Oracle Identity Governance Reviews

It brings centralized management of all the identities for the E-Business Suite; that's the central feature.

It streamlines the management of users, and it also provides compliance, in terms of the policies around maintaining identities, expiration, and so on.

It is cumbersome to deploy; there are multiple layers in terms of trying to get it to work; and they're also limited in terms of the number of products it can integrate with.

As far as deployment being cumbersome, I think it's just the nature of the product. For the version that we have, you need to have your own directory services or ID on top of that. Then you have to integrate it to Active Directory; that's another layer. Even the number of different products, packaged in terms of, "Do you want to do provisioning, or are you just looking to do authentication and authorization?"; all that mix is really difficult to configure.

It's very stable. Now, we do have it deployed with some high availability options on the back end, and we have multiple app servers, and that combination is very stable.

It scales well, because you can add more nodes. You can scale it vertically as well as horizontally.

I would give technical support an average score; it could be improved, it could be much better. I think it takes a long time to get to the issue resolution. You end up supplying the same information multiple times.

It's best to bring in a consultant who understands all the nuances, because of the difficulties with initial implementation. Once successfully deployed, is a fairly stable and easy to maintain, but that initial implementation is a high wall to scale for it to be successful.

We didn't look at other options because the Oracle product, at the time, was the only product that can fully integrate with Oracle E-Business Suite and manage those identities.

The most valuable feature is that it provides a consistent user interface. That's the primary thing, the consistent user interface.

Over time, it will improve the way my organization functions. We've had some challenges as far as rolling it out, but that's the goal. We have a consistent set of processes, so we need a consistent toolset to be able to disperse across our organization.

One of the things they don't have is, they don't provide support for what are called service accounts, non-human accounts, non-human IDs. That's critical.

In addition to that, we have some role mining capabilities that Oracle really hasn't included or defined what they're going to do, how they're going to incorporate that. They've been converging these two products for a very long time, Oracle Identity Manager (OIM) and Oracle Identity Analytics. There's still that component that's still outlying.

We've had some stability issues. We've worked closely with Oracle to resolve them. Just recently, we got performance issues. We're going to the new version. It was released last year. There are about a dozen customers that have it. We've discovered some performance issues. Oracle has worked closely with us. It's gotten to the point where it's ready to go. We're going live with it this weekend, the new version.

Scalability is one of the problems that we've had. Now that we've had it in production, and we have X number of concurrent users, we're having some performance issues. That's what they've helped us with, as far as they’ve given us some patches to correct the issues; it's become a little more acceptable. We're not at end state yet, so that's another thing we're going to continue to work with them on.

We meet often with Oracle. We have, literally, meetings at least twice a week with our technology staff. I coordinate a monthly meeting with some of their executives and our executives. We have a lot of visibility with Oracle. Overall, technical support is very good.

I was involved with the initial setup. It's not so straightforward. It's a very complicated space. It's a complicated tool to implement. There seemed to be a lot more customization and configuration that we needed to do; we initially believed we could just work out of the box.

Several years ago, I actually coordinated a proof of concept. We looked at several different vendors. We eventually landed with two vendors. We actually had kind of a bake off. Both of the vendors came in. We put them through a series of tests, we had usability tests, scripted tests. We had them demonstrate a lot of their functionality, and then we evaluated them. The OIM product came out on top.

We decided to go with Oracle because, when we did those different types of tests, they scored better than the other provider in all aspects.

When I’m selecting a vendor such as Oracle, it's important for us to make sure that they deliver on time, that they have a solid road map, and that they have the resources to back what they commit to.

I recommend the product. I recommend that they consider pilot rollouts when they go live, not a big bang, so they can gradually understand, once they implement it, what the real impacts are. That's pretty much the biggest “a-ha” that we had. Build the knowledge and understand how it functions, not just based on the documentation, but try it out, test it out, and come into it, eyes wide open.

I don't think there are other products like it out there. Again, there's always room for improvement.

Oracle Identity Manager is not in production yet. We are evaluating the product. There is a very strong motivation to get it out there into production and there is a need for it. Sooner or later, we will be doing it.

We need an application to allow role-based access. That is our next phase of implementation. We need to get there. Once our current engagements are completed, that will become our number-one priority. Right now, as I’ve mentioned, we are evaluating it. Apparently, it seems like it's meeting our requirements.

My pain point was while migrating my current user base. There is a certain point during that phase of the install where, if you get past it and make a mistake, there is no possibility of going back to a point before the mistake was done. If you cross that point, you have to start all over. That was my bad experience. I had to try it over and over to understand the point of failure. I had to do an install eight or nine times to get one right. After that, after I got my first install right, I learned that they have come up with a new mode of install called the LCM, life cycle management. That was pretty impressive. With the lessons I had learned before the LCM and with the new mode of installation, the LCM, I felt the install was, meaning the release, was done really well.

I have been using it for two years now.

Stability is as good as how you manage it. If it is in the hands of a bad administrator, it is only as good as how that administrator is.

As I’ve mentioned, we are still testing the waters. We haven't gone into experimenting how good the scalability is.

A certain team, the A-Team, is fantastic, but it's extremely difficult to reach out to that team. The last time I was in touch with them was a long time ago.

For the first year, I went around and around, and it never went anywhere. We had to escalate it so we could get our access to the right folks. There was also a learning curve, both for us and for the service techs out there who were handling my case. I think they're learning better than I am, because I'm spanned out across to other projects as well. That being their number one priority, I'm hoping that they ramp up at a quicker pace, so that, for the wider user base, it becomes a point of advantage.

Because OIM has a Java API, you can develop scripts and automate tasks. Integration with other products written in Java is easy, more or less.

The user just has to search the product+role in OIM and request it, with an approval workflow. The account is created automatically.

The GUI is very old and could be more user friendly; not all administrative operations can be done with the web interface. You need a Java client for fine tuning. Search operations are very slow, and you often need to use a wildcard. Users expect much-easier, Google search-type operations.

Stability can also be improved.

I have used it for two years.

• We see a lot of Java exceptions in logs
• The task scheduler often doesn’t work.
• It loses its connection with BBDD clusters.
• We need to reboot the product very often.
• Data sources stop working after a few days of intensive use

I have not encountered any scalability issues.

Technical support is 9/10.

I did not previously use a different solution.

Initial setup was complex; a lot of customizations are needed for the product to work.

Before choosing this product, I did not evaluate other options.

Try to implement newer versions (OIM 12c, for example), or change to other vendors (IBM, CA).

The capability of writing a custom connector makes this product flexible enough to potentially reach all types of target systems.

As an SI, I have implemented this product at multiple customers and it has improved overall user management.

Capability of building custom forms: Currently, the form building has very limited customization capability.

I have been using it for 2.5 years.

Password Sync had some issues, where some passwords from Active Directory use to fail while synchronization.

In customer identity management, the product suffers performance issues when scaled up to large numbers of users.

Technical support is pretty decent; would rate it 6.5/10.

I did not previously use a different solution.

Initial setup had medium complexity in terms of custom connector building.

It is very expensive.

I did not evaluate other options. The customer chose this product.

It is one of the best in breed, but is very expensive.

Connectors and the ability to provision and reconcile information. We can remove all access in one hit, but also easily provision a user with accounts all from one place.

The provision and deprovisioning means its more secure, less administration is required, and all the information about an identity is stored in one place. It saves costs of having to administer a user in every area or application.

The Design console is a bit dated and complicated to use when in development. It’s the biggest issue out there for all Oracle OIM developers who want to develop connectors (custom). Also, they need more easy to understand guides on how to use the API’s within OIM to create notifications or event handlers. I have been on a development course and this is still an area I struggle with. If we had a better understanding of the dev side of things we would do so much more with this product.

There were no issues with the deployment.

We have had no issues with the stability.

It's scaled for our needs.

It’s a difficult product to fully understand but with time will become a lot easier to use. I have only used Oracle so I cannot compare it with other products.

There are many valuable features, most notably Single Sign-On, Identity Management, and Identity Connector Framework, which can be implemented to provision with diverse interfaces.

It has assisted us with UI customization, as well as connecting to other frameworks using the OSB (Oracle Service Bus) and Custom Connectors.

The product requires improvements for UI customization with the current sandbox. Many people prefer that sandbox be removed from the product, as it has caused major challenges with wide implementations. Another improvement would be to provide the user-friendly option of replicating out-of-the-box attributes.

This solution has been successfully implemented and managed for the past 3+ years.

Deployment of sandbox is a major concern, as its stability was underprivileged if implemented with multiple sandboxes from different out-of-sync locations.

Scalability is reduced if the load increases above approximately 100,000.

I would rate this a 7. Since they have wider support level every 12 hours, a service request might change to different time zone. Therefore the same request must be provided again to the new support assistance.

No comment. I personally was not involved during the initial phase.

I personally was not involved during the initial phase.

It was an in-house implementation. Full re-testing will be required if the implementation involves a sandbox and we need to have eyes on the request page labels post-implementation.

I recommend for people to wait for the new version, in which the concept of a sandbox will be removed.

I rate the product a 7. The product provides good out-of-the-box functionality, and Oracle provides fair technical support, but the product does have its drawbacks. Performance is bad, and tuning must be performed by Oracle, which will take time. Customization of the product’s existing features is not user-friendly.

The following is a list of features that I have observed being used by my client that I have implemented:

1. User identity provisioning & lifecycle management
2. User Identity Profile/Attribute management
3. Self-Service Tool for end-user access request & password change
4. Role and Entitlement provisioning in target application/s
5. Auto de-provisioning of user identities
6. Audit capabilities & Report generation

I have seen an organization benefit through the automation of mundane repeat tasks related to setting up user identities, and managing user access as per a defined role. One of the key business driving factors for OIM implementation has been SOX compliance. End User Self-Service like password reset and access request is another feature that helps to reduce helpdesk calls.

The underlying architecture of the product is quite complex and hard to maintain and troubleshoot. Self-Service capabilities are quite limited, and the out-of-box capabilities are limited and customizations are quite complex.

I’ve been using it for four years.

Releases prior to 11gR2 PS2 were hard to deploy due to lot of shipped bugs. Every implementation was like dealing with an endless series of patches.

Once you get it working right, it turns out to be quite stable. 11gR2 PS2 can be considered as the first bug free stable release.

Scalability has never been an issue.

Technical support is horrible. It is faster to find the resolution ourselves than rely on support. Product team engagement has been helpful but it’s hard to get direct access to the product team resources. They are good at responding as per SLA without issue resolution.

I have worked with Microsoft FIM and SailPoint IQ as well. This was not by choice but the client environment was a multiple identity management platform. Silo based deployment had resulted in a solution that meant that there were multiple identity management solutions supporting the company’s global needs.

It was complex, primarily due to dependencies on various underlying technologies like Java, WebLogic, SOA, Database, and BI for reporting etc. Version compatibility was critical and any mismatch could lead to partially functional implementation. Things got better with 11gR2 PS2.

I was part of vendor team responsible for implementing the solution.

One thing for sure, is that it is the most comprehensive solution out there in the market. During the preliminary stages when the concept of Identity Management was not well defined, every vendor came up with a product offering solution for very specific use cases. Now, the offerings are quite mature but they still have trace and limitations bound to their origins. If you are looking for a simple, and quick, tool to get started with, there are many options out there in the market but then there are limitations that require customization or creating features from scratch.