Open-source alternative to MIM BHOLD attestation

Open-source alternative to MIM BHOLD attestation: the short answer

If your organization runs role attestation through BHOLD, the module is no longer recommended and its Silverlight components must come out of the environment, so reviews need a new on-premises home. midPoint access certification is the open-source option that covers role attestation. It is not a one-to-one swap, so confirm the gaps for your review types before you commit.

In midPoint, a review runs as a campaign built from a reusable definition. The definition sets the scope, the stages, the reviewer rules, the remediation and whether the campaign reiterates. Reviewers can accept, revoke, reduce or delegate each case. Remediation can be automated or report-only, which lets you start with reporting and move to enforcement once the review results are trusted. Unresolved cases can pass through several stages to new reviewers, timed actions can escalate or reassign work items, a closed campaign can be rerun for unresolved cases, and ad-hoc campaigns can be started from policy rules. Map each BHOLD attestation type to one of these campaign patterns and test it against a non-production copy of your role data.

Do not treat Apache Syncope or a manual review workflow as a substitute for attestation unless you have confirmed it. Syncope is a provisioning and identity management project, and a spreadsheet or ticket-based sign-off does not produce the scoped, recorded decisions and remediation trail that attestation provides. Ask Evolveum or your implementation partner to confirm which BHOLD review types, reviewer delegation rules and evidence exports midPoint covers in your version, and read the midPoint access certification documentation before scoping the work.

Which BHOLD attestation capabilities map to midPoint

This table maps the main BHOLD attestation functions to midPoint access certification features and flags what the public facts do not confirm. Use the coverage column to decide which items to test in a proof of concept before moving reviews off BHOLD.

BHOLD function	midPoint equivalent	Coverage notes
Role attestation campaigns	Certification campaigns built from a reusable definition with scope and stages	Confirmed. Confirm that your role set can be expressed as the campaign scope you need.
Reviewer assignment	Reviewer rules per stage, with stages passing unresolved cases to new reviewers	Confirmed in general. Confirm how BHOLD reviewer assignments map to midPoint reviewer rules.
Approve or revoke decisions	Reviewers can accept, revoke, reduce or delegate a case	Confirmed. Confirm that the decision options match the outcomes your auditors expect.
Delegation	Delegation is available to reviewers	Delegation rules matching existing BHOLD policies are not confirmed. Test them in a proof of concept.
Reminders and escalation	Timed actions escalate or reassign work items	Confirmed in general. Confirm notification content and timing against your current BHOLD reminders.
Remediation	Automated or report-only remediation of revoked access	Confirmed. Confirm that remediation reaches each connected target system you use.
Recurring and ad-hoc reviews	Rerun a closed campaign for unresolved cases and start ad-hoc campaigns from policy rules	Confirmed. Confirm how existing BHOLD review cycles translate into campaign schedules.
Review evidence and reports	Campaign results and audit records in midPoint	BHOLD-specific report layouts are not confirmed. Compare sample reports with your assessor before cutover.
Review user interface	midPoint's own web interface for reviewers	Review UI parity with BHOLD is not confirmed. Have reviewers walk through real review tasks in a proof of concept.

How BHOLD role attestation maps to midPoint certification campaigns

A BHOLD attestation cycle translates most cleanly into a reusable midPoint certification campaign definition. In midPoint, the definition is the durable object: it sets the scope of what is reviewed, the stages of review, the reviewer rules, the remediation applied to decisions, and the reiteration behavior. Each run of the campaign is then a campaign instance built from that definition, so the quarterly or annual cycle you ran in BHOLD becomes a definition you rerun and tune rather than a set of reviews you rebuild by hand. Review the definition with your audit team before the first run, because scope and reviewer rules are the settings auditors will ask you to explain. Confirm the exact campaign settings against the midPoint access certification documentation for your release, since the screens and option names change between versions.

Reviewers in midPoint can accept, revoke, reduce or delegate each case. Accept keeps the assignment, revoke removes it, reduce narrows what the reviewer has granted, and delegate hands the decision to another person. Where BHOLD routed unresolved items to an escalation path, midPoint uses multiple stages: cases still open at the end of one stage pass to new reviewers defined for the next. Timed actions handle the timing side, so overdue work items can be escalated or reassigned automatically. Closed campaigns can be rerun for cases that remain unresolved, which covers the common audit finding of reviews that were never completed. Decide, per campaign, whether remediation is automated or report-only. Report-only is the safer first run while reviewers learn the tool.

The reviewed object in a role-based campaign is the role itself, so the quality of the reviews depends on the role model. If roles overlap, carry unclear names, or grant assignments through inconsistent rules, reviewers will be asked to approve entitlements they cannot interpret. Before you trust the campaigns, inventory existing BHOLD roles and their members, remove duplicates, and document what each role grants. This cleanup is design effort the reader must plan for: it involves role owners, the business and security teams who define reviewer rules, and a test cycle on a non-production midPoint instance. Ask your implementation partner or Evolveum for a scoped estimate of this work, because the size depends on how many roles and connected systems you have, not on the product.

Which open-source options fit a BHOLD replacement

BHOLD attestation covered reviews of who holds which role and whether that access still makes sense. The options below range from a full midPoint certification build to interim steps and ticket-based reviews, and each depends on how much of your access model already lives in a provisioning platform.

midPoint certification on midPoint roles

This is the primary path: model the BHOLD role catalog as midPoint roles, then run access certification campaigns against those roles and their members. Campaign definitions set scope, stages, reviewer rules and remediation, and reviewers can accept, revoke, reduce or delegate a case. Check that your BHOLD role assignments can be expressed as midPoint roles or assignments, and confirm which reviewer hierarchy your managers and owners will use before you build the first campaign.

midPoint with the Entra ID connector

Use the Microsoft Entra ID (Graph API) connector in midPoint when reviewed access spans cloud-linked accounts and on-premises roles. This lets one campaign cover entitlements that originate in Entra ID alongside those in Active Directory or LDAP. Confirm which Entra ID objects and group types the connector reads and writes in your tenant, and test how revoke decisions propagate back to the cloud side before you rely on them for audit evidence.

Report-only remediation as an interim step

Run campaigns with remediation set to report-only so reviewers make decisions and midPoint records them without changing target systems. This gives you a working review process and evidence trail during the transition, while the team validates role mappings. Confirm with your auditors whether a report-only period is acceptable for the controls you must evidence, and plan the switch to automated remediation as a separate, dated change.

Apache Syncope for provisioning-led shops

Apache Syncope fits organizations whose main need is provisioning and self-service, with attestation as a secondary requirement. Under the Apache License 2.0 it has no per-user fee, but it is not a certification engine comparable to midPoint's campaigns. Before choosing it, confirm in writing that the review workflows, reviewer assignments and evidence you need are covered, and list any that you would have to build yourself.

Ticketing workflow during transition

Where BHOLD reviews cannot move yet, keep them in an existing ticketing or workflow tool with a fixed template, named reviewers and a stored decision record. This is a stopgap, not a control replacement: it depends on people following the process and on manual change tracking. Confirm that the tool keeps timestamps, approver identity and the revocation request, and set an end date for retiring the manual path.

Running midPoint certification beside the rest of MIM

Most MIM shops will not switch off provisioning on day one, so midPoint certification has to sit beside the Synchronization Service, Portal and any Entra ID flows that already run. Each card below is a decision that shapes how the two systems share directory state and role data, and each needs testing in your own environment before any production change.

Keep MIM sync for provisioning

Leaving the MIM Synchronization Service in charge of existing provisioning means midPoint reviews reflect what MIM last wrote, not what midPoint itself controls. Certification only removes access that midPoint can revoke, so any revocation decision must be pushed back through a path MIM still honors. Confirm which connected systems MIM writes to, which ones midPoint will read only, and who owns a revoke that MIM would re-grant on its next run. Test this with a non-production object before relying on it.

Read MIM output through LDAP and AD

midPoint's Active Directory and LDAP connectors can read the same directory objects that MIM writes, which lets reviewers see the current entitlement state without a second copy of the data. The trade-off is that read-only connections still need service account rights, paging and attribute mapping that match MIM's own attribute flows. Confirm the search base, the attributes MIM populates, and whether any group membership is written through nested or dynamic rules that a plain read would miss. Verify the imported state against a sample of accounts before using it for reviews.

Decide if Entra ID connector is needed

The ConnId Microsoft Entra ID connector is only worth adding if hybrid accounts or cloud-assigned licenses must appear in the same review as on-premises groups. Adding it introduces a second authoritative source, cloud permissions and a separate credential to protect. Confirm which accounts are synchronized to Entra ID, which groups are cloud-only, and whether those reviews can stay in a separate campaign. If the cloud side is not in scope, leave the connector out and document the gap for auditors.

Account for Portal and SharePoint

BHOLD users may have approved or changed role assignments through the MIM Portal or the SharePoint-hosted pages that supported it. Those changes can live outside the metaverse, so a midPoint review built only from directory data may miss pending requests or delegated decisions. Inventory which Portal workflows and SharePoint lists were used for attestation, export their history, and confirm where each approval was recorded. Treat any approval that exists only in those systems as evidence to be carried into the new campaign records.

Keep one source of role membership

During parallel running, role membership must come from exactly one place for each entitlement, or reviewers and provisioning will disagree. A common approach is to let MIM stay authoritative for provisioning while midPoint only records certification decisions and reads membership. Confirm which system writes each role, how drift is detected, and how a decision in midPoint reaches MIM or the target system. Write this ownership map down before the first campaign runs, and check it again at each cutover step.

How to move BHOLD attestation into midPoint in phases

This sequence moves BHOLD role attestation into midPoint certification campaigns without a cutover gap, keeping the evidence from the old process until the new one has been tested and proven with reviewers. Each phase produces a record that a compliance team or auditor can check.

Inventory BHOLD attestation policies and owners
Export the list of BHOLD attestation policies, the role and resource scope each one covers, the named owners and reviewers, and the reports produced for each review cycle. Ask the business owner of each policy to confirm the scope and reviewer assignments in writing. The step is done when every policy has a documented owner, reviewer group, scope and report, and any policy without an owner is flagged for a decision.
Export and retain BHOLD evidence before removal
Before anything is uninstalled, export completed attestation decisions, reviewer comments, approval records and the reports from prior cycles, and store them in your records system with retention labels that match your policy. Confirm with your compliance lead and records team which artifacts must be kept and for how long. The step is done when the exports are verified as readable and the retention owner has signed off. Only then should the Silverlight modules be removed.
Clean and map roles and members into midPoint
Review the role definitions and membership lists that BHOLD attestation relied on, remove stale or duplicate roles, and map each role to a midPoint role or organizational construct with its assigned members. Load the cleaned data into a midPoint test instance on a Linux host or Docker, with PostgreSQL on a separate database server. The step is done when role membership counts in midPoint match the cleaned source data for a sample of roles reviewed by the role owners.
Build and simulate campaign definitions
Create reusable access certification definitions in midPoint that set scope, stages, reviewer rules and remediation for each policy from step one. Run them against a copy of production data using simulations so you can see which cases would be generated, who would review them and what remediation would run, before anything is live. The step is done when the simulated case lists have been reviewed by the policy owners and the differences from the BHOLD scope are explained.
Run a pilot campaign alongside the existing process
Choose a small reviewer group and one low-risk policy, run a midPoint campaign for it, and keep the existing attestation process running in parallel for the same cycle. Compare decisions, timings and exceptions between the two. The step is done when the pilot reviewers confirm the workflow works for them and the differences between the two results have been investigated and either fixed or accepted by the policy owner.
Switch production cycles and keep the evidence trail
Move each policy to midPoint campaigns in the next review cycle, retire the BHOLD process for that policy, and keep midPoint's campaign records, reviewer decisions and remediation logs as the system of record. Confirm with your auditor or compliance team which evidence they will request and how midPoint exports satisfy it. The step is done when every in-scope policy has completed a cycle in midPoint and the evidence export has been accepted by the compliance owner.

What changes for air-gapped, EU-controlled and hybrid estates

On an isolated network, midPoint has to arrive with everything it needs. The team must stage the server distribution or container images, a Java runtime that matches the release line (Java 21 for 4.10 and older, Java 25 for 4.11 and later), PostgreSQL, and every ConnId connector used by the target systems. Nothing is fetched on demand, so each artifact is mirrored into an internal repository and admitted through the enclave's change process. Certification campaigns run inside midPoint, so reviews keep working once external connections are closed.

Artifact staging: Mirror the midPoint package or images, the Java runtime, PostgreSQL packages and connector archives, and record checksums for each one.
Local patching: Build a repeatable offline procedure for point releases. Confirm with Evolveum which release line you run and its support end date, such as 4.8 long-term support until 17 October 2028.
Connector coverage: Check each target system against the connector list. Community or experimental connectors need a code review and a test plan before they enter a restricted network.
Documentation copies: Keep local copies of the reference pages that operators and reviewers use for campaign design and provisioning, so they do not depend on public websites.

The trade-off is a slower patch cycle and ownership of vulnerability tracking. Ask Evolveum whether its support subscriptions cover offline installation help, and rehearse the full staged bundle in a lab enclave before go-live.

What buyers ask before replacing BHOLD attestation

What does it cost to replace BHOLD attestation with midPoint?

The midPoint software carries no license fee, so the cost sits in people, infrastructure and optional support. The main components are the team that designs roles and campaigns, PostgreSQL and its backup and monitoring, Linux hosts or virtual machines for midPoint in production and non-production, connector work for each reviewed system, and the time spent training reviewers. Design and build effort is largely one-time, while hosting, database operations, patching and any support subscription recur. Evolveum offers Product Support and Platform Subscriptions, and its support page lists no prices, so ask Evolveum for current terms. Costs go up with the number of connected systems, the number of roles, and the number of non-standard review rules. Ask any implementation partner for a fixed-scope quote that separates each of these components.

How long does a move from BHOLD attestation to midPoint take?

The timeline depends mostly on the state of your role model, the number of systems under review and how much reviewer training is needed. Organizations with clean, well-named roles and a short list of connected systems move faster than those that must first untangle role sprawl and manual exceptions. Each reviewed system needs its own connector configuration, mapping and test runs before its entitlements can feed a campaign. Reviewer training and a parallel run, where BHOLD and midPoint campaigns both produce results for one cycle, add time that is easy to underestimate. Ask your implementer for a timeline tied to these drivers and to a named milestone for the first full campaign, rather than accepting a generic duration.

Can our internal team replace BHOLD attestation without a partner?

A capable internal team can do it, provided it has people with the right skills and enough time alongside its existing duties. The work needs Java and Linux administration for midPoint, PostgreSQL administration, directory and target system knowledge for connectors, and an understanding of role-based access control and certification design. Reviewer-facing work also needs someone who can explain campaign stages, reassignment and remediation to business owners. Many teams bring in outside help for the initial design, the first campaigns and a documented runbook, then run the platform internally. Assess honestly whether your team has these skills today, and whether it can keep the platform patched after the first campaign closes.

Does midPoint cover every report and attestation view BHOLD provided?

Not automatically, and you should confirm this against your own list of BHOLD reports before committing. midPoint access certification covers the core review pattern: scoped campaigns, reviewer decisions to accept, revoke, reduce or delegate, staged escalation, reruns for unresolved cases and ad-hoc campaigns from policy rules. Reports that depend on BHOLD's own data model or on Silverlight-era views may need to be rebuilt as midPoint reports, queries or exports, and that work should be scoped explicitly. Inventory every report your auditors or managers read today and map each one to a campaign, a report or a documented gap.

What should we ask for in a quote for this migration?

Ask for a written scope that lists the systems in each campaign, the roles and policies in scope, and the reviewer groups and stages you expect. Request named deliverables, such as the campaign definitions, connector configurations, reviewer guidance, and the runbook for operating campaigns after handover. Ask what evidence is retained for each campaign cycle, including decision history, reviewer identity and remediation records, and confirm where it is stored. Require documented rerun tests for unresolved cases and a test of revocation or remediation against a non-production system. Finally, ask which support route applies after go-live, whether that is an Evolveum subscription, a retainer with the implementer, or internal ownership, and what each one covers. DeployOpen works from a written scope agreed before work starts, and quotes follow from that scope.

Is Microsoft Entra ID access reviews a simpler alternative to BHOLD?

It can be simpler when your access sits in Microsoft cloud services and your reviewers already work in that ecosystem. Entra ID access reviews run as a managed service, so there is no database or application server for you to operate. The trade-off is that the reviewed scope, the connected sources and the data residency model are set by Microsoft's service, which may not fit an on-premises, air-gapped or EU-controlled requirement. Check which of your target systems Entra ID governance covers, how it handles on-premises sources, and whether its licensing matches your user count. If your reviews must stay self-hosted, midPoint remains the open-source route.

What are the main engineering risks in replacing BHOLD attestation?

The main risks are incomplete role definitions, connector gaps and reviewers who approve without context. If roles do not reflect real entitlements, campaigns will produce noisy results that reviewers learn to rubber-stamp. Connectors for less common systems may be community or experimental in the ConnId catalog, so confirm their status and test them against your target version before relying on them. Campaign timing, escalation and remediation settings can also remove access unexpectedly if they are set to automated remediation without a test period. Run parallel campaigns, test revocation in a non-production environment, and review the first results with the control owners before enabling automatic actions.

Where should midPoint run to meet our data residency needs?

midPoint can run on Linux in a virtual machine or from Docker images, so it can be deployed in your own data centers, private cloud or air-gapped network. Its repository is PostgreSQL, ideally on a separate database server, and multi-node deployments need a sticky HTTP load balancer, a shared central database and HTTPS between nodes. Your residency requirement determines where the database, backups, certification records and logs are kept, so define those locations in the design. Confirm the exact supported Java and PostgreSQL versions for the midPoint release you choose with Evolveum's system requirements before procurement.

How DeployOpen scopes and delivers a BHOLD attestation replacement

DeployOpen plans and implements self-hosted open-source identity governance inside your own infrastructure, including the move of BHOLD role attestation to midPoint roles and certification campaigns. Each engagement starts from a written scope that names the roles, reviewers, systems and evidence in play before any work begins.

How we scope

Inventory every BHOLD attestation workflow, reviewer group and role set currently in use
Agree in writing which systems, connected sources and campaign types the midPoint scope covers
Define reviewer rules, escalation timing and remediation mode for each campaign before build starts
Confirm with your security and compliance leads which review evidence must be retained and where

How we build

Model attested roles as midPoint roles and build reusable certification definitions for each review type
Configure multi-stage campaigns with delegation, reassignment and timed escalation actions
Test accept, revoke, reduce and delegate outcomes against a non-production copy of your role data
Run remediation in report-only mode first, then enable automated remediation once results are verified

How we hand over

Document campaign definitions, reviewer rules, connector configuration and the deployment architecture
Provide runbooks for launching, closing and rerunning campaigns, and for removing the BHOLD Silverlight modules
Deliver evidence packs that show how controls operate, for your internal reviewers or an independent auditor
Train campaign administrators and reviewers on the midPoint interface during handover

How we support

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts
Ongoing support, upgrades and continuous testing are available as a retainer after handover
Confirm with your team which midPoint release line and Java version your environment will standardize on
Ask for a quote based on the written scope, since DeployOpen does not publish a price list

Open-source alternative to MIM BHOLD attestation