Oracle: IAM acquisitions and world domination?

Oracle last week continued its technology shopping spree with the acquisitions of Thor and OctetString, two startups that play in the Identity and Access Management (IAM) space. Thor is a great little company focused on user provisioning and has a very cool office in Manhattan's Silicon Alley. OctetString offers a virtual directory that kind of acts as a middleman for user and group identities between multiple systems and applications. Thor and OctetString join previous acquisition Oblix as Oracle's "three amigos" of IAM.

The obvious question here is "What the heck is Oracle thinking?" Integrating Oracle, Peoplesoft, and Seibel won't be a day at the beach so why would the company take on this same burden in a completely different technology segment?

Not to worry say the spin doctors in Redwood City. First of all, Oblix, OctetString, and Thor will actually accelerate the integration process as all of the products are already based upon standards and interoperate with various applications and system environments. These IAM products will also combine to form an identity service for user and XML message identity within SOA.

You've got to hand it to Oracle, this is a brilliant vision. Between compliance and SOA, IAM will finally become a real enterprise service over the next few years. That's said, its time to bring a little bit of reality into the big picture.

The IAM space today is dominated by point tools and tactical implementations – not exactly Oracle turf. CA, IBM, and Sun are executing well while BMC and Novell have strong product sets but no one is "killing it." Oh yeah, there's also Microsoft who owns the desktop and user directory. Oracle's been talking about the IAM space for years but has yet to really establish itself in this market.

It is also worth noting is the technology integration challenge here. Is it me, or does Oracle look like CA circa 1995 on steroids? There's not a common IAM infrastructure today in the Oracle products alone let alone across all of the company's application assets. Industry standards and existing integration efforts help but there's still all the work to build common GUIs, documentation, pricing, support, etc.

Remember too, that Oracle is running into a slew of security issues in its database code and needs to stop ignoring these issues. How will the company introduce secure coding practices and processes across Redwood City and everywhere else? Beats me. This kind of work doesn't add a thing to the top line and sucks dollars off the bottom one.

I agree with Larry's assessment that the tech industry is maturing and consolidating. While true, I don't see Cisco getting into desktop operating systems, EMC introducing a firewall, or Microsoft building server hardware any time soon. Oracle certainly has chutzpah; I just question its ability to pull all of these disparate pieces together into some kind of cohesive structure.