Oracle-Sun union means tough decisions on ID management

Oracle will have to make some significant product decisions and integration plans to address the overlap it has with Sun in terms of identity management software, according to experts.

Oracle agreed on Monday to buy Sun for $7.4 billion. After the deal closes, the real work of integrating the companies will follow, including rationalizing a laundry list of identity software.

Both Sun and Oracle for years have been acquiring identity companies, integrating software and developing products to move themselves up the ranks in such identity management areas as access management, provisioning, directories, identity administration and federation.

The two are listed among the Top 5 identity management vendors as judged by consulting firm Burton Group. IBM, CA and Novell are the other three.

“There is enormous overlap and there are going to be some tough questions there for Oracle,” says Jamie Lewis, president of the Burton Group. “Customers are going to be concerned where their future lies.”

Lewis says the most significant overlap is in terms of provisioning and access management.

In 2005, Oracle acquired Thor in part to counter Sun's 2003 acquisition of provisioning vendor Waveset. The acquisition of Thor's provisioning tools marked Oracle's first serious entry into building an identity management platform that is now part of its Fusion middleware lineup.

Oracle and Sun also butt heads in regards to access management, where Oracle acquired Oblix in 2005 and Sun is working with its in-house developed Sun Access Manager (now part of OpenSSO Enterprise, which also includes the former Sun Federation Manager).

Oracle's lineup, in fact, is heavily laden with acquisitions including Phaos in 2004 for federation and OctetString in 2005 for virtual directories. Oracle also acquired Bridgesteam in 2007 for its identity role management capabilities. The technology competes with Sun's Role Manager, which is the fruit of Sun's acquisition of Vaau in 2007.

So the question is not only how to integrate technology from Sun and Oracle not originally designed to work together, but also how to integrate the cornucopia of third-party identity technologies scattered throughout the identity portfolios of both companies.

“Figuring out what stays, what goes, and integrating the remaining pieces is going to be an enormous task that will undoubtedly create consequences for deployed customers,” says Andre Duran, CEO of Ping Identity, which develops identity federation software. “This is yet one more reason companies should consider standards-based, loosely coupled approaches, as it insulates them from the potential for single vendor lock-in, which is occurring irrespective of how they are selecting their vendors.”

To complicate matters even further, Sun has an aggressive stance on open source that Oracle does not share. Sun is de-emphasizing its Sun Directory Enterprise Edition in favor of putting resources into the OpenDS (Directory Services) platform.

“The directory decision looks like a free-for-all to me,” says Don Bowen, who left Sun a little over a year ago to help start UnboundID, whose product is based on OpenDS.

“Both companies have very bright people,” Bowen says. “But this is like a very complicated Brady Bunch marriage. It's not just they have three children of their own. These [product groups] are going to have to be competing. They can't keep it all.”

Determining what stays will likely come after a long process, given that identity management is not a major tenant of the deal. In fact, Oracle's slide deck that accompanied the announcement of the acquisition does not even include a mention of identity management.

“One of the things you have to keep in mind is that smashing together these product lines is not strategic,” says Kevin Cunningham, president and co-founder of SailPoint, which develops identity management software for compliance and access certification. “Identity is not the main focus of this deal.”

Oracle will have other integration areas to distract it, including systems management, where Oracle will improve its chances to win systems management deals from existing enterprise customers by bringing Sun's management technologies such as Ops Center and Management Center into its portfolio.

The advice some are giving to corporate users that have invested in Oracle or Sun identity technology is: Don't panic.

“A good thing is that this closes a period of uncertainty about the Sun portfolio [since the IBM offer],” says Bob Blakley, vice president and research director for the Burton Group's identity and privacy strategies practice. Blakley says as the deal closes, Oracle management likely won't address identity until the more compelling strategies, such as the database, are worked out. “So there will be a period where not much happens and it is business as usual.”

Therefore, Blakley says, users should not make any rash decisions.

“This very much reinforces a message we have been giving since HP exited the identity market,” Blakley says. “Anybody who is going into any kind of software deal right now, in particular in the identity management space, really has to pay attention to vendor viability issues.”