Oracle Identity Governance

Digital transformation is expanding organizational attack surfaces through initiatives like digital workplaces, DevOps, security automation, and IoT, creating new risks that must be assessed and managed without disrupting business operations. Identity Governance and Administration (IGA) is positioned as a core discipline for improving security posture through end-to-end identity lifecycle management, entitlement and policy workflows, role management, access certification, Segregation of Duties (SoD) analysis, reporting, and access intelligence. Weak IGA capabilities expose organizations to identity theft, unauthorized changes, access creep, role bloat, delayed fulfillment, orphaned roles/accounts, and SoD conflicts that can enable internal fraud. IGA is also framed as the convergence of Identity Provisioning (fulfillment across the lifecycle) and Access Governance (business-facing tools for workflows, certifications, reporting, and SoD checks), with access intelligence providing analytics for decision support. Privileged Access Management (PAM) is increasingly adjacent to IAM, with a possible future convergence with IGA via partnerships or built-in features, though potentially limited.

Oracle addresses governance needs with Oracle Identity Governance (OIG), available via the Oracle Cloud Infrastructure (OCI) Marketplace as part of Oracle Identity Management (IDM) 12c, using cloud-native approaches to support compliance-driven enterprise use cases and automated lifecycle governance. Key capabilities include lifecycle management, access requests and certifications, RBAC, SoD controls, and analytics reporting on access. OIG 12c streamlines application onboarding via a self-service wizard UI, optional Groovy transformations, bulk onboarding, REST APIs, and automated schema/data-type discovery, plus reconciliation, connector cloning, and scheduling. Role lifecycle management adds role discovery, role mining, and business-friendly policy authoring, including converting existing grants/requests into role-based grants. Certification features support campaign targeting and reviewer customization, while REST APIs enable web/mobile self-service. Broad connector coverage supports hybrid and SaaS targets. Security enhancements include JWT for SCIM/REST, TLS 1.2 ciphers, improved keystore management, and request header/origin controls. Deployment emphasizes Docker, Kubernetes, Terraform, CLI-driven automation, and multi-cloud support, though challenges include Oracle database dependence, RBAC without dynamic authorization, and no PAM offering.

• Identity Governance and Administration includes identity lifecycle management, access entitlements, workflow and policy management, role management, access certification, SoD risk analysis, reporting, and access intelligence.
• Weak IGA can lead to identity theft, unauthorized changes, access creep, role bloat, delayed access fulfillment, orphaned roles/accounts, and SoD conflicts enabling internal fraud.
• Access intelligence is described as an analytics layer over identity provisioning and access governance to support decision-making and enhance governance.
• Oracle Identity Governance is available on the OCI Marketplace as part of the Oracle Identity Management solution.
• OIG supports identity lifecycle, access requests and certification, RBAC, SoD, and analytics reporting on user access to resources.
• OIG 12c introduces a self-service, wizard-based UI for application onboarding and supports bulk onboarding and REST APIs.
• OIG provides certification capabilities such as group review support and customizable assignment of who reviews what.
• OIG exposes REST APIs enabling tasks like mobile certification reviews, access requests, catalog search, and viewing roles/entitlements and approval status.
• Security enhancements in OIG 12c include JWT tokens for SCIM/REST, TLS 1.2 cipher additions, and a move from file-based keystores to a keystore service (KSS).
• A stated limitation is that Oracle Identity Governance requires an Oracle database as part of the core IDM infrastructure.

• “To remain relevant, organizations must reinvent themselves by being agile and more innovative.”
• “Emerging technology initiatives such as the digital workplace, DevOps, security automation, and the Internet of Things continue to expand the attack surface for organizations as well as introduce new digital risks.”
• “Security leaders, therefore, have an urgent need to constantly improve upon the security posture of the organization by identifying and implementing appropriate controls to prevent such threats.”
• “IGA also refers to the increasingly integrated Identity Provisioning and Access Governance markets.”
• “Access intelligence is the analytics layer over Identity Provisioning and Access Governance that offers business-related insights to support effective decision making and potentially enhance governance.”
• “Future trends may show a convergence of IGA and PAM in the market… although PAM capabilities in these instances may be limited.”
• “OIG now uses a self-service wizard-based UI.”
• “With OIG 12c, a more business-friendly self-service UI is available, in which different lines of business can gain role insights and author policies before submitting the policy for review and going into production.”
• “OIG provides REST APIs for user self-service use cases giving both web and mobile clients the ability to provide a better user experience.”
• “Overall, Oracle shows that they listened to their customers and provided the Identity Governance tools that they needed in a much simpler, straightforward, and automated way.”