Oracle Identity Governance Reviews

The best part of Oracle Identity Manager is how well it will align to the business. There are features that are more generally required by business and you can easily get them with Oracle Identity Manager. If you compare it with Azure, with the latter you need to do customization and there are a lot of limitations in each of the tools. The connectors we have for Oracle Identity Manager are good, so you don't need to do custom connectors and all.

When I joined my project, they had been using a meta directory for identity management and application provisioning. There were around 150,000 active accounts, out of which many were redundant. They had left the organization 10 years ago. They were still active and they were paying for the maintenance of those accounts on a monthly basis. And there was no data clarity. So the moment we on-boarded Oracle Identity Manager, we started data cleansing, and started to do unmanaged account reconciliations.

With the help of support, we were able to reduce the cost of every identity which was active and was not in the organization.

One thing is the size of the infrastructure that is required for Oracle to implement. In addition, the maintenance cost and pricing.

With an Oracle implementation, we need to have a high availability of infrastructure where you need a minimum of four servers. Compared to SalePoint or with Microsoft Identity Manager, the infrastructure cost is notably less.

With a project for Oracle Identity Manager, the implementation cost is along the lines of a year. If you have 10 connectors or eight connectors and you have workflows, the implementation cost will usually go from eight months to 12 months, minimum. Whereas if you implement a SAP solution or a product like SalePoint, the implementation cost or time is reduced from 12 months to eight months, or even six months.

Six to seven years.

Yes. First, the audit engine. They have not advanced their audit engines from where they started. In version 9.1 it was same issue on the JMS Queues. The audit engine was getting in to queues. I had two clients whose audit engine queue was more than a million. They were not able to process those records because the audit engine was taking too much time and the reconciliation and the amount of data which we used to import was huge.

And after getting in to a year of implementation or two years of implementation, UPA tables get to a stage where they are not able to process the records. We start getting timeouts while processing the records and Oracle was not able to troubleshoot the issue.

Second, is the availability. The moment you install Oracle Identity Manager, the biggest problem is system performance. Even if you go with 8GB or 10GB of RAM, eventually after a week or so, you need a restart for it to survive, even in production. You can see logs where things are failing and the server is responding very slowly.

These things happen often with Oracle but when you compare with SIM or SalePoint, you will not see the system usage or system CPU usage to that extent.

I have done implementations up to 150k. We were provisioning 20 connectors. To be very frank, the experience I had was provisioning and reconciliation was on the scheduler.

Nowadays, if you compare scalability with cloud-based solutions, where you can implement Oracle in a SAP solution, you can extend the scalability. It is auto scalable. But if you need to extend to one or more server, it's not possible. It's not easy in any client-based environment. Scalability is something which is not possible in Oracle or as simple as any SAP solution at the moment.

So there are pros and cons of cloud-based solutions. For cloud-based solutions, you can extend to where there is no issue on the performance. But the limitation is you can't customize everything based on the client's requirements. With Oracle, that was the advantage, but the scalability was still a concern. Until last year it was a concern.

There is the team which handles the incident. And any major issue goes to a second level and then there is an AT which comes into the picture when there is a major issue and your client has a platinum partnership with Oracle. So, in scenarios where you are getting involved with the level-one team or level-two team, they come up with bookish knowledge and they will ask you questions. For instance, for small issues they will ask with you thousands of parameters in your web logic or in your OIM or in your database. And eventually when things are not getting resolved, then we move it to level-two and then AT. And that is when you actually should get results.

One of my client's audit issues was happening from almost nine months. And my previous client was the biggest client for Oracle, a premium client for Oracle, but still they were not able to resolve the issue.

I have only worked on Oracle. For the last year I have not been getting any clients who are ready to implement Oracle. So, that's the challenge for me. That's why I moved from Oracle to other solutions.

Initial setup was very complex when compared to others. Oracle is way more complex than any other implementation. SalePoint and Microsoft Identity Manager are simpler.

If I rate the cost, Oracle is the costliest at the moment. And there is no competition around Oracle and other tools. Oracle is somewhere in millions while a product like SalePoint is much less. So, I am not sure how to rate it. From a service provider perspective, or custom integration perspective, clients are proposing Oracle. So, if I propose Oracle, the only friction I get is the cost. It's too much for the client. Any small client will not be happy to use Oracle at the moment.

If I had to pick an identity management team, I would definitely pick Oracle. It's my favorite. From an implementation point of view, being a developer, I still prefer Oracle over anything else. But if I look at the market and see where things are going, I would go with SalePoint at the moment. SalePoint, or if you have any SAP solutions, I would go with Okta.

Nowadays, what people do is they look for queries, they look for solutions on the internet and they implement them. That will take more time implementing because they don't understand what they are doing. They need to understand the tool before they implement any solution. This is something I tell my juniors as well who work under me. You can't just bypass the basics and get the solution and implement it.

So, if you talk about implementation aligned to the business, Oracle is best. The only tool which I can compare with Oracle at the moment is SalePoint. Other than that, there is no tool which can compete with Oracle from a business implementation standpoint, where it is aligned to the work flows, the customization, which we can do in Oracle.

Regarding performance, I have used SalePoint and it is better than Oracle. And infrastructure cost, which is aligned to the Oracle suite. There are so many things which you need to do on an Oracle implementation, whereas SalePoint is just a small plug-in which you can implement anywhere.

The solution helps us to define roles and get people to specific tasks. From this point of view, it is an amazing tool. 

It is really hard to implement Oracle Data Manager because we have a lot security that we need to manage. We have a lot of security, so it is a bit difficult to implement, but it is still a good product. 

In Canada, we have some difficulty in getting training about this. They ask for at least five people in a class and we only have three people in our team. It's impossible to get the training. We register in Ottawa, but sometimes the class is canceled because we do not have enough people to take the course. 

We are learning a lot about the cloud, and I think that a cloud feature is being added this year. I am learning how the clouds can be used and the possibilities of using it. It's good for me to learn about these features.

We had some down time during the first release. We want to go to the next release. I spoke with the guys over there. It seems that it's easy to push the data that already exists in the new release. We will see. I think there will be more stability. We need to try.

The scalability depends on what you need to manage, the security needs, and the quantity of people.

I was not working on the installation. I'm just working on the part of development of plug-ins and doing Java because I am one of the Java developers. The installation does not seem too bad. I know some guys who are working to build it and put Java in place on all the servers and on all the connectors.

I'm new at this, but I know that the tool is working. I'm not sure if the problems are coming from us or from the implementation itself. We need to balance the complexity versus the quantity of users and the way that we manage all the connectors. 

OIM contributes majorly to simplifying the user management and role management capabilities of corporate users (employees, contractors, partners, and customers) from regulatory compliance requirements by enabling least privileged access.

• Provisioning workflow
• Accessing policies to automate provisioning requirements
• Identifying lifecycle management
• Identifying connector framework for unifying provisioning capabilities from OIM

This applies to the latest version of OIM support in WebLogic and WebSphere application servers only. It would be great if the Oracle Fusion Middleware team worked on making it compatible with other application servers, as it exists in OIM9.x.

No issues were found related to stability.

OIM is the right product and it is a good fit for enterprise deployments. There are no issues related to scalability, as long as it was configured as per Oracle enterprise deployment guidelines.

Customer Service:

I would give customer service a rating of six out of 10.

Technical Support:

I would give technical support a rating of six out of 10.

Depending upon requirements, it takes 10 days to three months to set up an environment.

We have been able, after eight months of coding our own Java classes, to implement a Joiner/Mover/Leaver process.

I won't lie to you. Since we didn't have an IDM, the idea of an IDM and all of its functionality has been valuable.

Most areas need improvements, all the way from the GUI to core functionality, logging, traceability, configuration, and bugs causing crashes. I don't know where to start. It is too complex, has too many bugs, and is an immature product, even the best case, beta version.)

One of the 5-6 consoles (Design Console) is a blast from the 1970's. It crashes constantly. The vendor is aware of it, but has stated that this is not a priority for them to fix.

There were no issues with scalability.

I would rate technical support as the worst. We have had constant meetings with them to follow up on our tickets. If you don't ask them for an update on a daily basis, they will not work on your case. Our average solution time is six to eight weeks, and this includes production issues. I have waited eight months for an answer, and the answer was, "If it fails when you do that, then don't do it."

We used an ETL-engine to push users earlier. It didn't have any "IDM functionality" so we switched to what we though was the best solution available.

I dare you to get an installation up and running in a PoC environment in less than a week. In my opinion, if you haven't done it before, you can't do it in less time.

Don't use it! Find something else. Ask me for advice. We are currently switching to another vendor/product.

One of the most visible improvements would be the fast turn around for getting users access to the system on the day they start work and getting users out of the environment on the last day of work.

The most important features that have impacted our environment recently are the Single Sign-On solution, role based provisioning, and the automated provisioning of accounts to target systems. This is because we operate in a large environment with huge user turnover. Lots of applications are manually provisioning and deprovisioning, which can be quite daunting when done manually.

The development and the administration side could be a lot more intuitive and easier to use than it currently is, in terms of functionality and what it tries to achieve as a Single Sign-On entity for an enterprise environment. However, on the development and administration side, the learning curve is steep and quite challenging to master.

We don’t really have any issues with the platforms stability as it is up and running with minimal downtime that is caused by the OIM itself. I would rate the platform as very stable.

At the moment, we have not had any issues with the product’s scalability.

The technical support from the product owners could be a lot better. Their default mechanism seems to be referring you to documentation, which most times does not solve your issues immediately. I believe that when you reach out to technical support for help, you want someone who can help address your needs immediately, not telling you how to investigate the issues yourself.

This is the first implementation of a Single Sign-On solution.

I was not here for the initial setup, but from what I have seen so far, it seemed pretty complex.

Document, Document, and Document. The product is very vast and complex and it can get pretty large in a short amount time. It pays to document every thing you do. Other than that, I think it’s a great product and it has a lot of potential.

It has improved the way my organization functions through customer implemented OIM and OIA. It keeps us compliant and away from risks and federal penalties.

I have found the OIM Connector framework, based on ICF, to be the most valuable feature.

OIA needs to improve its governance features.

I did not encounter any issues with stability.

I did not encounter any issues with scalability.

Oracle's support is not as good as that of other vendors.

We started with OIG.

The initial setup was complex, due to suite level integration.

Oracle licenses are expensive. I suggest making pricing and licensing decisions that align with architectural requirements and the project's budget.

I evaluated CA and RSA before making my decision.

Go with Oracle if you expect more customization features from the product.

• Centralized life cycle management of identities: the centralized view of people requesting access to provisioning to targets and governing the access from one place
• Periodic certifications of access for compliance

The organizational benefit is increased efficiency and simplicity so that we can manage the identify lifecycle faster and better, and so we can govern the access from a central place and make it easier.

Oracle is probably already working to make the overall user experience lighter, including the UI.

I have been working with all versions over the last seven years.

We have not encountered any deployment issues; it's manageable and easy.

The current version is stable. Past versions have stability issues.

There are some scalability issues with every product; most of them are related to load and performance but these can be handled and they are improving day by day.

Technical support is good, depending upon the severity and relationship with Oracle; but overall, you will get an answer.

Technical support is 3.0/5.

It's flexible enough but requires enough technical knowledge to set up.

Rich authorization engine for delegated admin
Robust workflow capability with BPML engine
Extensive connector support
Diagnostics are pretty good

Used it for external user registration, password & profile management

Attempted to model a hierarchical role model but the OIM Access Policies, which map roles to entitlements, don't provision entitlements from inherited roles. This is a flawed design, IMO, limiting you to a flat role model.

A lot of Dependencies - Oracle database, WebLogic, SOA
A lot of things still have to be done in Design Console, which still has a 90's UI.
No REST interface for Identity as a Service that I'm aware of
Doesn't hide its complexity

Expensive
Weak support team
Built on, and relies on ADF for extensibility

3+ years

Poor

Hit and miss

If you're anticipating a lot of growth, you may be able to keep costs more predictable with CPU-based licensing.

Classic enterprise provisioning system provides self-service, resource attestation, password synch, delegated admin. My use is for external user registration system into OID for target system.

The most valuable features are the comprehensiveness; the whole identity lifecycle management; the centralized view of people requesting access to provisioning, to SLD, and to access review; basically, the whole suite.

The features are there. Oracle has always had a good vision about where the product is going.

The greatest benefit is increased efficiency so we can manage the identify lifecycle faster and better and so we can govern the access from a central place and make it easier.

I would like them to focus on profile-based provisioning and make what we call the birthright access management. We need to have an easier way for people to find out the birthright rules and based on the birthright roles, the people get access they need to get what they want done.

By profile, I'm referring to job profile. Take engineering as example. To do their jobs, all engineers need access to some applications and systems. There are typically multiple engineering teams, e.g. the access needed by network engineering team can be quite different from security engineering, corporate software engineering, and customer facing software engineering. However for each of these engineering teams, people tends to have the same job profile (title, reporting to, department, etc.) and they may require the same access rights to a common set of apps / systems.

I am imagining that users could select security engineering and then a number of access requests could be generated for a list of apps / systems that a typical security engineer needs access to.

But first they need to work out the product stability issues and make it easier to upgrade, support, and troubleshoot; those kinds of things.

Sometimes, it does not meet our expectations in terms of stability. I would give it a 3.5/5 for stability.

Given that it's an OEM product, the scalability is not really a critical factor for us. People can wait for minutes, hours, even days to get access granted. For OIM, it's not really a high criteria.

Technical support is pretty good. The only comment is that it depends on which company you come from. Some companies have great relationships with Oracle's product management, so they can get access to the best resources faster than others. We happen to be one of the customers that have a close relationship with Oracle, so no complaints.

We did not really have a previous solution. OIM has been here for years. Many, many years ago, we had a homegrown solution, but it’s no longer there. For the several past years, I know it's just been OIM.

Initial setup is not a part of my job function.

I just joined, so there's no initiative to reevaluate that part.

I would certainly short list OIM on a list of candidates along with some others in the market. With Gartner publishing every year, you have a good review for all the products on the market. For me, Oracle is at least top 5.

The features are there. Oracle has always had a good vision about where the product is going.

A vendor must have a quality product with easy-to-use features. Right now, user experience is a big thing in the market. Many vendors offer similar solutions. Ease-of-use and the quality of that is the main factor for us.

This solution is for single-sign-on. We are trying to extend that feature to include other enterprise applications.

The user-level management has improved when you have this solution in place. It's very difficult for us to manage the user access at the corporate level. It is a 24/7 job and we are global with multiple locations. We have user groups who manage all user access on the global level. That is easier to do with Oracle Identity Management in place.

I would like to see it expand to other applications as well. There are certain non-Oracle applications where the integration might be difficult. It would be good if that integration could be simplified.

The solution is stable.

It is scalable as we expand into other applications. You need to fine-tune in some areas when expanding and maintaining the application.

In this area, I don't see great support. There are a few guys we know in the Oracle support group, so we can escalate a case if they are there. The issue can then be resolved fast. It would be good if more of the team members could catch up to that level.

This installation is straightforward. A lot of documentation is available from the Oracle website. We were able to implement this in-house, without spending too many dollars. I think it is pretty good.

It is a great product. There may be some issues during setup, but once it’s stabilized, it's a perfect product.