# Unable to Provision Oracle EBS user accounts after EBS QA Refresh **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** connectors, provisioning, identity-security-cloud\ **Created:** [March 17, 2025, 6:21pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350 "2025-03-17T18:21:33Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![mikenawara](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mikenawara](https://developer.sailpoint.com/discuss/u/mikenawara)\ **Post date:** [March 17, 2025, 6:21pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/1 "2025-03-17T18:21:33Z")
Hello, I am working with or Oracle EBS team and we are encountering the following error: [“[ConnectorException] \n [Error details] Error occurred during Provisioning operation. Please check the logs. Error: ORA-06550: line 1, column 7:\nPLS-00904: insufficient privilege to access object APPS.FND\_GLOBAL\nORA-06550: line 1, column 7:\nPL/SQL: Statement ignored\n\n[[https://docs.oracle.com/error-help/db/ora-06550/“,”[](https://docs.oracle.com/error-help/db/ora-06550/“,”[)](https://docs.oracle.com/error-help/db/ora-06550/%22,%22%5B%5D(https://docs.oracle.com/error-help/db/ora-06550/%22,%22%5B)) ConnectorException ] \n [Error details] Error occurred during Provisioning operation. Please check the logs. Error: ORA-06550: line 1, column 7:\nPLS-00904: insufficient privilege to access object APPS.FND\_GLOBAL\nORA-06550: line 1, column 7:\nPL/SQL: Statement ignored\n\n[[ORA-06550 - Database Error Messages](https://docs.oracle.com/error-help/db/ora-06550/)”]]([ORA-06550 - Database Error Messages](https://docs.oracle.com/error-help/db/ora-06550/%22)]) We do not see any changes in the FND\_USER\_PKG files. ![image](https://global.discourse-cdn.com/sailpoint/original/3X/f/2/f2651314173018b0ae3ddfd66c13463bd195f9bf.jpeg) - What have you tried? We have re-issued our grants as the service account user for the synonyms. - What is the result you are getting and what were you expecting? EBS account is not being created. I am admittedly not a Oracle EBS expert and primarily work on the SailPoint integrations side. Just looking for any guideance. Thank you! ---
**Author:** ![mikenawara](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mikenawara](https://developer.sailpoint.com/discuss/u/mikenawara)\ **Post date:** [March 17, 2025, 6:50pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/2 "2025-03-17T18:50:53Z")
I am sorry…I posted a slightly different error. This is the error we are getting (not GLOBAL): [“[ConnectorException] \n [Error details] Error occurred during Create operation. Please check the logs. Error: ORA-06550: line 1, column 7:\nPLS-00904: insufficient privilege to access object APPS.FND\_USER\_PKG\nORA-06550: line 1, column 7:\nPL/SQL: Statement ignored\n\n[[https://docs.oracle.com/error-help/db/ora-06550/“,”[](https://docs.oracle.com/error-help/db/ora-06550/“,”[)](https://docs.oracle.com/error-help/db/ora-06550/%22,%22%5B%5D(https://docs.oracle.com/error-help/db/ora-06550/%22,%22%5B)) ConnectorException ] \n [Error details] Error occurred during Create operation. Please check the logs. Error: ORA-06550: line 1, column 7:\nPLS-00904: insufficient privilege to access object APPS.FND\_USER\_PKG\nORA-06550: line 1, column 7:\nPL/SQL: Statement ignored\n\n[[ORA-06550 - Database Error Messages](https://docs.oracle.com/error-help/db/ora-06550/)”]]([ORA-06550 - Database Error Messages](https://docs.oracle.com/error-help/db/ora-06550/%22)]) ---
**Author:** ![agutschow](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/agutschow/32/8543_2.png) [@agutschow](https://developer.sailpoint.com/discuss/u/agutschow)\ **Post date:** [March 17, 2025, 7:09pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/3 "2025-03-17T19:09:35Z")
I would check the execute permissions that are mentioned here: [Required Permissions](https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/help/integrating_oracle_ebs/required_permissions.html) ---
**Author:** ![mikenawara](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mikenawara](https://developer.sailpoint.com/discuss/u/mikenawara)\ **Post date:** [March 18, 2025, 6:47pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/4 "2025-03-18T18:47:57Z")
We redid all the grants per the link above ( attempted a couple times) with no luck. Synonyms do look correct: ![image](https://global.discourse-cdn.com/sailpoint/original/3X/8/6/86cd2ac02650fae753b541addd382d0c7546f496.png) ---
**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\ **Post date:** [March 18, 2025, 6:59pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/5 "2025-03-18T18:59:31Z")
> [@mikenawara](#): > > insufficient privilege to access object APPS.FND\_USER\_PKG Notice the minor difference between the following two synonyms (the “SP\_”): INVOKER ```auto create or replace synonym FND_USER_PKG for APPS.SP_FND_USER_PKG; ``` DEFINER ```auto create or replace synonym FND_USER_PKG for APPS.FND_USER_PKG; ``` So, looks like your FND\_USER\_PKG is not using INVOKER rights (i.e. It’s not working)…so you should use the DEFINER side of things for FND\_USER\_PKG. ---
**Author:** ![mikenawara](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mikenawara](https://developer.sailpoint.com/discuss/u/mikenawara)\ **Post date:** [March 18, 2025, 7:32pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/6 "2025-03-18T19:32:28Z")
Thanks for looking into this! much appreciated…From what I understand we use INVOKER and not DEFINER. for INVOKER we’re supposed to use the custom one that SP had us create with the .sql files (SP\_FND\_USER\_PKG) ![image](https://global.discourse-cdn.com/sailpoint/original/3X/9/2/921b9971e4d4dd1c30e31929bcc446dc056bc3e1.jpeg) ---
**Author:** ![raeannehinkens](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@raeannehinkens](https://developer.sailpoint.com/discuss/u/raeannehinkens)\ **Post date:** [March 19, 2025, 7:02pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/7 "2025-03-19T19:02:55Z")
Hello! I’m a DBA working with Mike on this issue, did something change recently with the invoker vs. definer rights? I re-ran all the grants and packages in the Required Permissions link but we are still getting an error during provisioning with Sailpoint wanting to use the seeded Oracle packages/synonyms for FND\_USER\_PKG instead of SP\_FND\_USER\_PKG. We had this working a few months ago but had to stall this project due to others taking priority. Just wondering if something had changed on the sailpoint side in the last few months. We are using Oracle 19c (19.25.0.0) and EBS 12.2.12. Thanks everyone who’s looked at this so far! ---
**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\ **Post date:** [March 19, 2025, 8:30pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/8 "2025-03-19T20:30:49Z")
Did you also follow the validation steps? [https://community.sailpoint.com/t5/Shared-Documents/Validating-Service-Account-Permissions-on-Oracle-E-Business/ta-p/181650](https://community.sailpoint.com/t5/Shared-Documents/Validating-Service-Account-Permissions-on-Oracle-E-Business/ta-p/181650) ---
**Author:** ![raeannehinkens](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@raeannehinkens](https://developer.sailpoint.com/discuss/u/raeannehinkens)\ **Post date:** [March 21, 2025, 8:18pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/9 "2025-03-21T20:18:20Z")
Hello! I just confirmed that all of our INVOKER settings were good using the validation excel sheets from the provided link, but can confirm that that did not fix our issue. We even created a new test account to be sure (name is \*\*\*\*\* for privacy) we had everything correct with the DDL below. We are still getting the following error: ["[ConnectorException] \n [Error details] Error occurred during Create operation. Please check the logs. Error: ORA-06550: line 1, column 7:\nPLS-00904: insufficient privilege to access object APPS.FND\_USER\_PKG\nORA-06550: line 1, column 7:\nPL/SQL: Statement ignored\n\n[[https://docs.oracle.com/error-help/db/ora-06550/“,”[](https://docs.oracle.com/error-help/db/ora-06550/“,”[)](https://docs.oracle.com/error-help/db/ora-06550/%22,%22%5B%5D(https://docs.oracle.com/error-help/db/ora-06550/%22,%22%5B)) ConnectorException ] \n [Error details] Error occurred during Create operation. Please check the logs. Error: ORA-06550: line 1, column 7:\nPLS-00904: insufficient privilege to access object APPS.FND\_USER\_PKG\nORA-06550: line 1, column 7:\nPL/SQL: Statement ignored **New test user DDL:** CREATE USER “ **" PROFILE “DEFAULT” IDENTIFIED BY "** _**" DEFAULT TABLESPACE “SYSTEM” TEMPORARY TABLESPACE “TEMP” ACCOUNT UNLOCK GRANT CREATE PUBLIC SYNONYM TO "**__" GRANT CREATE SESSION TO "__**" GRANT CREATE SYNONYM TO "**__" GRANT SELECT ANY TABLE TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_APPLICATION” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_APPLICATION#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_APPLICATION\_TL” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_APPLICATION\_TL#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_DATA\_GROUPS” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_DATA\_GROUPS#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_DATA\_GROUP\_UNITS” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_DATA\_GROUP\_UNITS#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_FORM\_FUNCTIONS” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_FORM\_FUNCTIONS#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_MENUS” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_MENUS#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_MENU\_ENTRIES” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_MENU\_ENTRIES#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_PRODUCT\_GROUPS” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_PRODUCT\_GROUPS#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_REQUEST\_GROUP\_UNITS” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_REQUEST\_GROUP\_UNITS#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_RESPONSIBILITY” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_RESPONSIBILITY#” TO "__**" GRANT SELECT ON “APPLSYS”.“FND\_USER” TO "**__" GRANT SELECT ON “APPLSYS”.“FND\_USER#” TO "__**" GRANT SELECT ON “APPLSYS”.“WF\_LOCAL\_ROLES” TO "**__" GRANT SELECT ON “APPLSYS”.“WF\_LOCAL\_ROLES#” TO "__**" GRANT SELECT ON “APPLSYS”.“WF\_LOCAL\_USER\_ROLES” TO "**__" GRANT SELECT ON “APPLSYS”.“WF\_LOCAL\_USER\_ROLES#” TO "__**" GRANT SELECT ON “APPLSYS”.“WF\_ROLE\_HIERARCHIES” TO "**__" GRANT SELECT ON “APPLSYS”.“WF\_ROLE\_HIERARCHIES#” TO "__**" GRANT SELECT ON “APPS”.“AR\_CUSTOMERS” TO "**__" GRANT SELECT ON “APPS”.“FND\_APPLICATION\_VL” TO "__**" GRANT SELECT ON “APPS”.“FND\_FORM\_FUNCTIONS\_VL” TO "**__" GRANT SELECT ON “APPS”.“FND\_MENUS\_VL” TO "__**" GRANT SELECT ON “APPS”.“FND\_MENU\_ENTRIES\_VL” TO "**__" GRANT SELECT ON “APPS”.“FND\_RESPONSIBILITY\_VL” TO "__**" GRANT SELECT ON “APPS”.“FND\_USER\_RESP\_GROUPS\_ALL” TO "**__" GRANT SELECT ON “APPS”.“FND\_USER\_RESP\_GROUPS\_DIRECT” TO "__**" GRANT EXECUTE ON “APPS”.“SP\_FND\_GLOBAL” TO "**__" GRANT EXECUTE ON “APPS”.“SP\_FND\_RESPONSIBILITY\_PKG” TO "__**" GRANT EXECUTE ON “APPS”.“SP\_FND\_USER\_PKG” TO "**__" GRANT EXECUTE ON “APPS”.“SP\_FND\_USER\_RESP\_GROUPS\_API” TO "__**" GRANT EXECUTE ON “APPS”.“SP\_FND\_WEB\_SEC” TO "**__" GRANT EXECUTE ON “APPS”.“SP\_WF\_LOCAL\_SYNCH” TO "__**" GRANT SELECT ON “APPS”.“WF\_ALL\_ROLES\_VL” TO "**__" GRANT SELECT ON “APPS”.“WF\_ROLES” TO "__**" GRANT SELECT ON “HR”.“PER\_ALL\_PEOPLE\_F” TO "**__" GRANT SELECT ON “HR”.“PER\_ALL\_PEOPLE\_F#” TO "__**" GRANT SELECT ON “HR”.“PER\_PERIODS\_OF\_PLACEMENT” TO "**__" GRANT SELECT ON “HR”.“PER\_PERIODS\_OF\_PLACEMENT#” TO "__**" GRANT SELECT ON “HR”.“PER\_PERIODS\_OF\_SERVICE” TO "**__" GRANT SELECT ON “HR”.“PER\_PERIODS\_OF\_SERVICE#” TO "__**" GRANT SELECT ON “SYS”.“DBA\_USERS” TO "**__" GRANT SELECT ON “SYS”.“DUAL” TO "_\*\*\*” Thoughts on this? We are still confused on why it’s trying to use DEFINER (seeded) rights instead of INVOKER (SP\_% custom package) rights. Thanks! ---
**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\ **Post date:** [March 24, 2025, 10:59am UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/10 "2025-03-24T10:59:42Z")
Hi RaeAnne, We are also seeing the issue and the start date for that is 27th February for us. What I saw is that Sailpoint has changed the way connector used to function. When the connector tries to create the account it was altering the session and making connection using APPS user. We had raised a ticket with Sailpoint and they had enabled a flag last November to disable creating of the APPS session and recently have pushed a change to the Connector where they have given a connector attribute to disable this feature at source level. The attribute is “disableInitializeSession” but this seems to be not working. We have again raised a Sailpoint ticket and i would recommend you also do the same as it has nothing to do with permission. if you enable the logs at db level you will understand how sailpoint is trying to alter session using apps user. Thanks Rakesh Bhati ---
**Author:** ![raeannehinkens](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@raeannehinkens](https://developer.sailpoint.com/discuss/u/raeannehinkens)\ **Post date:** [March 24, 2025, 1:58pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/11 "2025-03-24T13:58:05Z")
Thank you very much for the reply, Rakesh! Is that attribute set at the source Oracle DB level? Or is it set somewhere within the SP website? We noticed that the Required Permissions website was updated recently with that Troubleshooting error on Feb 27 and again on March 12. I was not sure where to set that in the Oracle DB. We’ll look into creating a SP ticket also. Thanks! ---
**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\ **Post date:** [March 24, 2025, 2:39pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/12 "2025-03-24T14:39:38Z")
Hi RaeAnne, It is set inside the connectorAttributes in Sailpoint. When you get your source in IdentityNow using REST API you can see that attribute set. This is nothing to do with Oracle DB. Tell your Sailpoint developer her should help you get the required details from the source. Thanks ---
**Author:** ![mikenawara](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mikenawara](https://developer.sailpoint.com/discuss/u/mikenawara)\ **Post date:** [March 24, 2025, 6:05pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/13 "2025-03-24T18:05:01Z")
Thanks for the information. We will be raising a ticket with SailPoint. ---
**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\ **Post date:** [March 27, 2025, 1:20pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/14 "2025-03-27T13:20:48Z")
Hi Team, Update from Sailpoint. Thank you for enabling access and providing the successful provisioning. It is already bearing fruit!Our engineers identified the error and managed to reproduce it in our labs. They have created a bug report in high priority.I will continue keeping you informed of any progress. Thanks Rakesh Bhati ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [May 26, 2025, 1:21pm UTC](https://developer.sailpoint.com/discuss/t/unable-to-provision-oracle-ebs-user-accounts-after-ebs-qa-refresh/104350/15 "2025-05-26T13:21:47Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.