OracleFree referencePDF, Excel, Word exportJD Edwards EnterpriseOneAll JD Edwards EnterpriseOne tools

JD Edwards Security Tables and Security Types: F00950, F95921, F98OWSEC, F9312

A reference for the JD Edwards EnterpriseOne 9.2 security tables (F00950, F95921, F0092, F98OWSEC, F9312) with their real column names, plus the Security Workbench security types and the precedence rules that decide what a user can actually do.

Download:

Type	Name	FSSETY code / key	What it controls or holds	Where set	Gotcha
Table	F00950 Security Workbench Table	FSSETY, FSUSER, FSOBNM, FSDTAI, FSFRDV, FSSY	All security records. FSUSER is a user, role or *PUBLIC, FSOBNM the object, FSFMNM the form. Separate flag columns hold run, install, view, add, change, delete, OK and copy authority	Security Workbench (P00950)	Do not insert rows with SQL; the security cache on servers will not refresh correctly.
Table	F00950 range columns	FSFRDV, FSTHDV, FSDTAI	From and thru values and data item for row security	P00950 row security	Row security on a data item only applies to tables where that item exists and is enabled for the table.
Table	F95921 Role Relationships	RLFRROLE, RLTOROLE, RLEFFDATE	User (RLFRROLE member) to role (RLTOROLE member of), effective and expiration dates (RLEFFDATE, RLEXPIRDATE), default role flag (RLDEFROLE)	Role Relationships (P95921)	An expired relationship still exists as a row; filter on RLEXPIRDATE when auditing.
Table	F0092 User Profile	ULUSER	ULUGRP role/group, ULAN8 address number, user type	User Profiles (P0092)	Roles are defined as user profiles too; check the user type to tell users from roles.
Table	F98OWSEC One World Security	SCUSER	System user (SCSECUSR), password change frequency (SCSECFRQ), last change (SCSECLST), allowed attempts, enabled flag (SCEUSER), force password change	Security Maintenance (P98OWSEC)	Disabling a user here blocks sign-on but leaves roles and F00950 rows in place.
Table	F9312 Security History	SHUSER, SHMKEY, SHUPMJ, SHUPMT	Security events by user and machine: event type (SHEVTYP), event status (SHEVSTAT), sign-off date and time	Written by the system; review in security history inquiry	Grows quickly; purge on a schedule your auditors agree.
Security type	Processing Option and Data Selection	5	Whether a user can change processing option values and data selection on versions	P00950, Setup Security	Common answer to 'version security': lock prompting here and restrict who can change versions.
Security type	Application		Run and install access to applications, versions and forms	P00950, Setup Security	Securing an application does not secure its business functions called from other apps.
Security type	Action		Add, change, delete, copy, OK/select and other form actions	P00950, Setup Security	Action security on one form does not cover the same table maintained by another form.
Security type	Row		Which records (data item value ranges) a user can view, add, change or delete	P00950, Setup Security	Row security is evaluated at the database level, so it also affects UBEs and can slow large reports.
Security type	Column		View and change access to a data item in a table, application or form	P00950, Setup Security	Column security on a table column applies everywhere that column is shown.
Security type	Tab		Hide or disable tabs on forms	P00950, Setup Security	Users can still reach the same fields from another form unless you secure those too.
Security type	Hyper Exit		Row and form exits (menu items) on forms	P00950, Setup Security	Exits that call another app still need that app's application security.
Security type	Exclusive Application		Grants access to data through one application even if row security would block it	P00950, Setup Security	Powerful override; document every exclusive application rule.
Security type	External Calls		Access to standalone executables called from the menu	P00950, Setup Security	Rarely needed on web-only sites.
Security type	Push Button, Link and Tab		Visibility or enablement of buttons, links and tabs on forms	P00950, Setup Security	Check web client form personalization does not re-expose controls.
Security type	Text Block Control		Text block controls on forms	P00950, Setup Security	Easy to miss in audits.
Security type	Data Browser		Who can query tables and business views directly with Data Browser	P00950, Setup Security	Data Browser bypasses application logic; restrict it for sensitive tables such as payroll and F98OWSEC.
Security type	Published Business Services		Access to published business services	P00950, Setup Security	Service users need this plus the application and data security behind the service.
Security type	UDO (user defined objects)		Who can create, publish, approve or view queries, watchlists, pages, personal forms and other UDOs	P00950 and User Defined Object administration	Publishing a UDO to *PUBLIC shares it with everyone; use roles.
Rule	Precedence		User level security is read first, then role, then *PUBLIC	System behaviour	A user-level record overrides the role setting, so old user-level rows often explain 'why can he still do that'.
Rule	Multiple roles		When a user signs on with ALL, security from the roles marked Include in ALL in P95921 is combined	Role Relationships (P95921)	Combining roles can open access that each role alone denies; test with the real role mix.

Columns are from the 9.2 F00950, F95921, F98OWSEC, F9312 and F0092 table definitions. FSSETY values other than 5 (processing option and data selection) are not listed here: read them from your system with SELECT DISTINCT FSSETY on F00950 and match against the security type you set up in P00950. All these tables live in the System data source.

Get a role and access review pack

Send your role list and we will return read-only queries for user-level overrides, expired roles and Data Browser access.

Optional. The tool and every export work without this. No spam.

Was this tool useful?

Where security lives

Security Workbench (P00950) writes every security record to F00950 in the System data source. The primary key is security type (FSSETY), user or role (FSUSER), object (FSOBNM), data item (FSDTAI), from value (FSFRDV) and product code (FSSY). Role membership is in F95921, keyed by member (RLFRROLE), role (RLTOROLE) and effective date. User profiles, including role profiles, are in F0092; passwords, system user mapping and sign-on controls are in F98OWSEC; and sign-on events are recorded in F9312.

P00950: security records
P95921: user to role
P98OWSEC: passwords and system users

How JDE resolves security

For each object the system checks for a record at user level first, then for the user's role, then for *PUBLIC. The first match wins, which is why a forgotten user-level record overrides a carefully designed role. When the user signs on with *ALL, roles flagged Include in *ALL are combined, so test with the real mix of roles rather than one role at a time. Row security is enforced at the database layer, so it affects batch jobs as well as interactive apps; application and action security apply only to the objects named.

Worked example: who can change R42800 versions?

An auditor asks who can change processing options on Sales Update versions. Query F00950 for FSSETY = '5' and FSOBNM = 'R42800' to find processing option and data selection records by user, role and *PUBLIC. Then list members of each role from F95921 where RLTOROLE matches and RLEXPIRDATE is blank or in the future. Finally check F0092 for user-level overrides and F98OWSEC.SCEUSER for disabled users. The result is a list you can defend, built from the tables the system actually reads.

Gotchas

Do not maintain F00950 with SQL: servers cache security and the change may not take effect until a cache clear, or may be overwritten. Security type codes differ from their names, so read FSSETY values from your own data rather than guessing. Data Browser and published business services are separate types; securing an application does not stop a user reading the same table in Data Browser. Keep F9312 history under a retention rule, because it grows with every sign-on.

Frequently Asked Questions

What are the JD Edwards security tables?

The main ones are F00950 (Security Workbench records), F95921 (role relationships), F0092 (user and role profiles), F98OWSEC (passwords and system user mapping) and F9312 (security history). All are in the System data source and are maintained through P00950, P95921, P0092 and P98OWSEC.

Which JDE table links users to roles?

F95921 Role Relationships. RLFRROLE is the member (user), RLTOROLE the role, RLEFFDATE and RLEXPIRDATE the effective and expiration dates, and RLDEFROLE marks the default role. Maintain it in P95921 rather than with SQL so the relationship dates and flags stay valid.

How do I set version security in JDE?

Use processing option and data selection security, security type 5 in F00950, set in Security Workbench (P00950). It controls whether users can change processing options and data selection on versions of an object. Combine it with application security on the version itself to control who can run it.

What is the JDE security history table?

F9312 Security History records security events by user and machine key with date and time, event type (SHEVTYP) and event status (SHEVSTAT), including sign-off date and time. Auditors use it for sign-on reviews. Agree a purge schedule because it grows quickly.

If your security admin wants to ask 'who can change this version' or 'which users have Data Browser' in plain English, answered from F00950 and F95921 on your own servers, we can set that up read only.

Talk to an Expert Explore More Free Tools