fu.user_id = urg.user_id
and urg.responsibility_id = 20420
and fu.end_date is null;

✔ Uses responsibility_id, not name 
✔ Filters only active users
✔ Accurate even if responsibility name is customized

📜 Generic Account Detection

select user_name, creation_date
from fnd_user
where user_name like 'SYS%'
and end_date is null;

✔ Flags technical users commonly overlooked
✔ Helps identify shared or orphaned accounts

5. Audit Interpretation

Finding Risk
Multiple SYSADMIN users Segregation of duties violation
Generic users active Non-repudiation risk
Old accounts without end date Audit failure
Unknown responsibility owners Insider threat

6. Production Best Practices

  • Enforce quarterly responsibility reviews

  • Combine with FND_AUDIT trail

  • Log script output for historical comparison

  • Integrate with SOX / ISO control evidence

7. Conclusion

Oracle EBS security is application-driven, not database-driven.
Without automated audits, excessive privileges can remain undetected for years.

This script provides a repeatable, evidence-backed approach to securing EBS environments while reducing audit effort and risk exposure.

Recent Posts