- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
OpenText NetIQ Access Manager
Half your web apps speak SAML and half never will. Your users shouldn’t need a password for each — NetIQ Access Manager signs users in once across SAML, OpenID Connect and WS-Federation apps, puts a reverse-proxy gateway in front of the apps that cannot federate, and runs on servers you choose — in India if you need it.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The OpenText platform family
This page covers OpenText NetIQ Access Manager — single sign-on and the Access Gateway, with Advanced Authentication and Identity Foundation as context. The rest:
Quick facts
30-second orientation- Product
- Self-hosted SSO, federation and reverse-proxy access gateway for web apps
- Maker
- Open Text Corporation, Waterloo, Canada; NASDAQ and TSX: OTEX; CEO Ayman Antoun since April 2026
- Lineage
- Sold as Micro Focus Access Manager until OpenText bought Micro Focus in January 2023
- Release
- Version 5.1 (CE 24.2) brought a new Angular console and REST APIs; 5.1.3 fixes June 2026 CVEs
- Standards
- SAML, OAuth, OpenID Connect, WS-Federation and WS-Trust
- Deploy
- Docker containers with Helm charts for Kubernetes, a soft-appliance ISO, or single-tenant private cloud
- MFA
- NetIQ Advanced Authentication, a separate licence with 30+ methods including FIDO2
- Price
- Not published; quoted by OpenText or its partners
- India
- Self-hosted, so identity data stays in your own Indian data centre
- In India via
- TechBag — app inventory, quote in INR with GST, gateway pilot
Understand access management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is web access management?
One identity server signs users in once and vouches for them to every app, while a gateway covers apps that cannot federate.
A login per app vs one access manager — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A login per app, resets by ticket | OpenText NetIQ Access Manager |
|---|---|---|
| Passwords per user | One per app, reset by the help desk | One sign-in across federated and proxied apps |
| Apps with no SAML | Left out of SSO, own login forms | Fronted by the Access Gateway reverse proxy |
| Risk checks | A password at the door, then nothing | Nine rule types re-scored through the session |
| Where identity data lives | Scattered across each app’s database | On the cluster you run, in your own DC |
| Leaver access | Hunt down every app account | Disable once and federated access ends |
| What it is NOT | — | A SaaS IdP, an MFA product, or a published price |
The cheapest test is one legacy web app behind the Access Gateway: if it joins single sign-on unchanged, the rest of the business case follows.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Identity Server
The identity provider: it authenticates users against your directory and issues SAML, OAuth, OpenID Connect or WS-Federation tokens to each connected app.
Access Gateway
A reverse proxy in front of web apps that have no federation or security model of their own, injecting identity so they join single sign-on unchanged.
Console
Rebuilt on Angular in 5.1 with iManager removed; REST APIs and a Swagger test page let you script Identity Server configuration, and changes are audited.
Risk and MFA
A built-in engine scores each request in context, not only at login; step-up factors come from Advanced Authentication, a separately licensed product.
An identity server for the apps that federate — a reverse-proxy gateway for the ones that never will, all on servers you run.
Nine capabilities. Federate, adapt, gate.
NetIQ Access Manager gives every web app one sign-in, whether the app federates or sits behind the gateway.
Five standards, one server
SAML, OAuth, OpenID Connect, WS-Federation and WS-Trust from one Identity Server, so old and new apps share a login.
SharePoint and M365 built in
Out-of-the-box integrations sign users into Microsoft SharePoint and Microsoft 365 Enterprise through the same policies.
Right-sized tokens for APIs
OAuth token exchange swaps a broad user token for a narrower one before a call reaches a downstream service or API.
Scores the whole session
Nine rule types score each request by user and context throughout the session, not just at the moment of sign-in.
30+ factors when risk rises
Paired with Advanced Authentication, a risky request can demand FIDO2, OATH tokens, biometrics or a smartwatch approval.
Password encrypted in browser
The SecureCredentialsAuthClass added in 5.1 uses the Web Crypto API to encrypt the password before it reaches the server.
SSO for apps that never had it
A reverse proxy protects web apps with no security model, and OpenText claims 100% SSO coverage with plug-in or desktop agent.
Legacy web apps on a phone
Published APIs let developers build a mobile gateway for one-touch access to legacy web apps, which OpenText says takes hours.
A portal in your own brand
Administrators design and brand the sign-in and app-launch portal without writing front-end code for each change.
Watch NetIQ Access Manager in action
Token exchange in Access Manager, then the separately licensed Advanced Authentication on a smartwatch, for remote access and over RADIUS.
Token Exchange for Right Sized Access | NetIQ Access Manager
How Access Manager narrows a token before it is passed on to an API.
Two-factor authentication on Apple Watch with OpenText Advanced Authentication
The separately licensed MFA layer approving a sign-in from a watch.
Secure Remote Access | NetIQ Advanced Authentication
Advanced Authentication guarding remote access; recorded before the 2025 renaming.
MFA solution -- RADIUS integration | NetIQ Advanced Authentication
Adding MFA to RADIUS-based VPN and network sign-ins, from 2023.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Every app keeps its own login until something sits in front of it. Access Manager federates the apps that can and gates the ones that can’t.
Here’s what genuinely sets it apart — and exactly where it stops.
Single sign-on that stays on your servers
Access Manager is installed, not rented. It runs as Docker containers with Helm charts for Kubernetes, as a soft-appliance ISO on SLES or RHEL, or in a single-tenant private cloud. Tokens, sessions and audit trails sit wherever you put the cluster, which settles the residency question before a lawyer has to ask it.
Old web apps join the login without rewrites
Most estates have apps that will never speak SAML. The Access Gateway sits in front of them as a reverse proxy and supplies identity for them, and a browser plug-in or desktop agent covers the rest; OpenText claims 100% SSO coverage that way. Cloud-only identity providers usually reserve that job for a premium tier.
Risk is checked during the session, not once
The built-in risk engine has nine rule types and keeps scoring the user’s requests in context after sign-in. When a score rises, Advanced Authentication can step the user up to one of 30+ methods, FIDO2 and OATH among them. WS-Federation and WS-Trust support keeps older Microsoft-style apps in scope as well.
Where it stops
There is no public price and no self-serve trial, and real MFA means buying Advanced Authentication too. You run, patch and scale it: NVD lists June 2026 flaws fixed only in 5.1.3, and CVE-2021-22506 in pre-5.0 builds is on CISA’s KEV list. The 5.1 Analytics Dashboard is deprecated, and no analyst ranking is cited.
The numbers behind the platform
What your NetIQ Access Manager rollout looks like
Inventory every login
List each web app, how it signs users in today — SAML, OIDC, WS-Fed or a form — and which ones can never federate.
Choose where it runs
Pick Kubernetes with Helm charts, the soft appliance or private cloud, in your Indian DC, and size the cluster for peak sign-ins.
Federate the first apps
Connect the directory, then bring Microsoft 365 and two SAML apps under one login before touching anything legacy.
Put a legacy app behind the gateway
Front one non-federating app with the Access Gateway, test header injection, and write risk rules that trigger step-up MFA.
Roll out and patch on a cycle
Move the remaining apps in waves, upgrade to 5.1.3 or later, and set a routine for applying OpenText security fixes.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our core banking portal had no SAML at all. The Access Gateway put it behind the same login as M365 without a code change.”
“We have to keep identity data on our own racks, so a product we install ourselves was the only option that passed review.”
“Running it on Kubernetes with the Helm charts beat the old appliance builds, but plan for proper staging before upgrades.”
“WS-Federation support kept two ageing .NET apps in SSO that our cloud IdP shortlist would have left out entirely.”
“The REST APIs in 5.1 let us script config across environments. The older console was much slower to work in.”
“Strong product, but MFA is a second licence and the quote took weeks. Budget for Advanced Authentication from day one.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the access management market — tap any vendor to see why it sits where it does.
TechBag Access Management Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; self-hosted, with MFA licensed separately.
Self-Hosting × App Coverage
The grid nobody publishes — how much of the stack you can run yourself, India included, vs how many kinds of app it can bring into single sign-on.
Self-hosted; five federation standards plus a reverse-proxy gateway.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
NetIQ Access Manager vs the SSO and MFA field
Against Okta Single Sign-On, Cisco Duo, miniOrange SSO, Fortinet FortiAuthenticator and ManageEngine AD360 — on deployment, legacy apps, MFA, price, limits and India.
| Dimension | OpenText NetIQ Access Manager | Okta Single Sign-On | Cisco Duo | miniOrange SSO | Fortinet FortiAuthenticator | ManageEngine AD360 |
|---|---|---|---|---|---|---|
| What it is | Self-run SSO + gateway | Cloud identity provider | MFA first, SSO added | Cloud or on-prem IAM | Auth server appliance | AD-centred IAM bundle |
| Deployment | Containers or appliance | SaaS only | SaaS, gateway on-prem | Cloud or on-premise | Hardware or VM | Self-hosted install |
| Federation standards | SAML, OIDC, WS-Fed + | SAML, OIDC, SWA, SCIM | SAML and OIDC | SAML, OAuth, OIDC | SAML, RADIUS, LDAP | Via ADSelfService Plus |
| Apps without federation | Gateway, plug-in, agent | Gateway in top suite | Network Gateway, Premier | In-house apps from $3 | Network access focus | Federated apps only |
| MFA and adaptive risk | Risk engine; MFA extra | Adaptive from $14 | Risk-based from $6 | Adaptive from $3 | FortiToken and FIDO2 | MFA via ADSelfService |
| Pricing model | Quote only | Per user, five suites | Per user, four editions | Per user, three plans | Appliance + user licence | Per component unit |
| Published entry price | Not published | $6/user/month | Free up to 10 users | $2/user/month | Not published | Store calculator |
| Included vs add-on | MFA licensed apart | Gateway in Enterprise | Remote access, Premier | Legacy apps, Enterprise | Tokens bought apart | Pick components |
| Scale and limits | No ceiling published | 7,000+ integrations | Free tier caps at 10 | 5,000+ integrations | 1,500 or 8,000 base | Sized by domain/users |
| Directories and integrations | M365, SharePoint, APIs | Universal Directory | Duo Directory or any IdP | AD, LDAP, SCIM | AD/LDAP, Fabric | AD, M365, Exchange |
| India data location | Your own data centre | India tenants, 2026 | Mumbai data centre | On-prem, Pune vendor | Your appliance | Your own server |
| Support and trial | No self-serve trial | 30-day free trial | 30-day trial | 30-day trial, all plans | Trial via Fortinet | Downloadable trial |
| Lock-in and exit | Standards out, rules in | Okta-run tenant | Sits beside your IdP | Same plans, two forms | Tied to Fortinet | Tied to AD |
| Best fit | Self-hosted web estates | Cloud-first, SaaS-heavy | Fast MFA over any IdP | Budget, cloud or on-prem | Fortinet network estates | AD and M365 shops |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose NetIQ Access Manager if…
- ✓Identity data and sessions must stay on your own servers, in an Indian data centre or a private cloud
- ✓You have web apps that will never speak SAML and need a reverse-proxy gateway to join single sign-on
- ✓You need WS-Federation and WS-Trust alongside SAML and OpenID Connect, with risk re-checked through the session
Compare alternatives if…
- ✓You would rather rent the IdP than patch it — Okta now offers Indian tenants and Duo runs a Mumbai data centre
- ✓You want a price before a sales call — Okta, Duo and miniOrange all publish per-user rates
- ✓Your apps are mostly SaaS and already federate — a hosted IdP needs no gateway of your own
Do not expect…
- ✓A published price, a self-serve trial, or MFA without a second licence for Advanced Authentication
- ✓A hosted SaaS edition of Access Manager itself — Identity Foundation is the separate cloud product
- ✓A current analyst ranking — OpenText cites none for Access Manager
OpenText NetIQ Access Manager is one of 26 iam, sso & mfa products TechBag carries. The IAM, SSO & MFA guide narrows them to a shortlist and shows the reasoning. →
What do separate logins cost you?
Drag the sliders (employees who sign in; employee-hour cost). Estimates model time lost to separate logins, lockouts and password resets at an assumed 1.5 hours per employee a year, with 70% of it removed by single sign-on across federated and gateway-fronted apps. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Not published: OpenText prints no price for Access Manager, Advanced Authentication or the SaaS Identity Foundation, and there is no INR rate card. Budget for two licences if you need MFA beyond the risk engine, plus the servers and people to run the cluster. TechBag gets both quoted together, then converts to INR with GST.
Access Manager
Best for self-hosted SSO and legacy web apps
- Quote only; no public list price
- Identity Server, Access Gateway, risk engine
- Runs on Kubernetes, appliance or private cloud
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Advanced Authentication
Best when risk rules must step up to MFA
- Quote only; licensed separately
- 30+ methods including FIDO2 and OATH
- Cloud service or on-premises
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which apps federate over SAML, OIDC or WS-Fed, and which need the Access Gateway or a desktop agent instead?
Will it run on Kubernetes with Helm charts, as the soft-appliance ISO, or in a single-tenant private cloud?
Which Indian data centre holds the cluster, and where do logs and audit trails get shipped after that?
Is Advanced Authentication in the same quote, and which of its 30+ methods will users actually enrol?
Which of the nine risk-rule types will you use, and what score should trigger a step-up or a block?
Are you on 5.1.3 or later, past CVE-2026-11877, and who applies OpenText fixes and on what schedule?
Would OpenText’s SaaS sibling, Identity Foundation, suit some users, given no India region was found for it?
Does the quote state the licence metric, support level and term? Ask for INR with GST and the renewal uplift.
Questions buyers ask
Ready to evaluate NetIQ Access Manager?
Map which of your apps federate and which need the gateway first, or let a TechBag advisor scope a pilot that puts one legacy app behind single sign-on.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.