Adminbeginner

User and Password Administration in EBS

Understand the standard mechanisms for managing user accounts, password policies, and account lifecycle in EBS

EBS user administration centers on FND_USER, where system administrators create, enable/disable, and manage password policies for application user accounts through the Users form (or, in more modern setups, through SSO/identity-provider-delegated administration where EBS accounts are provisioned automatically from a central identity system). Key administrative concerns include configuring appropriate password expiration policies (via profile options like Signon Password Hard to Guess, Signon Password Length, and Signon Password No Reuse), managing account lockout behavior after repeated failed login attempts, and periodically auditing for dormant or orphaned accounts (former employees whose accounts weren't properly deactivated).

Disabling rather than deleting a user account is like revoking someone's building access badge when they leave a company while keeping the security camera footage and visitor logs referencing their past visits intact — you cut off future access without erasing the historical record of what happened while they had access.

Key Concepts

1
A critical distinction technical consultants must understand is between disabling a user (setting an end date on FND_USER, preventing login but preserving all historical audit trail and transaction ownership references) versus actually deleting data — EBS never truly deletes FND_USER records in normal operation, since countless tables reference CREATED_BY/LAST_UPDATED_BY foreign keys back to user IDs, and removing a user record would orphan or corrupt historical audit trails across the entire system.
disablingdeletingCREATED_BYLAST_UPDATED_BY
2
For larger organizations, bulk user provisioning/deprovisioning integration (tying EBS account lifecycle to an HR system's hire/terminate events, often via custom API calls to FND_USER_PKG) is common, ensuring new employees get appropriate access promptly and terminated employees are disabled immediately as part of the standard offboarding process rather than relying on manual, potentially delayed administrative action.
bulk user provisioning/deprovisioningFND_USER_PKG
3
Interviewers frequently ask candidates to explain why EBS 'disables' rather than deletes users, and to describe how they'd design an automated user deprovisioning process tied to HR termination events to close a common security gap (terminated employees retaining active system access).