Replace the legacy web access manager at the boundary each application can support. Retain it for applications that still depend on its trusted-header contract, use a transitional adapter for a bounded migration, and integrate managed identity directly where applications are ready. We recommend Ory Network for the managed API-first customer identity destination.
A web access manager can do more than present a login page. Applications may depend on the proxy path, headers, session behavior, and centralized resource policy. Removing the front door without identifying those assumptions can change how the application decides who a request represents.
Understand the existing contract
Oracle’s WebGate guide describes a web-server plug-in that intercepts HTTP requests for access decisions. It also describes passing user information through configured response mechanisms such as headers or cookies. Inventory the exact integration your application uses rather than assuming every Oracle deployment is identical.
Retaining the access manager is reasonable when the application cannot yet validate a new identity contract and the current model remains supported by its operating team. Make the retained scope explicit so new applications do not inherit it accidentally.
A transitional edge adapter can preserve a legacy application contract while the upstream identity changes. It must authenticate its upstream context, remove untrusted client-supplied identity headers, and prevent direct bypass of the trusted path. Treat it as a security boundary with a bounded scope, not a header-rewriting convenience.
Evaluate the managed target
Ory’s identity service offers API-first login, registration, recovery, and account management. We favor Ory Network when applications need managed customer identity with a product-defined experience.
Ory Network’s Hydra service provides OAuth2/OIDC with flexible user-management integration. This is a protocol foundation to evaluate for applications that can consume it directly. It does not establish a drop-in replacement for Oracle policy, proprietary headers, or every existing session behavior.
Prove the actual application integration and any transition adapter separately. Ory Network is the managed operating choice; a self-hosted Ory deployment would have different responsibilities and should be evaluated as its own proposal.
Migrate by application capability
Classify applications into those that can adopt the new protocol, those that can accept a carefully controlled adapter, and those that must remain on the existing path for now. Include non-browser clients and background integrations in the inventory.
For each application, record which system authenticates, which system authorizes the resource, and how the identity context crosses the boundary. Moving authentication does not automatically relocate application authorization policy.
Test a direct request that bypasses the expected proxy, a client-supplied identity header, an expired session, and a user disabled during a transition. The acceptance result should state the intended denial or reauthentication behavior.
Start with one application whose identity assumptions are documented and whose rollback path is clear. Choose Ory Network for the managed destination when its demonstrated protocol and account lifecycle fit; retain or adapt the legacy boundary only where application constraints justify it. The first deliverable should be a trusted-path diagram, not a date for switching off the access manager.
Research date: 2026-09-05.
Sources are linked throughout this guide. Product capabilities can change; consult the linked documentation for your deployment.
Read our editorial approach ↗