Decision tree: if you will use Federation to replace OAM authentication, you must configure it after installation.