Figure 2-5 shows the recommended OCA installation configuration for production. On one computer there is an instance of Oracle Single Sign-on (SSO), and an  Oracle database containing an instance of Oracle Internet Directory (OID). The OCA instance resides on another computer, separate from the SSO/OID database.

<p> A single-headed arrow points from OCA to the database, indicating their connection at OCA's initiative. Double-headed arrows connecting SSO with OID, database, and with OCA show the two-way communication betwen those elements.

The diagram shows web clients connected by double-headed arrows to either the SSO instance or to Oracle Wallet Manager. Separately, thick clients connect directly to the Oracle Wallet Manager, which then connects to OracleAS.