Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
access management

Oracle Access Management and OIG, moved to 14c before Premier Support runs out.

Premier Support for Oracle Access Management and Oracle Identity Governance 12.2.x ends in December 2026. We plan and run the move to 14c (14.1.2), including WebGates, connectors, adaptive authentication and Kubernetes deployments.

Talk to a Oracle Identity & Access Management engineerWhat changed recently
OAM
platform dossierOracle Identity & Access ManagementAccess management
Current release
OAM and OIG 14.1.x (14c), GA March 2025
12.2.x support
Premier ends December 2026, Extended December 2027
14.1.x Premier Support
Ends December 2030
Security patches
Monthly: quarterly CPUs plus CSPUs in between
release watch
  • Next Oracle security patch dates17 Nov 2026
  • OAM and OIG 12.2.x Premier Support endsDec 2026
connects with
ERP PS
in short·15-second read

Premier Support for Oracle Access Management and Oracle Identity Governance 12.2.x ends in December 2026, and Extended Support in December 2027.

Oracle now releases security patches every month, and recent ones fixed critical OAM and OIM flaws on both 12.2.1.4 and 14c. Cohash plans and runs the move to 14.1.2, and supports the estate once it's there.

you probably need this if
  • OAM and OIG are on 12.2.1.4, and the December 2026 Premier Support date already sits on the risk register.
  • A few WebGates still run in SIMPLE mode, and nobody's sure which web servers they're on.
  • A customer login still sits behind OAAM 11g, with rules nobody has looked at in years.
terms on this page Extended SupportdefinitionIBM's paid support once a release's normal support has ended. Security Verify Access 10.0.x moved onto it in April 2026, except on hardware appliances, so check your contract still covers you.explained in a field note →Premier SupportdefinitionThe first stage of Oracle's support policy. You get CPU patches here and in Extended Support, which you pay extra for. Once both end, the patches stop coming.explained in a field note →Identity governancedefinitionThe tools and process that decide who should have what access, grant and remove it as people join, move and leave, and prove it to auditors. Often shortened to IGA.explained in a field note →
Ask an engineer facts checked 2026-11-04
how it runs
  1. 01Estate inventory
  2. 02Path decision
  3. 03Rehearsal
  4. 04Cut-over and handover
you keep
  • Every WebGate listed with its version, web server, security mode and owner, so you know who has to change what
  • Test results on 14c for each OIG connector and custom event handler, so you see what breaks before cut-over
  • In-place or rebuild decision paper per environment
+ 3 more documents
who does it
Oracle Access Management engineer (WebGates, policies)OIG developer (connectors, event handlers)Engineer moving OAAM rules to Adaptive Risk Management
platforms
OAM ERP PS
proof
2 case studies on this
background
01 Craftedrequest 02 Verify Access below 11.0.3.2 03 Code on thegateway 04 Fix pack,then review
field note · 14 minIBM Verify Access flaws let attackers run code without a login: patch to 11.0.3.2
oracle-identity · release timeline
  1. Dec 2021 OAAM 11.1.2.x past Extended Support The Lifetime Support Policy lists Oracle Adaptive Access Manager 11.1.2.x with Extended Support ended December 2021. Anything still running on it hasn't had a security fix from Oracle since, and that usually includes a customer-facing login.
  2. Mar 2025 OAM and OIG 14.1.x This is the line to move to, with Premier Support until December 2030 and Extended until December 2033. OAM 14.1.x also brings in the adaptive risk and authenticator pieces that used to need separate products, which matters if you still run OAAM.
  3. May 2026 Oracle moves to monthly security patches Critical Patch Updates still come out quarterly, in January, April, July and October. The first Critical Security Patch Update came out on 28 May 2026. Since then Oracle has released smaller Critical Security Patch Updates on the third Tuesday of the other eight months. For an OAM or OIG team that means a patch test cycle every month rather than four times a year.
  4. 21 Jul 2026 July 2026 Critical Patch Update If July's patch never went in, start there. It fixed CVE-2026-60358, a no-login CVSS 10.0 flaw in the OAM Authentication Engine, and CVE-2026-60531 (9.9) in the OIM Connector Core, which any low-privileged user can reach over HTTP. Two 9.8 fixes for the PeopleSoft connector came with it, on 12.2.1.4.0 and 14.1.2.1.0 alike.
  5. Sep 2026 August and September 2026 security patches The in-between months hit OAM and OIM hard too. September's fixed another CVSS 10.0 OAM Authentication Engine flaw (CVE-2026-71133) that needs no login, plus two 9.8 OIM issues. August's fixed a 9.8 SAML flaw in OAM's agent infrastructure (CVE-2026-70905) and two 9.8 OIM Legacy UI flaws. If your team only patches every quarter, you missed these.
  6. 20 Oct 2026 October 2026 Critical Patch Update The worst one is CVE-2026-87337 in the OAM Authentication Engine. It's rated CVSS 10.0, and anyone who can reach it over HTTP can exploit it without logging in. OIM's End User Self Service (CVE-2026-91408) and the OIM LDAP Gateway connector (CVE-2026-91491) are both 9.8 and need no login either. Each affects 12.2.1.4.0 and 14.1.2.1.0, so being on 14c doesn't let you skip this patch.
  7. today · Nov 09, 2026
  8. 17 Nov 2026ahead Next Oracle security patch dates Oracle now releases security patches on the third Tuesday of every month. The next ones are Critical Security Patch Updates on 17 November and 15 December 2026, then the January Critical Patch Update on 19 January 2027. Book the test and change windows now, because OAM and OIM have had critical fixes in every release since July.
  9. Dec 2026ahead OAM and OIG 12.2.x Premier Support ends Oracle's Lifetime Support Policy (effective 13 April 2026) lists Premier Support ending December 2026 and Extended Support ending December 2027. Oracle only patches versions still in Premier or Extended Support. During 2027 the patches come only with Extended Support, and after December 2027 a 12.2.1.4 estate gets none.
  10. no date yetOracle Access Management 14c (14.1.2.1.0) changesCertified on JDK 17 and 21. Support for TLSv1.1 and earlier and for SIMPLE mode communication is discontinued. Rules now run on GraalVM instead of Jython.
the story · oracle identity & access management estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your Oracle Identity & Access Management estate, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • OAM and OIG are on 12.2.1.4, and the December 2026 Premier Support date already sits on the risk register.
    • A few WebGates still run in SIMPLE mode, and nobody's sure which web servers they're on.
    • A customer login still sits behind OAAM 11g, with rules nobody has looked at in years.
  2. chapter 02 · what we change

    How we solve it

    • OAM and OIG 14c upgrades
    • Oracle Identity Governance connectors and workflows
    • Adaptive authentication (OAAM and OARM)
    • Kubernetes deployments
    • OCI IAM identity domains
    • Health checks and support
  3. chapter 03 · how it runs

    Our approach

    • Estate inventory
    • Path decision
    • Rehearsal
    • Cut-over and handover
  4. chapter 04 · where you end up

    What changes

    • WebGate changes are done before the upgrade window, so cut-over to 14c is about the servers, not hundreds of application teams.
    • Customer login now runs on a supported release, with risk rules the team actually understands.
    • Every WebGate listed with its version, web server, security mode and owner, so you know who has to change what
    • Test results on 14c for each OIG connector and custom event handler, so you see what breaks before cut-over
what we do

Our Oracle Identity & Access Management work

6 kinds of Oracle Identity & Access Management work, each run by engineers who have done it on live tenants.

  1. 12.2.1.4 estates moved to 14.1.2, with JDK 17 or 21, TLS settings, WebGate versions and custom plug-ins checked against the 14c changes before the upgrade window.

  2. Connector inventory, custom event handlers, scheduled tasks and approval workflows reviewed and retested on 14c, with connectors upgraded where Oracle ships new versions.

  3. Legacy OAAM 11g deployments assessed and replaced with the Advanced Authentication and Adaptive Risk Management components Oracle includes in Oracle Access Management 14.1.x.

  4. OAM and OIG 14c on Kubernetes with the WebLogic Kubernetes Operator, domain on a persistent volume, and CI/CD for configuration changes.

  5. Federation between on-premises OAM and OCI IAM identity domains, or a move of selected applications to identity domains where that makes sense.

  6. A review of OAM policy domains, session settings, OIG reconciliation jobs and database growth, with a ranked fix list.

capability 01 / 06in production

OAM and OIG 14c upgrades

12.2.1.4 estates moved to 14.1.2, with JDK 17 or 21, TLS settings, WebGate versions and custom plug-ins checked against the 14c changes before the upgrade window.

talk to an engineer about this →
capability 02 / 06in production

Oracle Identity Governance connectors and workflows

Connector inventory, custom event handlers, scheduled tasks and approval workflows reviewed and retested on 14c, with connectors upgraded where Oracle ships new versions.

talk to an engineer about this →
capability 03 / 06in production

Adaptive authentication (OAAM and OARM)

Legacy OAAM 11g deployments assessed and replaced with the Advanced Authentication and Adaptive Risk Management components Oracle includes in Oracle Access Management 14.1.x.

talk to an engineer about this →
capability 04 / 06in production

Kubernetes deployments

OAM and OIG 14c on Kubernetes with the WebLogic Kubernetes Operator, domain on a persistent volume, and CI/CD for configuration changes.

talk to an engineer about this →
capability 05 / 06in production

OCI IAM identity domains

Federation between on-premises OAM and OCI IAM identity domains, or a move of selected applications to identity domains where that makes sense.

talk to an engineer about this →
capability 06 / 06in production

Health checks and support

A review of OAM policy domains, session settings, OIG reconciliation jobs and database growth, with a ranked fix list.

talk to an engineer about this →
typical situations

Oracle Identity & Access Management situations we walk into

We pieced these together from Oracle Identity & Access Management situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

OAM 12.2.1.4 with 300 WebGates and a December support date

composite · not a client story
  1. Beforethe situation

    OAM and OIG run on 12.2.1.4 across three environments. Around 300 WebGates sit on a mix of OHS, Apache and IIS servers, and some still use SIMPLE mode, which 14c no longer supports.

  2. What we dothe work

    We pull the WebGate registrations from OAM, match them to web servers, and list every one using SIMPLE mode or TLSv1.1. Those move to a supported mode on 12.2.1.4 first. The 14c upgrade is rehearsed on a production copy while that work runs.

  3. Afterwhere you end up

    WebGate changes are done before the upgrade window, so cut-over to 14c is about the servers, not hundreds of application teams.

case file 02

OAAM 11g still guarding online banking login

composite · not a client story
  1. Beforethe situation

    An OAAM 11g deployment guards a customer login with device fingerprinting and knowledge-based challenges. It's past Extended Support, and nobody has tuned the rules in years.

  2. What we dothe work

    We export the OAAM policies and rules, classify which still fire, and design the equivalent risk rules and step-up flows in the Adaptive Risk Management component of OAM 14c. Both run side by side in monitor mode before the switch.

  3. Afterwhere you end up

    Customer login now runs on a supported release, with risk rules the team actually understands. The old OAAM servers can be switched off.

case studies

Oracle Identity & Access Management case studies

All case studies
migration Identity and access

Oracle Access Manager and OIG to a modern identity provider and IGA

A university replaced Oracle Access Manager and OIG: SAML and OIDC apps to Entra ID, header-based apps behind a gateway, governance rebuilt in SailPoint.

read the case study
migration Identity and access

IBM ISIM, Oracle OIM or homegrown provisioning to SailPoint or Saviynt

Getting off IBM ISIM, Oracle OIM or homegrown provisioning scripts and onto SailPoint or Saviynt, with provisioning, certifications and audit history intact.

read the case study
approach

How a Oracle Identity & Access Management engagement runs

We don't start a step until the last one has produced something you can check.

  1. step 01

    Estate inventory

    We go through every OAM and OIG domain, WebGate and connector, then the custom event handlers, scheduled tasks and OAAM rules, and note versions and owners for each.

  2. step 02

    Path decision

    In-place upgrade to 14.1.2 or a fresh build on Kubernetes, decided per environment from the inventory, with JDK, database and TLS prerequisites listed.

  3. step 03

    Rehearsal

    We upgrade a copy of production, run reconciliation and sign-in tests against real applications and record timings for the production window.

  4. step 04

    Cut-over and handover

    WebGates and connectors move in planned waves, each with its own rollback. The run team gets runbooks for the new domains before we hand over.

ai on oracle identity & access management

Where AI fits on Oracle Identity & Access Management, and where it needs guardrails.

Oracle ships little AI for Oracle Access Management and Oracle Identity Governance. The 14c release notes cover JDK 17 and 21, TLS changes and rules on GraalVM rather than AI features. With 12.2.x Premier Support ending in December 2026, AI is most useful for the upgrade itself: reading old Jython rules, mapping configuration and triaging WebLogic logs.

AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Oracle Identity & Access Managementdoes the work

Oracle doesn't document an MCP server for OAM or OIG, at least none we found. Agents should use the OIG and OAM REST APIs under a dedicated service account with least-privilege admin roles. We log the calls, and a human approves any provisioning or policy change before it goes through.

Rule conversion for 14c

In OAM 14c, rules run on GraalVM instead of Jython. Hand an AI coding assistant your existing scripts and it drafts the converted rules and their tests. Engineers review each one, then run it against the same requests on a 14c test domain.

Documenting OIG customizations

Old OIG estates carry event handlers, adapters and approval workflows, and few of them are documented. An assistant can read the exported code and draft a catalog of what each customization does. We confirm that catalog, then decide what to rebuild.

WebLogic and Kubernetes log triage

Once you're on the WebLogic Kubernetes Operator, errors are spread across pods and managed servers. We have an agent group the log errors by cause, so engineers can go to the likely fix.

architecture

Logins go through OAM. Joiners and leavers go through OIG.

Every request hits a WebGate first. The WebGate asks Oracle Access Management whether to let the user in, and risky logins get an extra adaptive risk check. Oracle Identity Governance works on a different clock: it reads HR data and creates or removes accounts in the directory and the Oracle apps.

Logins go through OAM. Joiners and leavers go through OIG. Every request hits a WebGate first. The WebGate asks Oracle Access Management whether to let the user in, and risky logins get an extra adaptive risk check. Oracle Identity Governance works on a different clock: it reads HR data and creates or removes accounts in the directory and the Oracle apps. 01 · USERS AND SOURCES 02 · ORACLE IAM 14C 03 · APPLICATIONS AND TARGETS HTTPS OAP policy check risk evaluation federation trusted reconciliation provision provision Users employees · customers PS HR system PeopleSoft HCM ·Workday OAM Oracle AccessManagement policies · sessions ·federation Adaptive Risk Management risk rules · step-up OAM Oracle IdentityGovernance lifecycle ·certifications WebGates OHS · Apache · IIS ERP Oracle E-BusinessSuite responsibilities Directory OUD · Active Directory Ex Entra ID SAML federation © Cohash · cohash.com
01 · USERS AND SOURCES02 · ORACLE IAM 14C03 · APPLICATIONS AND TARGETS Users: employees · customers Users employees ·customers HR system: PeopleSoft HCM · Workday PS HR system PeopleSoft HCM ·Workday Oracle Access Management: policies · sessions · federation OAM OracleAccessManagement policies ·sessions ·federation Adaptive Risk Management: risk rules · step-up AdaptiveRiskManagement risk rules ·step-up Oracle Identity Governance: lifecycle · certifications OAM OracleIdentityGovernance lifecycle ·certifications WebGates: OHS · Apache · IIS WebGates OHS · Apache · IIS Oracle E-Business Suite: responsibilities ERP OracleE-BusinessSuite responsibilities Directory: OUD · Active Directory Directory OUD · ActiveDirectory Entra ID: SAML federation Entra ID SAML federation HTTPS OAP policy check federation trusted reconciliation provision provision © Cohash · cohash.com
use cases

Typical Oracle Identity & Access Management projects

The work teams usually bring us, and the platforms Oracle Identity & Access Management has to talk to while we do it.

  1. ORA-01 OAM and OIG run on 12.2.1.4 and Premier Support ends in December 2026 common request
  2. ORA-02 WebGates on old web servers still use SIMPLE mode or TLSv1.1 common request
  3. ORA-03 OAAM 11g still guards a customer-facing login and nobody wants to touch it common request
  4. ORA-04 OIG reconciliation jobs run longer every quarter as the database grows common request
  5. ORA-05 You'd rather run OAM and OIG on Kubernetes than keep hand-building WebLogic domains common request
Oracle Identity & Access Management · connected platforms
OAM Oracle Fusion ERP & E-Business SuiteOracle PeopleSoftMicrosoft Entra IDOktaSailPointRed Hat OpenShift
you keep

What a Oracle Identity & Access Management engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

  • document01

    Every WebGate listed with its version, web server, security mode and owner, so you know who has to change what

    yours to keep
  • runbook02

    Test results on 14c for each OIG connector and custom event handler, so you see what breaks before cut-over

    yours to keep
  • report03

    In-place or rebuild decision paper per environment

    yours to keep
  • runbook04

    14c upgrade runbook with timed rehearsal results

    yours to keep
  • document05

    A map from each OAAM rule and challenge flow to the 14c adaptive risk piece that takes it over

    yours to keep
  • runbook06

    Kubernetes manifests for the new deployment, plus runbooks for the operator your team will run

    yours to keep
talent and delivery · oracle identity & access management

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
roles we staff
  • Oracle Access Management engineer (WebGates, policies)
  • OIG developer (connectors, event handlers)
  • Engineer moving OAAM rules to Adaptive Risk Management
  • WebLogic and Kubernetes platform engineer for Oracle IAM
  • Oracle IAM upgrade lead
due diligence · oracle identity & access management

Questions to ask any partner, including us.

Put these to anyone bidding on your Oracle Identity & Access Management work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    Which of our WebGates use SIMPLE mode or TLSv1.1, and who owns those web servers?

    OAM 14c drops both. Each affected WebGate needs an application team to make a change, and that coordination is often the longest part of the project.

  2. Q2

    Would you upgrade in place or rebuild on Kubernetes, and why for our estate?

    Either path can be right. Ask them to tie the answer to your custom code, your environment count and your platform plans. If every client gets the same answer, that's habit.

  3. Q3

    How will you test custom OIG event handlers and scheduled tasks on JDK 17 or 21?

    14c is certified on newer JDKs. Custom Java code compiled years ago is the most common source of upgrade surprises in OIG.

  4. Q4

    What is the plan if we miss the December 2026 Premier Support date?

    Extended Support runs to December 2027 at extra cost. A partner should help you compare that cost with a compressed schedule.

  5. Q5

    How will you test our OAAM rules before real users hit the new risk engine?

    Bad risk rules lock real customers out. Running old and new side by side in monitor mode shows the difference before anyone is blocked.

01When does Oracle Access Manager 12c (12.2.1.4) support end?

Oracle's Lifetime Support Policy, effective 13 April 2026, lists Premier Support for Oracle Access Management and Oracle Identity Governance 12.2.x ending December 2026 and Extended Support ending December 2027. Extended Support is priced separately, and once it ends, Oracle's security patches stop too. Most teams plan to be on 14c before then.

02Should we upgrade in place or build 14c fresh?

It depends on how much custom code you run and whether you want to change platforms. An in-place upgrade keeps the domain and data. A fresh build on Kubernetes with the WebLogic Kubernetes Operator gives you a cleaner estate but needs data and policy migration. We decide after the inventory.

03What happens to our WebGates in 14c?

OAM 14c discontinues SIMPLE mode communication and TLSv1.1 and earlier. Any WebGate still configured that way has to move to a supported mode before cut-over, so we list every WebGate with its version, web server and security mode first.

04How long does a 14c upgrade take?

It depends on the number of environments, connectors, custom event handlers and WebGates. We rehearse on a copy of production and set the window from timed runs rather than from a template plan.

05Do we really have to patch OAM and OIG every month now?

Every month now. The quarterly Critical Patch Updates still come out in January, April, July and October, and the other months now get smaller Critical Security Patch Updates on the third Tuesday. The first of those came out on 28 May 2026. The August and September 2026 ones both fixed critical OAM and OIM flaws, so a quarterly-only habit leaves gaps.

06We're already on 14c. Do we still need the October 2026 patch?

Most of the OAM and OIM fixes cover both 12.2.1.4.0 and 14.1.2.1.0, and the worst, CVE-2026-87337 in the OAM Authentication Engine, scores CVSS 10.0 with no login needed. Apply it on both lines. If you're on an older 14c build such as 14.1.2.0.0, check the advisory, because a few OAM fixes list that version instead.

07Do you provide Oracle IAM engineers on contract?

Yes. We place OAM and OIG engineers on contract, contract-to-hire or permanent terms. They can work onsite in the US, or nearshore and offshore if you need cover in other time zones.

services

Related services

Projects on Oracle Identity & Access Management usually end up touching one of these, so they're worth a look.

you are hereOracle Identity & Access Management
fact-checked Checked against vendor and official documentation last checked 2026-11-04 content fingerprint 6a057169
  1. 01Book a 30-minute working sessionsenior engineer
  2. 02Talk to an engineer about your setupreply within 24 hours
  3. 03See how similar projects wentcase studies
Reviewed by the Cohash team Oracle Identity & Access Management is a trademark of its owner, used here to identify the platform. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it