Opal.dev vs. Oracle Identity Governance

I am frustrated that my organization chose to adopt Opal for our access management tool. It is extremely difficult to use, due to bugs and basic functionality missing. Engineers are not given write access to production resources, so every change must flow through Opal.

This involves writing an IAM policy by hand for every request, because it is far too difficult to find an existing role in the system, and requests must the narrowly tailored only to allow the exact operation requested. Opal makes this process much more difficult because it lacks basic functionality for end users, such as: -Ability to modify an existing IAM role

-Ability to view existing IAM roles

-Ability to delete duplicate Opal roles

-Lack of IAM role templates

-Poor error messages when attempting JSON policy fails validation

In general, each Opal request takes 5-10 minutes because you need to be very explicit with every API action you are requesting, which then needs to be repeated multiple times because it is very hard to get everything correct the first time, which then requires a new round of reviews. This is partially because AWS IAM roles can be tricky to get right, but Opal provides no functionality to make this easier.

Incentivized

Oracle Identity Manager (OIM) is great if you have a huge organisation and a lot of users to support. It integrates particularly well if you want SSO and already use Oracle's business suit applications such as Oracle Business Intelligence. One of the most important things to keep in mind while deciding to go ahead with OIM is whether or not you have enough time, money and resources for its implementation because it can be very challenging and expensive.

Incentivized

• Provisioning and Deprovisioning from HR System PeopleSoft into OIM and downstream systems
• Access Requests and SOA Workflows
• Active Directory and Exchange Connnectors also work great

Incentivized

• Inability to modify an IAM role after creation
• Inability to use templated IAM roles
• Inability to see existing IAM roles
• Inability for users to clean up existing Opal roles
• Poor ability to search for existing Opal roles
• Repeated reliability issues - IAM role creation breaks far too often
• Cryptic error messages when IAM JSON is incorrect

Incentivized

• It is extremely difficult to install and administer.
• It is very complex, to set it up correctly requires a huge learning curve.
• The product is not stable and somewhat buggy.

Overall good product and somewhat reliable when used in a specific manner. However, there are cons like unending bugs and no well-defined upgrade path. The product could have been more flexible and lite in terms of organisational infra needs. OIM is a robust product but other vendors are almost on-par now.

Incentivized

OIM is a leader in the identity management space and appropriate for specific organisations and use cases. Where its competitors have an edge over cost and overall look and feel of product, OIM offers Oracle's vast experience of enterprise security products and compatibility with infrastructure applications. It melds well with other Oracle security products like OAM and OAAM. When cost is not a problem and you are ready to invest your resources for long-term OIM is preferable. It has its pros and cons as explained earlier, and should be selected on basis of specific needs.

Incentivized

• Decreased engineering productivity

Incentivized

• It has sped up onboarding processes by at least 3x.
• Reduced workload.
• Auto-provisioning.

Incentivized