# JD Edwards Security Tables and Security Types: F00950, F95921, F98OWSEC, F9312 > Source: https://netray.co/tools/jde-security-tables-f00950-f95921-reference > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer The JDE 9.2 security tables with their real columns, plus the Security Workbench security types, what each controls and the precedence rules that trip people up. ## Category oracle ## Erp JD Edwards EnterpriseOne ## Audience - JDE security administrator - CNC administrator - IT auditor ## Tool **Kind:** worksheet **Mode:** reference **Columns:** #### Type **Key:** type **Type:** text #### Name **Key:** name **Type:** text #### FSSETY code / key **Key:** code **Type:** text #### What it controls or holds **Key:** controls **Type:** text #### Where set **Key:** where **Type:** text #### Gotcha **Key:** gotcha **Type:** text **Rows:** #### F00950 Security Workbench Table **Type:** Table **Code:** FSSETY, FSUSER, FSOBNM, FSDTAI, FSFRDV, FSSY **Controls:** All security records. FSUSER is a user, role or *PUBLIC, FSOBNM the object, FSFMNM the form. Separate flag columns hold run, install, view, add, change, delete, OK and copy authority **Where:** Security Workbench (P00950) **Gotcha:** Do not insert rows with SQL; the security cache on servers will not refresh correctly. #### F00950 range columns **Type:** Table **Code:** FSFRDV, FSTHDV, FSDTAI **Controls:** From and thru values and data item for row security **Where:** P00950 row security **Gotcha:** Row security on a data item only applies to tables where that item exists and is enabled for the table. #### F95921 Role Relationships **Type:** Table **Code:** RLFRROLE, RLTOROLE, RLEFFDATE **Controls:** User (RLFRROLE member) to role (RLTOROLE member of), effective and expiration dates (RLEFFDATE, RLEXPIRDATE), default role flag (RLDEFROLE) **Where:** Role Relationships (P95921) **Gotcha:** An expired relationship still exists as a row; filter on RLEXPIRDATE when auditing. #### F0092 User Profile **Type:** Table **Code:** ULUSER **Controls:** ULUGRP role/group, ULAN8 address number, user type **Where:** User Profiles (P0092) **Gotcha:** Roles are defined as user profiles too; check the user type to tell users from roles. #### F98OWSEC One World Security **Type:** Table **Code:** SCUSER **Controls:** System user (SCSECUSR), password change frequency (SCSECFRQ), last change (SCSECLST), allowed attempts, enabled flag (SCEUSER), force password change **Where:** Security Maintenance (P98OWSEC) **Gotcha:** Disabling a user here blocks sign-on but leaves roles and F00950 rows in place. #### F9312 Security History **Type:** Table **Code:** SHUSER, SHMKEY, SHUPMJ, SHUPMT **Controls:** Security events by user and machine: event type (SHEVTYP), event status (SHEVSTAT), sign-off date and time **Where:** Written by the system; review in security history inquiry **Gotcha:** Grows quickly; purge on a schedule your auditors agree. #### Processing Option and Data Selection **Type:** Security type **Code:** 5 **Controls:** Whether a user can change processing option values and data selection on versions **Where:** P00950, Setup Security **Gotcha:** Common answer to 'version security': lock prompting here and restrict who can change versions. #### Application **Type:** Security type **Controls:** Run and install access to applications, versions and forms **Where:** P00950, Setup Security **Gotcha:** Securing an application does not secure its business functions called from other apps. #### Action **Type:** Security type **Controls:** Add, change, delete, copy, OK/select and other form actions **Where:** P00950, Setup Security **Gotcha:** Action security on one form does not cover the same table maintained by another form. #### Row **Type:** Security type **Controls:** Which records (data item value ranges) a user can view, add, change or delete **Where:** P00950, Setup Security **Gotcha:** Row security is evaluated at the database level, so it also affects UBEs and can slow large reports. #### Column **Type:** Security type **Controls:** View and change access to a data item in a table, application or form **Where:** P00950, Setup Security **Gotcha:** Column security on a table column applies everywhere that column is shown. #### Tab **Type:** Security type **Controls:** Hide or disable tabs on forms **Where:** P00950, Setup Security **Gotcha:** Users can still reach the same fields from another form unless you secure those too. #### Hyper Exit **Type:** Security type **Controls:** Row and form exits (menu items) on forms **Where:** P00950, Setup Security **Gotcha:** Exits that call another app still need that app's application security. #### Exclusive Application **Type:** Security type **Controls:** Grants access to data through one application even if row security would block it **Where:** P00950, Setup Security **Gotcha:** Powerful override; document every exclusive application rule. #### External Calls **Type:** Security type **Controls:** Access to standalone executables called from the menu **Where:** P00950, Setup Security **Gotcha:** Rarely needed on web-only sites. #### Push Button, Link and Tab **Type:** Security type **Controls:** Visibility or enablement of buttons, links and tabs on forms **Where:** P00950, Setup Security **Gotcha:** Check web client form personalization does not re-expose controls. #### Text Block Control **Type:** Security type **Controls:** Text block controls on forms **Where:** P00950, Setup Security **Gotcha:** Easy to miss in audits. #### Data Browser **Type:** Security type **Controls:** Who can query tables and business views directly with Data Browser **Where:** P00950, Setup Security **Gotcha:** Data Browser bypasses application logic; restrict it for sensitive tables such as payroll and F98OWSEC. #### Published Business Services **Type:** Security type **Controls:** Access to published business services **Where:** P00950, Setup Security **Gotcha:** Service users need this plus the application and data security behind the service. #### UDO (user defined objects) **Type:** Security type **Controls:** Who can create, publish, approve or view queries, watchlists, pages, personal forms and other UDOs **Where:** P00950 and User Defined Object administration **Gotcha:** Publishing a UDO to *PUBLIC shares it with everyone; use roles. #### Precedence **Type:** Rule **Controls:** User level security is read first, then role, then *PUBLIC **Where:** System behaviour **Gotcha:** A user-level record overrides the role setting, so old user-level rows often explain 'why can he still do that'. #### Multiple roles **Type:** Rule **Controls:** When a user signs on with *ALL, security from the roles marked Include in *ALL in P95921 is combined **Where:** Role Relationships (P95921) **Gotcha:** Combining roles can open access that each role alone denies; test with the real role mix. **Notes:** Columns are from the 9.2 F00950, F95921, F98OWSEC, F9312 and F0092 table definitions. FSSETY values other than 5 (processing option and data selection) are not listed here: read them from your system with SELECT DISTINCT FSSETY on F00950 and match against the security type you set up in P00950. All these tables live in the System data source. ## Content **Intro:** A reference for the JD Edwards EnterpriseOne 9.2 security tables (F00950, F95921, F0092, F98OWSEC, F9312) with their real column names, plus the Security Workbench security types and the precedence rules that decide what a user can actually do. **Sections:** #### Where security lives **Body:** Security Workbench (P00950) writes every security record to F00950 in the System data source. The primary key is security type (FSSETY), user or role (FSUSER), object (FSOBNM), data item (FSDTAI), from value (FSFRDV) and product code (FSSY). Role membership is in F95921, keyed by member (RLFRROLE), role (RLTOROLE) and effective date. User profiles, including role profiles, are in F0092; passwords, system user mapping and sign-on controls are in F98OWSEC; and sign-on events are recorded in F9312. **Bullets:** - P00950: security records - P95921: user to role - P98OWSEC: passwords and system users #### How JDE resolves security **Body:** For each object the system checks for a record at user level first, then for the user's role, then for *PUBLIC. The first match wins, which is why a forgotten user-level record overrides a carefully designed role. When the user signs on with *ALL, roles flagged Include in *ALL are combined, so test with the real mix of roles rather than one role at a time. Row security is enforced at the database layer, so it affects batch jobs as well as interactive apps; application and action security apply only to the objects named. #### Worked example: who can change R42800 versions? **Body:** An auditor asks who can change processing options on Sales Update versions. Query F00950 for FSSETY = '5' and FSOBNM = 'R42800' to find processing option and data selection records by user, role and *PUBLIC. Then list members of each role from F95921 where RLTOROLE matches and RLEXPIRDATE is blank or in the future. Finally check F0092 for user-level overrides and F98OWSEC.SCEUSER for disabled users. The result is a list you can defend, built from the tables the system actually reads. #### Gotchas **Body:** Do not maintain F00950 with SQL: servers cache security and the change may not take effect until a cache clear, or may be overwritten. Security type codes differ from their names, so read FSSETY values from your own data rather than guessing. Data Browser and published business services are separate types; securing an application does not stop a user reading the same table in Data Browser. Keep F9312 history under a retention rule, because it grows with every sign-on. **Cta:** If your security admin wants to ask 'who can change this version' or 'which users have Data Browser' in plain English, answered from F00950 and F95921 on your own servers, we can set that up read only. **Faq:** #### What are the JD Edwards security tables? **Answer:** The main ones are F00950 (Security Workbench records), F95921 (role relationships), F0092 (user and role profiles), F98OWSEC (passwords and system user mapping) and F9312 (security history). All are in the System data source and are maintained through P00950, P95921, P0092 and P98OWSEC. #### Which JDE table links users to roles? **Answer:** F95921 Role Relationships. RLFRROLE is the member (user), RLTOROLE the role, RLEFFDATE and RLEXPIRDATE the effective and expiration dates, and RLDEFROLE marks the default role. Maintain it in P95921 rather than with SQL so the relationship dates and flags stay valid. #### How do I set version security in JDE? **Answer:** Use processing option and data selection security, security type 5 in F00950, set in Security Workbench (P00950). It controls whether users can change processing options and data selection on versions of an object. Combine it with application security on the version itself to control who can run it. #### What is the JDE security history table? **Answer:** F9312 Security History records security events by user and machine key with date and time, event type (SHEVTYP) and event status (SHEVSTAT), including sign-off date and time. Auditors use it for sign-on reviews. Agree a purge schedule because it grows quickly. ## Search terms jde security tables, jd edwards security tables, jde user role table, jde e1 security history table, jde security types, version security in jde, jde f00950 fssety, jde f95921 role relationships --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json