Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
access management

Oracle Access Management and OIG, moved to 14c before Premier Support runs out.

Premier Support for Oracle Access Management and Oracle Identity Governance 12.2.x ends in December 2026. We plan and run the move to 14c (14.1.2), including WebGates, connectors, adaptive authentication and Kubernetes deployments.

Talk to a Oracle Identity & Access Management engineerWhat changed recently
OAM
platform dossierOracle Identity & Access ManagementAccess management
Vendor
Oracle
Current release
OAM and OIG 14.1.x (14c), GA March 2025
12.2.x Premier Support
Ends December 2026
14.1.x Premier Support
Ends December 2030
release watch
  • OAM and OIG 12.2.x Premier Support endsDec 2026
  • OAM and OIG 14.1.xMar 2025
connects with
ERP PS
in short·15-second read

Cohash upgrades and supports Oracle Access Management, Oracle Identity Governance and Oracle's adaptive authentication products (OAAM and OARM).

Oracle's Lifetime Support Policy ends Premier Support for OAM and OIG 12.2.x in December 2026, while 14.1.x has Premier Support to December 2030. We inventory WebGates, connectors and custom code, then rehearse the 14c upgrade or a fresh 14c build on Kubernetes.

you probably need this if
  • OAM and OIG are on 12.2.1.4, and the December 2026 Premier Support date already sits on the risk register.
  • A few WebGates still run in SIMPLE mode, and nobody's sure which web servers they're on.
  • A customer login still sits behind OAAM 11g, with rules nobody has looked at in years.
Ask an engineer facts checked 2026-10-20 · 5 sources
how it runs
  1. 01Estate inventory
  2. 02Path decision
  3. 03Rehearsal
  4. 04Cut-over and handover
you keep
  • WebGate inventory with version, web server, security mode and owner
  • OIG connector and custom event handler inventory with 14c test results
  • In-place or rebuild decision paper per environment
+ 3 more documents
who does it
Oracle Access Management engineer (WebGates, policies)OIG developer (connectors, event handlers)OAAM to Adaptive Risk Management migration engineer
platforms
OAM ERP PS
proof
2 case studies on this
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
oracle-identity · release timeline
  1. Dec 2021 OAAM 11.1.2.x past Extended Support The Lifetime Support Policy lists Oracle Adaptive Access Manager 11.1.2.x with Extended Support ended December 2021. source ↗
  2. Mar 2025 OAM and OIG 14.1.x GA March 2025. Premier Support to December 2030, Extended to December 2033. OAM 14.1.x includes Advanced Authentication Adaptive Risk Management, Radius Agent and Universal Authenticator. source ↗
  3. today · Oct 22, 2026
  4. Dec 2026ahead OAM and OIG 12.2.x Premier Support ends Oracle's Lifetime Support Policy (effective 13 April 2026) lists Premier Support ending December 2026 and Extended Support ending December 2027. source ↗
  5. no date yetOracle Access Management 14c (14.1.2.1.0) changesCertified on JDK 17 and 21. Support for TLSv1.1 and earlier and for SIMPLE mode communication is discontinued. Rules now run on GraalVM instead of Jython.source ↗
the story · oracle identity & access management estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your Oracle Identity & Access Management estate, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • OAM and OIG are on 12.2.1.4, and the December 2026 Premier Support date already sits on the risk register.
    • A few WebGates still run in SIMPLE mode, and nobody's sure which web servers they're on.
    • A customer login still sits behind OAAM 11g, with rules nobody has looked at in years.
  2. chapter 02 · what we change

    How we solve it

    • OAM and OIG 14c upgrades
    • Oracle Identity Governance connectors and workflows
    • Adaptive authentication (OAAM and OARM)
    • Kubernetes deployments
    • OCI IAM identity domains
    • Health checks and support
  3. chapter 03 · how it runs

    Our approach

    • Estate inventory
    • Path decision
    • Rehearsal
    • Cut-over and handover
  4. chapter 04 · where you end up

    What changes

    • WebGate changes are done before the upgrade window, so cut-over to 14c is about the servers, not hundreds of application teams.
    • Customer login now runs on a supported release, with risk rules the team actually understands.
    • WebGate inventory with version, web server, security mode and owner
    • OIG connector and custom event handler inventory with 14c test results
what we do

Our Oracle Identity & Access Management work

6 kinds of Oracle Identity & Access Management work, each run by engineers who have done it on live tenants.

  1. 12.2.1.4 estates moved to 14.1.2, with JDK 17 or 21, TLS settings, WebGate versions and custom plug-ins checked against the 14c changes before the upgrade window.

  2. Connector inventory, custom event handlers, scheduled tasks and approval workflows reviewed and retested on 14c, with connectors upgraded where Oracle ships new versions.

  3. Legacy OAAM 11g deployments assessed and replaced with the Advanced Authentication and Adaptive Risk Management components Oracle includes in Oracle Access Management 14.1.x.

  4. OAM and OIG 14c on Kubernetes with the WebLogic Kubernetes Operator, domain on a persistent volume, and CI/CD for configuration changes.

  5. Federation between on-premises OAM and OCI IAM identity domains, or a move of selected applications to identity domains where that makes sense.

  6. A review of OAM policy domains, session settings, OIG reconciliation jobs and database growth, with a ranked fix list.

capability 01 / 06in production

OAM and OIG 14c upgrades

12.2.1.4 estates moved to 14.1.2, with JDK 17 or 21, TLS settings, WebGate versions and custom plug-ins checked against the 14c changes before the upgrade window.

talk to an engineer about this →
capability 02 / 06in production

Oracle Identity Governance connectors and workflows

Connector inventory, custom event handlers, scheduled tasks and approval workflows reviewed and retested on 14c, with connectors upgraded where Oracle ships new versions.

talk to an engineer about this →
capability 03 / 06in production

Adaptive authentication (OAAM and OARM)

Legacy OAAM 11g deployments assessed and replaced with the Advanced Authentication and Adaptive Risk Management components Oracle includes in Oracle Access Management 14.1.x.

talk to an engineer about this →
capability 04 / 06in production

Kubernetes deployments

OAM and OIG 14c on Kubernetes with the WebLogic Kubernetes Operator, domain on a persistent volume, and CI/CD for configuration changes.

talk to an engineer about this →
capability 05 / 06in production

OCI IAM identity domains

Federation between on-premises OAM and OCI IAM identity domains, or a move of selected applications to identity domains where that makes sense.

talk to an engineer about this →
capability 06 / 06in production

Health checks and support

A review of OAM policy domains, session settings, OIG reconciliation jobs and database growth, with a ranked fix list.

talk to an engineer about this →
typical situations

Oracle Identity & Access Management situations we walk into

We pieced these together from Oracle Identity & Access Management situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

OAM 12.2.1.4 with 300 WebGates and a December support date

composite · not a client story
  1. Beforethe situation

    OAM and OIG run on 12.2.1.4 across three environments. Around 300 WebGates sit on a mix of OHS, Apache and IIS servers, and some still use SIMPLE mode, which 14c no longer supports.

  2. What we dothe work

    We pull the WebGate registrations from OAM, match them to web servers, and list every one using SIMPLE mode or TLSv1.1. Those move to a supported mode on 12.2.1.4 first. The 14c upgrade is rehearsed on a production copy while that work runs.

  3. Afterwhere you end up

    WebGate changes are done before the upgrade window, so cut-over to 14c is about the servers, not hundreds of application teams.

case file 02

OAAM 11g still guarding online banking login

composite · not a client story
  1. Beforethe situation

    An OAAM 11g deployment guards a customer login with device fingerprinting and knowledge-based challenges. It's past Extended Support, and nobody has tuned the rules in years.

  2. What we dothe work

    We export the OAAM policies and rules, classify which still fire, and design the equivalent risk rules and step-up flows in the Adaptive Risk Management component of OAM 14c. Both run side by side in monitor mode before the switch.

  3. Afterwhere you end up

    Customer login now runs on a supported release, with risk rules the team actually understands. The old OAAM servers can be switched off.

case studies

Oracle Identity & Access Management case studies

All case studies
migration Identity and access

Oracle Access Manager and OIG to a modern identity provider and IGA

Replacing Oracle Access Manager and Oracle Identity Governance 12c with a cloud identity provider and SailPoint or Saviynt before support runs out.

read the case study
migration Identity and access

IBM ISIM, Oracle OIM or homegrown provisioning to SailPoint or Saviynt

Getting off IBM ISIM, Oracle OIM or homegrown provisioning scripts and onto SailPoint or Saviynt, with provisioning, certifications and audit history intact.

read the case study
approach

How a Oracle Identity & Access Management engagement runs

We don't start a step until the last one has produced something you can check.

  1. step 01

    Estate inventory

    We go through every OAM and OIG domain, WebGate and connector, then the custom event handlers, scheduled tasks and OAAM rules, and note versions and owners for each.

  2. step 02

    Path decision

    In-place upgrade to 14.1.2 or a fresh build on Kubernetes, decided per environment from the inventory, with JDK, database and TLS prerequisites listed.

  3. step 03

    Rehearsal

    We upgrade a copy of production, run reconciliation and sign-in tests against real applications and record timings for the production window.

  4. step 04

    Cut-over and handover

    WebGates and connectors move in planned waves, each with its own rollback. The run team gets runbooks for the new domains before we hand over.

ai on oracle identity & access management

Where AI fits on Oracle Identity & Access Management, and where it needs guardrails.

Oracle ships little AI for Oracle Access Management and Oracle Identity Governance. The 14c release notes cover JDK 17 and 21, TLS changes and rules on GraalVM rather than AI features. With 12.2.x Premier Support ending in December 2026, AI is most useful for the upgrade itself: reading old Jython rules, mapping configuration and triaging WebLogic logs.

AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Oracle Identity & Access Managementdoes the work

Oracle doesn't document an MCP server for OAM or OIG, at least none we found. Agents should use the OIG and OAM REST APIs under a dedicated service account with least-privilege admin roles. We log the calls, and a human approves any provisioning or policy change before it goes through.

Rule conversion for 14c

In OAM 14c, rules run on GraalVM instead of Jython. Hand an AI coding assistant your existing scripts and it drafts the converted rules and their tests. Engineers review each one, then run it against the same requests on a 14c test domain.

Documenting OIG customizations

Old OIG estates carry event handlers, adapters and approval workflows, and few of them are documented. An assistant can read the exported code and draft a catalog of what each customization does. We confirm that catalog, then decide what to rebuild.

WebLogic and Kubernetes log triage

Once you're on the WebLogic Kubernetes Operator, errors are spread across pods and managed servers. We have an agent group the log errors by cause, so engineers can go to the likely fix.

Oracle docs: What's new in Oracle Access Management 14c ↗Oracle Lifetime Support Policy: Oracle Fusion Middleware ↗Oracle docs: OAM 14.1.2 and the WebLogic Kubernetes Operator ↗
architecture

How Oracle Access Management and OIG fit an Oracle estate

Users reach applications through WebGates that ask Oracle Access Management for policy decisions, with adaptive risk checks on sensitive logins. Oracle Identity Governance reads HR data and provisions accounts to directories and Oracle applications.

How Oracle Access Management and OIG fit an Oracle estate Users reach applications through WebGates that ask Oracle Access Management for policy decisions, with adaptive risk checks on sensitive logins. Oracle Identity Governance reads HR data and provisions accounts to directories and Oracle applications. 01 · USERS AND SOURCES 02 · ORACLE IAM 14C 03 · APPLICATIONS AND TARGETS HTTPS OAP policy check risk evaluation federation trusted reconciliation provision provision Users employees · customers PS HR system PeopleSoft HCM ·Workday OAM Oracle AccessManagement policies · sessions ·federation Adaptive Risk Management risk rules · step-up OAM Oracle IdentityGovernance lifecycle ·certifications WebGates OHS · Apache · IIS ERP Oracle E-BusinessSuite responsibilities Directory OUD · Active Directory Ex Entra ID SAML federation
Read the diagram as text
  1. Users → WebGates: HTTPS
  2. WebGates → Oracle Access Management: OAP policy check
  3. Oracle Access Management → Adaptive Risk Management: risk evaluation
  4. Oracle Access Management → Entra ID: federation
  5. HR system → Oracle Identity Governance: trusted reconciliation
  6. Oracle Identity Governance → Directory: provision
  7. Oracle Identity Governance → Oracle E-Business Suite: provision
use cases

Typical Oracle Identity & Access Management projects

The work teams usually bring us, and the platforms Oracle Identity & Access Management has to talk to while we do it.

  1. ORA-01 OAM and OIG run on 12.2.1.4 and Premier Support ends in December 2026 common request
  2. ORA-02 WebGates on old web servers still use SIMPLE mode or TLSv1.1 common request
  3. ORA-03 OAAM 11g still guards a customer-facing login and nobody wants to touch it common request
  4. ORA-04 OIG reconciliation jobs run longer every quarter as the database grows common request
  5. ORA-05 You'd rather run OAM and OIG on Kubernetes than keep hand-building WebLogic domains common request
Oracle Identity & Access Management · connected platforms
OAM Oracle Fusion ERP & E-Business SuiteOracle PeopleSoftMicrosoft Entra IDOktaSailPointRed Hat OpenShift
you keep

What a Oracle Identity & Access Management engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

  • inventory01

    WebGate inventory with version, web server, security mode and owner

    yours to keep
  • tests02

    OIG connector and custom event handler inventory with 14c test results

    yours to keep
  • report03

    In-place or rebuild decision paper per environment

    yours to keep
  • runbook04

    14c upgrade runbook with timed rehearsal results

    yours to keep
  • inventory05

    OAAM rule and challenge flow mapping to 14c adaptive risk components

    yours to keep
  • runbook06

    Kubernetes deployment manifests and operator runbooks

    yours to keep
talent and delivery · oracle identity & access management

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
roles we staff
  • Oracle Access Management engineer (WebGates, policies)
  • OIG developer (connectors, event handlers)
  • OAAM to Adaptive Risk Management migration engineer
  • WebLogic and Kubernetes platform engineer for Oracle IAM
  • Oracle IAM upgrade lead
due diligence · oracle identity & access management

Questions to ask any partner, including us.

Put these to anyone bidding on your Oracle Identity & Access Management work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    Which of our WebGates use SIMPLE mode or TLSv1.1, and who owns those web servers?

    OAM 14c drops both. Each affected WebGate needs an application team to make a change, and that coordination is often the longest part of the project.

  2. Q2

    Would you upgrade in place or rebuild on Kubernetes, and why for our estate?

    Both are valid. The answer should come from your custom code, environment count and platform plans, not from the partner's habit.

  3. Q3

    How will you test custom OIG event handlers and scheduled tasks on JDK 17 or 21?

    14c is certified on newer JDKs. Custom Java code compiled years ago is the most common source of upgrade surprises in OIG.

  4. Q4

    What is the plan if we miss the December 2026 Premier Support date?

    Extended Support runs to December 2027 at extra cost. A partner should help you compare that cost with a compressed schedule.

  5. Q5

    How will OAAM rules be tested before customers see the new risk engine?

    Bad risk rules lock real customers out. Running old and new side by side in monitor mode shows the difference before anyone is blocked.

01When does support end for OAM and OIG 12.2.1.4?

Oracle's Lifetime Support Policy, effective 13 April 2026, lists Premier Support for Oracle Access Management and Oracle Identity Governance 12.2.x ending December 2026 and Extended Support ending December 2027. Extended Support is priced separately, so most teams plan to be on 14c before then.

02Should we upgrade in place or build 14c fresh?

It depends on how much custom code you run and whether you want to change platforms. An in-place upgrade keeps the domain and data. A fresh build on Kubernetes with the WebLogic Kubernetes Operator gives you a cleaner estate but needs data and policy migration. We decide after the inventory.

03What happens to our WebGates in 14c?

OAM 14c discontinues SIMPLE mode communication and TLSv1.1 and earlier. Any WebGate still configured that way has to move to a supported mode before cut-over, so we list every WebGate with its version, web server and security mode first.

04We still run OAAM 11g. What replaces it?

The Lifetime Support Policy shows OAAM 11.1.2.x past Extended Support since December 2021. Oracle Access Management 14.1.x includes Advanced Authentication Adaptive Risk Management and Universal Authenticator, so we map your OAAM rules and challenge flows to those components.

05How long does a 14c upgrade take?

It depends on the number of environments, connectors, custom event handlers and WebGates. We rehearse on a copy of production and set the window from timed runs rather than from a template plan.

06Do you provide Oracle IAM engineers on contract?

Yes. We staff OAM and OIG engineers on contract, contract-to-hire and permanent terms, onsite in the US or nearshore and offshore, across all time zones.

services

Related services

Projects on Oracle Identity & Access Management usually end up touching one of these, so they're worth a look.

you are hereOracle Identity & Access Management
sources 5 sources linked last checked 2026-10-20 content fingerprint 30a28e95
  1. 01Oracle Lifetime Support Policy: Oracle Fusion Middleware (effective 13 April 2026)oracle.com ↗
  2. 02Oracle docs: What's new in Oracle Access Management 14cdocs.oracle.com ↗
  3. 03Oracle docs: OIG 14.1.2 on Kubernetes system requirementsdocs.oracle.com ↗
  4. 04Oracle docs: OAM 14.1.2 and the WebLogic Kubernetes Operatordocs.oracle.com ↗
  5. 05Oracle docs: OCI IAM identity domainsdocs.oracle.com ↗
Reviewed by the Cohash team Oracle Identity & Access Management is a trademark of its owner, used here to identify the platform. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it