Oracle Identity Cloud Service: Identity for Business Applications in the Hybrid IT

Hybrid IT has become the default state for most organizations as “cloud first” strategies collide with the long, multi-year reality of migrating critical workloads. Because IAM is a foundational control for security, compliance, and access, it must follow workloads wherever they run, making a hybrid IAM model unavoidable. The direction of travel is shifting from on-premises IAM with some cloud support toward cloud-delivered IAM (IDaaS-first) with strong, deliberate support for existing on-premises applications, since identity services work best when located near the systems they must protect.

Many IDaaS offerings focus narrowly on run-time needs—SSO, federation, and adaptive authentication—yet IAM requires broader depth: managing identities and entitlements, provisioning accounts and access, enforcing authorization decisions, and auditing with Access Governance (including access reviews and Segregation of Duties controls). The 4A model (Administration, Authentication, Authorization, Auditing) highlights that authentication-only services cover only a fraction of the full requirement. Hybrid support is further complicated by unequal integration maturity: SaaS commonly uses SAML and OAuth/OpenID Connect, while many on-premises applications lack these standards and require alternatives such as HTTP header injection. Governance quality is tightly coupled to provisioning depth; weak provisioning undermines entitlement visibility and reviews.

A gradual migration path is recommended, avoiding tactical connector-by-connector decisions. Options include enhancing on-premises IAM with SaaS connectors, adding SSO-centric IDaaS, selecting comprehensive IDaaS with IGA, connecting back to on-premises via gateways, integrating with existing on-premises IAM, or using CASB interception as a workaround. Oracle Identity Cloud Service (IDCS) is positioned as a comprehensive, multi-tenant platform supporting hybrid scenarios, deep Oracle application integration, gateways for access and provisioning, adaptive MFA and risk-based policies, and identity-aware API security, enabling staged modernization and eventual retirement of legacy IAM where feasible.

• Most organizations operate hybrid IT environments and are expected to continue doing so for many years.
• Shifting business workloads to the cloud commonly takes years and often tens of years.
• Many IDaaS products primarily emphasize Single Sign-On and adaptive authentication.
• IAM is described as encompassing identity administration, authentication, authorization, and auditing/governance.
• Access Governance includes regular access reviews and enforcement of Segregation of Duties controls.
• Many SaaS applications commonly authenticate using identity federation standards such as SAML and OAuth.
• A large portion of on-premises applications lack federation standards support and may require HTTP header injection approaches.
• Oracle Identity Cloud Service is implemented with a microservice architecture aligned with cloud principles such as scalability and resilience.
• The Oracle Application Gateway uses NGINX and Oracle Linux and acts as a policy enforcement point using IDCS as the central policy definition point.
• The Provisioning Gateway supports integrations with over 60 enterprise applications, including mainframes.

• “IAM as a critical IT capability should run where the critical business services reside.”
• “Hybrid IT mandates hybrid identity services.”
• “IDaaS services that are just SSO and authentication services lack the depth that is required for successfully securing and governing business applications.”
• “The shift to a hybrid IAM can be done in different ways, depending on the requirements and the IAM infrastructure that is already in place.”
• “Oracle Identity Cloud Service delivers the IAM capabilities for the hybrid business.”
• “Unfortunately, this is a long-term evolution.”
• “There is no way to split identity services into disparate services for the ‘old’ and ‘new’ IT.”
• “Many of these investments don’t follow a well-thought-out strategy but are tactical…”
• “Moving to an ‘IDaaS first’ approach is a consequence in the shift to as-a-service models.”
• “Just relying on gateways is the lean approach, while continuing to run full-blown on-premises IAM is more complex and costly.”