Oracle Entitlements Server

Authorization Runtime is fast

Horrible administration web UI - had to spend months with our database team to make an application's entitlements show up in < 30 seconds, difficult to navigate UI. It has sliders that make you think you can expand certain portions of the UI, but they do nothing. Many operations that must be done in day-to-day administration require 3 clicks per application, so this makes policy creation and distribution extremely time-consuming. A variety of random errors would occur and instead of friendly messages, full exceptions were shown to the user, including a stack trace. Often, this stack trace was so long, the box would overflow the screen and the user would be unable to close the popup box.

The built in Policy Decision Point's web service only supported returning a SINGLE entitlement at a time. This was completely inadequate (would have crippled our apps' performance) and somewhat laughable given this is an 'enterprise product'. We ended up having to write our own web-service which could check multiple entitlements at once using the Java API

Horrible Support - we opened at least 20 support cases and the majority were classified as bugs or product enhancements, and then nothing was done on them. I am pretty sure this product has no full-time developers, given the lack of progress seen on their product in over 2 years. A variety of issues went back and forth between the OES and Weblogic teams, both blaming each other, and never got resolved. When we tried to escalate, various Oracle manager folks claimed to be exerting pressure, but ultimately everything fell back on us (sorry, can't reproduce it on our end) and made no progress. Almost every support person we got did not speak fluent English, writing back in incomplete sentences, and confusing basic pronouns (he vs she), etc.

Lack of product documentation. It took us about a month of working with support to enable LDAPS binds for users logging into the admin UI (by default, it only worked with unsecure LDAP binds). All of such configuration was undocumented and we had to rely on support giving us explicit instructions. There was also a bevy of patches that had to be applied to 3 different components of the product in a specific order to work properly. Some patches caused regressions and broke functionality that previously had been corrected by a prior patch. They also released an entire new version (Patch Set 1 I believe) and forgot to increment the build number in the UI, causing much confusion. Any development house with basic build/release practices in place would have avoided this.

I do not have hard numbers on this, because it probably had an indirect impact on our applications.