Oracle Access Manager and OIG to a modern identity provider and IGA
Cohash replaces Oracle Access Manager and Oracle Identity Governance with a cloud identity provider such as Entra ID, Okta or Ping, and a governance platform such as SailPoint or Saviynt. We inventory WebGates, policy domains, connectors and event handlers, move SAML and OIDC apps first, put header-based apps behind a gateway, rebuild provisioning and certifications, and run OAM and the new IdP side by side until the last app moves.
- 01Inventory OAM and OIG
- 02Sort apps by protocol
- 03Coexistence
- 04Rebuild governance
- 05Parallel run and cut-over
- 06Decommission
The story
Told without the client's name or anything that could identify them.
A university's identity team ran Oracle Access Manager 12.2.1.4 and Oracle Identity Governance on WebLogic servers that only a contractor knew how to patch. Premier Support for 12.2.x was due to end in December 2026, and when the 14c upgrade quote arrived the CISO asked what a cloud identity provider would cost instead. We inventoried every WebGate, policy domain, connector and event handler, then sorted apps by protocol. SAML and OIDC apps moved to Entra ID first, header-based apps went behind a gateway, and governance was rebuilt in SailPoint after a parallel certification cycle. OAM and OIG were then shut down, with their audit history archived.
why it was urgentOracle's Lifetime Support Policy lists Premier Support for OAM and OIG 12.2.x ending in December 2026 and Extended Support in December 2027. Getting new patches past that means a 14.1.2 upgrade on JDK 17 or 21. For OAM it also means no TLS 1.1 or SIMPLE mode, and rules running on GraalVM instead of Jython. Many teams price that upgrade against leaving.
- openOAM 12.2.1.4 sits on WebLogic servers, and only one contractor knows how to patch them.
- recurringMost apps behind WebGates could speak SAML or OIDC, but nobody has asked them to.
- blockedOIG custom event handlers and approval workflows break on every bundle patch.
- openThe 14c upgrade quote arrived and the CISO asked what a cloud IdP would cost instead.
The estate, before and after
Before: OAM WebGates and OIG on WebLogic
Users signed in through OAM WebGates, which passed headers to some apps and sessions to others, including E-Business Suite. OIG reconciled from HR and provisioned targets through custom event handlers, all on WebLogic that few people could patch.
After: Entra ID for sign-in, SailPoint for governance
Sign-in is Entra ID's job, directly for SAML and OIDC apps and through Application Proxy for header-based ones. Governance is SailPoint's. It takes HR events, provisions accounts and groups and runs the certification campaigns.
How we run it, phase by phase.
6 phases take you from Oracle Access Manager and OIG 12c to Cloud identity provider plus SailPoint or Saviynt. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Inventory OAM and OIG
Every WebGate, policy domain, authentication scheme, header variable and session setting goes on the list with its app and owner. Connectors, event handlers, scheduled tasks and approval workflows go on it too.
- phase 02
Sort apps by protocol
Apps that support SAML or OIDC move to the new identity provider directly. Header-based apps go behind a gateway such as Entra Application Proxy with header-based SSO or PingAccess. Oracle apps that sign in through OAM, such as E-Business Suite, get their own plan.
- phase 03
Coexistence
OAM and the new identity provider stay federated for the whole move, so someone signed in on one side reaches apps on the other without a second prompt. Session timeouts are aligned to avoid surprise logouts.
- phase 04
Rebuild governance
In SailPoint or Saviynt we rebuild OIG's trusted reconciliation, target connectors, roles, SoD rules and certifications. Custom event handlers turn into workflows or transforms. Or they're retired, with the reason written down.
- phase 05
Parallel run and cut-over
Run provisioning and a certification campaign in both tools for one cycle. Then move apps off WebGates in waves, and switch OIG provisioning target by target.
- phase 06
Decommission
Finally the WebGates are removed from the web servers and the OAM and OIG domains shut down, with audit and certification history exported and retained.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
Web apps now sign in through the cloud identity provider
Apps that support SAML or OIDC moved off WebGates to Entra ID in waves, with OAM federated during the move so users never saw a second prompt.
- result 02
Header-based apps sit behind a gateway
Apps that trusted OAM headers now get identity through Entra Application Proxy header-based SSO. The others have a code change or a retirement date.
- result 03
Event handler rules are written down and rebuilt
Logic buried in OIG event handlers, username and email generation for instance, was read line by line. It was rebuilt as SailPoint workflows or retired, with the reason written down.
- result 04
Provisioning and certifications run in SailPoint
After one cycle in parallel with OIG, HR now feeds joiners, movers and leavers straight into SailPoint, which provisions targets and runs the certification campaigns.
- result 05
No identity WebLogic servers left to patch
WebGates have come off the web servers and the OAM and OIG domains are gone. Audit and certification history was exported and kept for retention.
Risks we plan for
-
Header-based apps
Apps that trust OAM headers for user identity can't simply be repointed. Each needs a gateway, a code change or a retirement date, and they are usually the long tail.
-
Oracle application dependencies
E-Business Suite, PeopleSoft and other Oracle products may sign in through OAM or read Oracle directories. We test their sign-in path early, because it often decides how long both systems have to coexist.
-
Event handler logic
OIG event handlers often hold business rules nobody wrote down elsewhere, like how usernames or email addresses get generated. We read them line by line before the governance build starts.
-
Running out of support mid-project
If the move runs past December 2027, OAM and OIG run without Extended Support. The plan sets a fallback: either a scoped 14c upgrade or a firm cut-over date for the riskiest apps.
Where AI helps, and where it needs guardrails
SailPoint's Agentic Fabric, announced as generally available on 4 August 2026, and Saviynt Identity Security for AI, released 24 March 2026, both govern AI agents as identities. We use the move to register agents and their owners in the new IGA. AI assistants can turn exported OAM policy and OIG connector files into a first draft of the app inventory, but an engineer checks every line against the running system.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- inventory01
OAM and OIG inventory with app, owner, protocol and target per item
yours to keep - design02
A coexistence design, so OAM and the new identity provider can run side by side
yours to keep - plan03
Gateway plan for header-based applications
yours to keep - code04
What we build for governance: connectors, roles, SoD rules and campaigns
yours to keep - runbook05
Cut-over runbooks and archived OIG audit history
yours to keep
Platforms and services on this move
Learn the background
Terms from this page in plain English. If you want the why, the field note behind it is right there.
- 01Certification campaign
- A scheduled review where managers go through their people one by one and decide who keeps which access. Auditors expect to see it run on a schedule.in context →
- 02Rules
- The JavaScript snippets Auth0 used to run at login. Someone would write one to add a role to the token or block a sign-in, and each one ran after the last.in context →
- 03Connector
- The link between the identity platform and one app. When HR marks someone as a leaver, the connector is what actually goes into that app and switches their account off. When the app upgrades, the connector is often what breaks.in context →
- 04SAML
- What sits behind most single sign-on. Entra ID or Okta signs a message saying who you are, and Secret Server lets you in because it trusts that signature.in context →
- 05provisioning
- Creating, updating and removing accounts in an app automatically, based on who's assigned to it in Entra ID.in context →
- 06Extended Support
- IBM's paid support once a release's normal support has ended. Security Verify Access 10.0.x moved onto it in April 2026, except on hardware appliances, so check your contract still covers you.in context →
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Should we upgrade to 14c instead?
Sometimes staying is right, for example when lots of Oracle apps depend on OAM or you have to stay on-premises. If most apps can speak SAML or OIDC and you'd like to stop running WebLogic, leaving usually works out cheaper over time. We price both from the inventory.
02Can we move access first and leave governance until later?
Yes, and many teams do. Sign-in tends to move first, because apps can go one at a time. Governance follows once the new IGA platform has its sources and connectors working.
03What happens to E-Business Suite sign-in?
It depends on how EBS is integrated today and whether EBS itself is moving. We test the EBS sign-in path in the first weeks, because it often sets how long OAM has to stay.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyMoving Auth0 Rules and Hooks to Actions before Auth0 switches them off
Moving Auth0 Rules and Hooks to Actions before Hooks stop on 30 April 2027 and Rules on 31 January 2028, with token claims checked before and after each change.
read the case study17e42240 - 01Book a 30-minute working sessionsenior engineer
- 02Talk to an engineer about your setupreply within 24 hours
- 03See how similar projects wentcase studies
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it