The OpenAM Distributed Authentication UI can hide many OpenAM administrative capabilities from the Internet. Notice that OpenAM installed with the console is inside your infrastructure as well.