Oracle-Sun union means tough decisions on ID management

Currently, the two companies overlap in many areas, most significantly in terms of provisioning and access management

Oracle will have to make some significant product decisions and integration plans to address the overlap it has with Sun in terms of identity management software, according to experts.

Slideshow: Hottest tech M&A deals of 2009

[ InfoWorld's Neil McAllister correctly predicted Oracle's Sun takeover. Find out why he thought the deal would make sense. | For full coverage of the Oracle-Sun deal, see InfoWorld's special report. ]

Oracle agreed on Monday to buy Sun for $7.4 billion. After the deal closes, the real work of integrating the companies will follow, including rationalizing a laundry list of identity software.

Both Sun and Oracle for years have been acquiring identity companies, integrating software and developing products to move themselves up the ranks in such identity management areas as access management, provisioning, directories, identity administration, and federation.

The two are listed among the Top 5 identity management vendors as judged by consulting firm Burton Group. IBM, CA, and Novell are the other three.

"There is enormous overlap and there are going to be some tough questions there for Oracle," says Jamie Lewis, president of the Burton Group. "Customers are going to be concerned where their future lies."

Lewis says the most significant overlap is in terms of provisioning and access management.

In 2005, Oracle acquired Thor in part to counter Sun's 2003 acquisition of provisioning vendor Waveset. The acquisition of Thor's provisioning tools marked Oracle's first serious entry into building an identity management platform that is now part of its Fusion middleware lineup.

Oracle and Sun also butt heads in regards to access management, where Oracle acquired Oblix in 2005 and Sun is working with its in-house developed Sun Access Manager (now part of OpenSSO Enterprise, which also includes the former Sun Federation Manager).

Oracle's lineup, in fact, is heavily laden with acquisitions including Phaos in 2004 for federation and OctetString in 2005 for virtual directories. Oracle also acquired Bridgesteam in 2007 for its identity role management capabilities. The technology competes with Sun's Role Manager, which is the fruit of Sun's acquisition of Vaau in 2007.

So the question is not only how to integrate technology from Sun and Oracle not originally designed to work together, but also how to integrate the cornucopia of third-party identity technologies scattered throughout the identity portfolios of both companies.