Oracle Access Manager and OIG to a modern identity provider and IGA
Cohash replaces Oracle Access Manager and Oracle Identity Governance with a cloud identity provider such as Entra ID, Okta or Ping, and a governance platform such as SailPoint or Saviynt. We inventory WebGates, policy domains, connectors and event handlers, move SAML and OIDC apps first, put header-based apps behind a gateway, rebuild provisioning and certifications, and run OAM and the new IdP side by side until the last app moves.
- 01Inventory OAM and OIG
- 02Sort apps by protocol
- 03Coexistence
- 04Rebuild governance
- 05Parallel run and cut-over
- 06Decommission
The story
Told without the client's name or anything that could identify them.
A university's identity team ran Oracle Access Manager 12.2.1.4 and Oracle Identity Governance on WebLogic servers that only a contractor knew how to patch. Premier Support for 12.2.x ends in December 2026, and when the 14c upgrade quote arrived the CISO asked what a cloud identity provider would cost instead. We inventoried every WebGate, policy domain, connector and event handler, then sorted apps by protocol. SAML and OIDC apps moved to Entra ID first, header-based apps went behind a gateway, and governance was rebuilt in SailPoint after a parallel certification cycle. OAM and OIG were then shut down, with their audit history archived.
why it was urgentOracle's Lifetime Support Policy lists Premier Support for OAM and OIG 12.2.x ending in December 2026 and Extended Support in December 2027. Staying means a 14.1.2 upgrade with JDK 17 or 21, no TLS 1.1 or SIMPLE mode, and rules running on GraalVM instead of Jython. Many teams price that upgrade against leaving.
- openOAM 12.2.1.4 sits on WebLogic servers, and only one contractor knows how to patch them.
- recurringMost apps behind WebGates could speak SAML or OIDC, but nobody has asked them to.
- blockedOIG custom event handlers and approval workflows break on every bundle patch.
- openThe 14c upgrade quote arrived and the CISO asked what a cloud IdP would cost instead.
The estate, before and after
Before: OAM WebGates and OIG on WebLogic
Users signed in through OAM WebGates, which passed headers to some apps and sessions to others, including E-Business Suite. OIG reconciled from HR and provisioned targets through custom event handlers, all on WebLogic that few people could patch.
Read the diagram as text
- Staff and students → Oracle Access Manager 12.2: sign-in
- Oracle Access Manager 12.2 → Web apps behind WebGates: WebGate session
- Oracle Access Manager 12.2 → Header-based apps: identity headers
- Oracle Access Manager 12.2 → E-Business Suite: OAM sign-in
- HR system → Oracle Identity Governance 12c: trusted reconciliation
- Oracle Identity Governance 12c → Web apps behind WebGates: target connectors
- WebLogic servers → Oracle Access Manager 12.2: hosts
- WebLogic servers → Oracle Identity Governance 12c: hosts
After: Entra ID for sign-in, SailPoint for governance
Sign-in is Entra ID's job, directly for SAML and OIDC apps and through Application Proxy for header-based ones. Governance is SailPoint's. It takes HR events, provisions accounts and groups and runs the certification campaigns.
Read the diagram as text
- Staff and students → Entra ID: sign-in
- HR system → SailPoint: joiner · mover · leaver
- Entra ID → SAML and OIDC apps: SAML and OIDC
- Entra ID → Entra Application Proxy: pre-authentication
- Entra Application Proxy → Header-based apps: identity headers
- SailPoint → Entra ID: groups
- SailPoint → SAML and OIDC apps: provision
- SailPoint → Certification campaigns: campaigns
How we run it, phase by phase.
6 phases take you from Oracle Access Manager and OIG 12c to Cloud identity provider plus SailPoint or Saviynt. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Inventory OAM and OIG
Every WebGate, policy domain, authentication scheme, header variable and session setting goes on the list with its app and owner. Connectors, event handlers, scheduled tasks and approval workflows go on it too.
- phase 02
Sort apps by protocol
Apps that support SAML or OIDC move to the new identity provider directly. Header-based apps go behind a gateway such as Entra Application Proxy with header-based SSO or PingAccess. Oracle apps that sign in through OAM, such as E-Business Suite, get their own plan.
- phase 03
Coexistence
OAM and the new identity provider stay federated for the whole move, so someone signed in on one side reaches apps on the other without a second prompt. Session timeouts are aligned to avoid surprise logouts.
- phase 04
Rebuild governance
In SailPoint or Saviynt we rebuild OIG's trusted reconciliation, target connectors, roles, SoD rules and certifications. Custom event handlers turn into workflows or transforms. Or they're retired, with the reason written down.
- phase 05
Parallel run and cut-over
Run provisioning and a certification campaign in both tools for one cycle. Then move apps off WebGates in waves, and switch OIG provisioning target by target.
- phase 06
Decommission
Finally the WebGates are removed from the web servers and the OAM and OIG domains shut down, with audit and certification history exported and retained.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
Web apps sign in through the cloud identity provider
Apps that support SAML or OIDC moved off WebGates to Entra ID in waves, with OAM federated during the move so users never saw a second prompt.
- result 02
Header-based apps sit behind a gateway
Apps that trusted OAM headers now get identity through Entra Application Proxy header-based SSO. The others have a code change or a retirement date.
- result 03
Event handler rules are written down and rebuilt
Logic buried in OIG event handlers, username and email generation for instance, was read line by line. It was rebuilt as SailPoint workflows or retired, with the reason written down.
- result 04
Provisioning and certifications run in SailPoint
After one cycle in parallel with OIG, HR now feeds joiners, movers and leavers straight into SailPoint, which provisions targets and runs the certification campaigns.
- result 05
No identity WebLogic servers left to patch
WebGates have come off the web servers and the OAM and OIG domains are gone. Audit and certification history was exported and kept for retention.
Risks we plan for
-
Header-based apps
Apps that trust OAM headers for user identity can't simply be repointed. Each needs a gateway, a code change or a retirement date, and they are usually the long tail.
-
Oracle application dependencies
E-Business Suite, PeopleSoft and other Oracle products may sign in through OAM or read Oracle directories. Their sign-in path is tested early, because it decides the coexistence period.
-
Event handler logic
OIG event handlers often hold business rules nobody wrote down elsewhere, like how usernames or email addresses get generated. We read them line by line before the governance build starts.
-
Running out of support mid-project
If the move runs past December 2027, OAM and OIG run without Extended Support. The plan sets a fallback: either a scoped 14c upgrade or a firm cut-over date for the riskiest apps.
Where AI helps, and where it needs guardrails
SailPoint's Agentic Fabric, generally available since 4 August 2026, and Saviynt Identity Security for AI, released 24 March 2026, both govern AI agents as identities, which OIG never did. We use the move to register agents and their owners in the new IGA. AI assistants can turn exported OAM policy and OIG connector files into a first draft of the app inventory, but an engineer checks every line against the running system.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- inventory01
OAM and OIG inventory with app, owner, protocol and target per item
yours to keep - design02
Coexistence design for OAM and the new identity provider
yours to keep - plan03
Gateway plan for header-based applications
yours to keep - code04
Governance build with connectors, roles, SoD rules and campaigns
yours to keep - runbook05
Cut-over runbooks and archived OIG audit history
yours to keep
Platforms and services on this move
Learn the background
Terms from this page in plain English. If you want the why, the field note behind it is right there.
- 01Certification campaign
- A scheduled review in which managers or owners confirm, person by person, whether each one should keep the access they hold.in context →
- 02Connector
- The integration between an identity platform and an app. It's how the platform reads and changes accounts and access in that app.in context →
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Should we upgrade to 14c instead?
Sometimes staying is right, for example when lots of Oracle apps depend on OAM or you have to stay on-premises. If most apps can speak SAML or OIDC and you'd like to stop running WebLogic, leaving usually works out cheaper over time. We price both from the inventory.
02Can access and governance move at different times?
Yes, and they often do. Sign-in tends to move first, because apps can go one at a time. Governance follows once the new IGA platform has its sources and connectors working.
03What happens to E-Business Suite sign-in?
It depends on how EBS is integrated today and whether EBS itself is moving. We test the EBS sign-in path in the first weeks, because it often sets how long OAM has to stay.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAuth0 Rules and Hooks to Actions before end of life
Rewriting Auth0 Rules and Hooks as Actions before their 18 November 2026 end of life, with token claims compared before and after each change.
read the case studyd265acf8 - 01Oracle Lifetime Support Policy: Oracle Fusion Middleware (effective 13 April 2026)oracle.com ↗
- 02Oracle docs: What's new in Oracle Access Management 14cdocs.oracle.com ↗
- 03ITBrief: SailPoint launches Agentic Fabric (4 Aug 2026)itbrief.co.uk ↗
- 04Saviynt press release: Identity Security for AI (24 Mar 2026)saviynt.com ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it