SSOGEN / Learn / Web Access Management: What It Is, Who Makes It and How Teams Replace It
SSOGEN
Web Access Management: What It Is, Who Makes It and How Teams Replace It
Web access management intercepts every request and asks a policy server. The products, the agent and proxy designs, and an order to migrate.
Web access management is the older name for putting one access decision in front of many web applications. A policy server holds the rules.
A small component on each web server, or a reverse proxy, intercepts every request and asks the policy server. Then it lets the request through or sends the person to sign in.
If you run one of these products or plan to replace it, this page gives you the vocabulary, the product list, the architecture options and a migration order.
It ends with how SSOGEN replaces web access management without changes to the application.
Every statement about a named product comes from the vendor’s own documentation, read on 2026-10-11 and linked where used. Documentation differs by version, so check the release you run.
What web access management does
Broadcom’s SiteMinder 12.8 documentation says a Web Agent is software that:
- Controls access. “controls access to any resource that can be identified by a URL”
- Intercepts requests. “intercepts requests for a resource to determine whether or not the resource is protected”
(Web Agents Overview, read 2026-10-11).
Those two statements hold the core pattern. The other products say the same thing in their own words:
- Interception. A component in the request path sees every request for a protected URL.
- A central decision. The component asks a policy server whether this person may have this resource.
- Single sign-on and sessions. One sign-in covers many applications, and the product tracks the session.
- Identity handed to the application. Applications that cannot use modern sign-in protocols are told who the user is, typically in a request header.
Oracle’s documentation describes its WebGate the same way.
“Oracle HTTP Server WebGate is a Web server plug-in that intercepts HTTP requests and forwards them to an existing Oracle Access Manager instance for authentication and authorization” (Oracle, WebGate for OAM 14.1.2, read 2026-10-11).
Two architectures, agent and proxy
The category splits by where interception happens.
- Agent on the web server. The Broadcom page says Web Agents reside on a web server. Oracle’s WebGate is a web server plug-in. The agent sees the request inside the server that already hosts the application.
- Reverse proxy. IBM’s documentation describes the web reverse proxy component of IBM Security Verify Access, based on WebSEAL. It provides and enforces access to the downstream servers it connects to (IBM, Verify Access documentation and documentation index, read 2026-10-11). The proxy sits in front of the application, and nothing installs on the application’s own server.
Which products form the category
Okta’s WAM migration guide names the category like this (read 2026-10-11):
“Web Access Management (WAM) solutions – CA SiteMinder, Oracle Access Manager, IBM Tivoli Access, Ping Access, ForgeRock AM, Microsoft Active Directory Federation Services (AD FS), and NetIQ/Novell Access Manager” (Okta, WAM modernization and migration guide).
That is Okta’s list, not a standard one.
Documentation we read for individual products:
- SiteMinder (Broadcom): Policy Server plus Web Agents.
- Oracle Access Manager with WebGates on Oracle HTTP Server, Apache and IIS.
- IBM Security Verify Access, built on WebSEAL: reverse proxy.
- RSA Access Manager, formerly RSA ClearTrust. Oracle’s documentation describes it as providing “identity management and access control services for web applications” (Oracle, RSA Access Manager authorization, read 2026-10-11).
We could not read a Gartner or other analyst definition of the category, so we do not quote one.
How WAM differs from an identity provider and a gateway
Identity provider. An identity provider (IdP) signs people in. It issues standard assertions or tokens, such as SAML or OpenID Connect, to applications that understand them.
WAM product. A WAM product enforces access at the request, for applications that often understand neither.
Overlap. The two overlap. Okta’s guide, above, lists AD FS in the WAM group. In practice the difference is where the check happens and what the application receives.
Gateway. A gateway is a proxy that applies an IdP’s sign-in and policy before forwarding. It moves the WAM interception job to a proxy.
| Option | Where interception happens | What the application receives | Trade-off to weigh |
|---|---|---|---|
| WAM agent plus policy server | Plug-in in the web server | A user name header set by the agent (Broadcom documents its name) | An agent to install on each protected web server |
| WAM reverse proxy | Proxy in front of the application | Whatever the proxy forwards to the back end; check the product’s documentation | One more tier in the request path, but nothing installed on the application’s server |
| IdP with SAML or OIDC in the application | The application itself | A signed assertion or token | Only for applications that can speak the protocol |
| IdP plus a web server agent | Module in the web server | Headers, as before, but the decision comes from the IdP | Same module-per-server shape, newer policy source |
| IdP plus a gateway | Proxy in front of the application | Identity headers from the proxy | Gateway to operate; works for servers that cannot host a module |
Why organizations move off it
Only reasons the sources state, credited to them.
Okta’s guide says WAM solutions “cannot cost-effectively support the IT and security requirements of today” (read 2026-10-11).
It lists the requirements it means:
- Applications and users. Diverse application types and all user categories.
- Mobile and SaaS. Mobile access and SaaS integrations.
- Multi-factor. Modern multi-factor methods.
That is a vendor describing its own market, so test it against your estate.
Microsoft treats moving applications to its own identity service as a project with four phases: discovery, classification, migration and ongoing management (Microsoft Learn, resources for migrating apps, read 2026-10-11).
Neither source says your product must be replaced. Some estates keep it.
What replaces it
Most replacements pair an identity provider with something that does the interception for applications that cannot change: an agent in the web server, or a gateway.
The table above and your application list decide which.
SSOGEN provides both halves in one product. It is a complete identity provider, in production since 2016, with two ways to enforce access at the request:
- The Web Agent is an Apache and Oracle HTTP Server module. It signs people in, then passes identity to the application as request headers and environment variables. It protects Oracle E-Business Suite, PeopleSoft and JD Edwards without changes to the application.
- The Gateway App Proxy does the same for applications that cannot host a module.
Applications that speak SAML 2.0 or OpenID Connect connect to SSOGEN directly.
SSO for legacy applications covers the four routes. The Apache SSO module comparison covers module alternatives.
Each old policy maps to SSOGEN assignments and policies in step 2 below.
Migration steps
Vendor guides name phases. Okta’s lists “Identify and classify your WAM applications”, “Migrate WAM applications” and “Uninstall the legacy WAM service” (read 2026-10-11).
Microsoft’s lists discovery, classification, migration and management. Combined into an order you can run:
- Inventory. Every agent or proxy, the application behind it, its URLs, the realms or policies that protect it, the directories used, and an owner.
- Map policies. Write down who each rule lets in, under what conditions, and what the application reads. Map them one by one. No shortcut.
- Parallel run. Register a pilot application in the new system. Use a separate hostname or a non-production copy. Keep the old path live.
- Compare what the application receives. User name first, then every header or cookie.
- Cut over one application at a time, with the old path ready to restore.
- Retire an agent or proxy only after its application has run through a full business cycle.
For one product in depth, see the SiteMinder alternative and Oracle Access Manager alternative pages, and SSOGEN compared with named products.
The header is the contract
The surprise. This one surprises migration teams. The application often depends on a header the old product set, edge cases included.
What Broadcom documents. Broadcom’s 12.8 documentation says the web agent places the user name in an HTTP header variable for all requests.
When it is missing. It also says the agent does not set it when a user does not provide a user name, such as with certificate-based authentication, or when a user name is not known (Generated User Attributes, read 2026-10-11).
So an application may already handle a missing header.
What must match. Whatever replaces the product must send the same name, in the same case. Otherwise the application breaks silently.
SSOGEN Web Agent. The SSOGEN Web Agent passes the user name unchanged, the way the application already reads it, so the application keeps working without a code change.
Questions people ask
What is a wams ID?
What is site minor web access management?
What is an access management system?
How do I change my password for IAM Wisconsin gov?
Where to go next
- Your product. Read the SiteMinder alternative or Oracle Access Manager alternative page.
- Your route. Use SSO for legacy applications to choose a route.
- SSOGEN options. The Web Agent and Gateway pages cover them.
- More to learn. The Learn hub is at /learn/.
Sources, all read 2026-10-11: Broadcom SiteMinder 12.8 TechDocs (Web Agents Overview; Generated User Attributes); Oracle HTTP Server WebGate guide 14.1.2; IBM Security Verify Access documentation; Oracle documentation for RSA Access Manager; Okta WAM modernization and migration guide; Microsoft Learn migration resources; IBM, What is access management; State of Wisconsin WAMS profile help; SSOGEN’s Web Agent and Gateway pages.
About this page. SSOGEN Corporation prepared this page from the vendors’ public documentation, last read on 2026-10-11. We took care to be accurate, but products change, and we may have misread or missed something, so some statements may be wrong or out of date.
This page is for general information only and comes without any warranty. SSOGEN is not responsible for errors, omissions or decisions made from it. Check the vendor’s own pages and test the products yourself before you decide. If you see a mistake, tell us and we will correct it.
SiteMinder, Broadcom, Oracle Access Manager, WebGate, Oracle HTTP Server, IBM Security Verify Access, WebSEAL, RSA ClearTrust, RSA Access Manager, Okta, Microsoft, Entra, AD FS, Apache, IIS and the other product names are trademarks of their respective owners.
Their owners are not affiliated with, endorsed by or sponsored by SSOGEN, and have not reviewed this page.