Adminbeginner
User and Password Administration in EBS
Understand the standard mechanisms for managing user accounts, password policies, and account lifecycle in EBS
User accounts live in FND_USER, managed through the Users form or provisioned from a central identity system where SSO is in place.
Disabling rather than deleting a user account is like revoking someone's building access badge when they leave a company while keeping the security camera footage and visitor logs referencing their past visits intact — you cut off future access without erasing the historical record of what happened while they had access.
Key Concepts
1
Password policy comes from profile options.
Signon Password Length minimum characters
Signon Password Hard to Guess complexity requirements
Signon Password No Reuse how many before reuse
Signon Password Failure Limit attempts before lockout2
The distinction that matters: end-date or disable, never delete.
end-date the account the user cannot log in.
Their history is intact.
delete the row referential integrity breaks3
Every EBS table carries CREATED_BY and LAST_UPDATED_BY pointing at FND_USER. Delete the user and every
record they ever touched references a user that no longer exists.
CREATED_BYLAST_UPDATED_BYFND_USER
4
So the audit trail — who created this invoice — is destroyed, permanently, for the whole history.
End-dating preserves it and achieves the same access outcome.
5
Dormant accounts are the recurring audit finding. Somebody leaves, HR knows, IT knows, and the EBS
account is still active because nobody told the EBS administrator.
6
The mitigations are a periodic review of accounts with no recent login, and — the better answer — SSO, so
that disabling the central account ends EBS access without anyone remembering EBS exists.
7
Shared and generic accounts are the other finding. An account several people use means the audit trail
records the account rather than the person, and nothing can be attributed.
8
They usually exist because a genuine need was solved badly — an interface needing to log in, or a test
account that became operational.
9
Responsibility assignment is where least privilege happens. A user accumulates responsibilities as
their job changes and rarely loses any, so after a few years they hold access to areas they left long ago.
10
End-dating responsibility assignments when somebody moves is the discipline, and a periodic review of who
holds what is how the drift is caught.
11
Where SSO changes this. Authentication moves out and provisioning can be automated, but responsibility
assignment remains an EBS decision — so SSO solves the account lifecycle and not the access review.
12
What the interviewer is probing.1. "How are passwords controlled?" Probing: the mechanism. Stalls: "A setting." Moves up:
profile options for length, complexity, expiry and failed login limits, applied at site level.
13
2. "What is the end-dating practice for leavers?" Probing: the control. Stalls: "Delete the
user." Moves up: end-date the FND user rather than deleting, so the audit trail on their
transactions remains intact.
14
3. "Why are shared accounts a problem?" Probing: the audit angle. Stalls: "Convenience."
Moves up: actions cannot be attributed to a person, which breaks segregation of duties and any
investigation.
15
4. "What should be reviewed periodically?" Probing: the governance. Stalls: "Nothing."
Moves up: responsibility assignments against roles, dormant accounts, and anyone holding both ends
of a segregation-of-duties pair.