Oracle Identity Governance cost vs midPoint: where the savings come from
A cost review usually starts with a renewal notice, a licensing change or a data residency requirement that forces the question of what the identity governance stack really costs. midPoint has no license fee, so the comparison turns on infrastructure, migration effort and support, not on a software line item. Evolveum states that midPoint has no enterprise edition and that every line of its code is published under open source licenses, dual-licensed under EUPL-1.2 with Apache 2.0 as the secondary license. Before you compare totals, list every cost on the Oracle side, including the Oracle license and annual support, the WebLogic and SOA Suite middleware that OIG runs on, and the Oracle Database that holds its schemas. Each of those has its own renewal date and its own support terms, so pull them from your contracts and order forms rather than from memory.
On the self-hosted side, the recurring costs are the servers or cloud instances for midPoint, a PostgreSQL database (midPoint's native repository, ideally on a separate database server), the load balancer and monitoring for multi-node deployments, and staff time. An optional Evolveum subscription is a recurring line item if you choose it. Evolveum offers Product Support subscriptions with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence, and its page lists no prices, so request written quotes for each tier. The one-time items are the migration itself, connector work and the port of approval processes. Check the java and database versions you will need: midPoint 4.10 (Braille) is supported until November 26, 2027, and 4.8 (Curie) is a long-term support release supported until October 17, 2028, so pick a release whose support window matches your planned operating horizon. Ask any implementation partner for a fixed-scope quote that separates these one-time and recurring costs.
Which cost components change when you move from OIG to midPoint
This table lists each cost component in an Oracle Identity Governance estate next to its midPoint counterpart, marking whether each cost is one-time or recurring and what drives it. Oracle figures are not published here, so take them from your own contract and support renewal before comparing.
| Cost component | One-time or recurring | Cost driver and what to confirm |
|---|---|---|
| Oracle license and annual support | Recurring | Driven by the licensed metrics and options in your contract. Confirm the support renewal date, the metric basis and any audit or true-up terms with Oracle. |
| WebLogic Server | Recurring (support) and one-time (upgrades) | Tied to the Oracle middleware licensing that hosts OIG. Confirm which WebLogic licenses and support levels your OIG deployment depends on. |
| SOA Suite | Recurring (support) and one-time (rework) | Used by OIG workflows and approvals in many deployments. Confirm whether your approval logic depends on SOA composites, since porting that logic is a separate effort. |
| Oracle Database | Recurring (support) and infrastructure | Licensing depends on the database edition and processor or user metrics. Confirm the basis in your contract and the database tier OIG uses. |
| Upgrade projects and specialist staff | One-time and recurring | Oracle middleware and OIG specialists are scarce and their time drives effort. Compare the cost of any planned upgrade with the cost of a migration. |
| midPoint software | None for the software | midPoint is open source with no license fee. Costs come from people, infrastructure and any support you choose. |
| PostgreSQL | Recurring (infrastructure) | Open source with no license fee. Cost is database hosting, backups and administration, driven by identity volume and availability needs. |
| Java runtime and hosting | Recurring (infrastructure) | No runtime license is required for the open-source JDK distributions you select. Cost is the VMs or containers, load balancing and monitoring you run. |
| Optional Evolveum support subscription | Recurring | Evolveum offers Product Support and Platform Subscriptions with different SLAs. Compare tiers and prices with Evolveum on a written quote. |
| Migration project | One-time | Covers configuration analysis, connector mapping, workflow porting and parallel running. Scope it in writing with your implementation partner before work starts. |
What moves the cost comparison most
The licence line is only part of the Oracle Identity Governance bill, and the self-hosted midPoint side carries its own staffing, hosting and support decisions. The six factors below are the ones that move the comparison most, and each one should be measured in your own environment before you read any total.
User and identity counts
Oracle's licence and the size of its supporting infrastructure both scale with the number of users and identities under governance, so this count is the first input to any model. midPoint has no licence fee to scale, but a larger identity population still means more repository capacity, more reconciliation runs and a larger test set before each upgrade. Ask Oracle how its licence metric counts identities and ask your own team how many accounts exist across systems, including service and non-human accounts.
Connected systems and connector types
Every target system needs a connector, and the cost of each connector depends on whether one already exists. midPoint uses the ConnId framework, which documents connectors for LDAP, Active Directory, CSV, Microsoft Entra ID, SCIM2 and others, while less common systems may need a custom connector written and maintained by your team or a partner. List each target, its protocol and whether a supported connector exists before estimating.
Availability and multi-node requirements
A single midPoint node is simpler to run, but production often needs several nodes behind a sticky HTTP load balancer, a shared central database and task scheduling across nodes. Each extra node adds infrastructure, monitoring and patching effort, and the replacement for WebLogic clustering and SOA Suite high availability must be designed rather than assumed. Confirm your required recovery targets and whether you will run a standby site.
Support level and subscription tier
Oracle support is a recurring annual charge, and midPoint support is an optional recurring cost you choose. Evolveum's Product Support subscriptions offer an 8x5 next-business-day SLA or a 24x7 SLA for resolving product bugs, while Platform Subscriptions add feature development and roadmap influence. Ask Evolveum or a partner for the current price for each tier, and compare it against the hours your own team can cover without it.
In-house skills for Java and PostgreSQL
Running midPoint shifts effort toward Java application operations, PostgreSQL administration and connector development, while Oracle work often depends on WebLogic, SOA Suite and Oracle Database specialists. Staff who already run these stacks lower the cost of the transition, and any skills gap becomes a line item in the plan. Inventory who can operate each component today and decide whether to train, hire or contract for the gap.
Custom workflow and approval logic to port
Approval chains, custom Java plug-ins and bespoke provisioning logic in Oracle often cost more to move than the platform itself, because each one must be redesigned, tested and signed off. midPoint covers request and approval workflows, but its configuration differs from Oracle's approach, so each custom process needs an explicit mapping and test case. Export and count every workflow, script and custom handler, then rank them by business risk before you commit to a timeline.
How to build the OIG versus midPoint model with your own numbers
This sequence turns the cost components on this page into a model built from your own Oracle records, infrastructure inventory and migration quotes, so the comparison reflects your environment rather than generic figures. The output is a side-by-side total cost view you can take to finance and your architecture board.
Pull the current Oracle contract and invoices
Gather the signed license agreement, every order or amendment, and the last two to three years of annual support invoices from your procurement or finance team. Record the licensed metrics (processor or named user terms), the support percentage or fixed fee, the renewal date and any notice period for changes. Confirm the terms with Oracle or your reseller, since support fees and renewal mechanics are set in your contract and not on this page. You are done when every recurring Oracle charge tied to Oracle Identity Governance is listed with its source document.
Inventory WebLogic, SOA Suite and database components
Work with your middleware and DBA teams to list each WebLogic domain, managed server, SOA Suite component, load balancer, and the Oracle Database instances and licenses that hold OIG schemas. Note which components are licensed separately, which run on shared hosts, and which are used only by OIG. Include non-production environments, because they often carry license and hosting cost too. You are done when each component has an owner, a host and a clear yes or no on whether it can be retired with OIG.
Inventory connectors, workflows and reconciliation jobs
Using OIG's configuration and the connector list in your environment, catalog every target system, its connector type, its reconciliation schedule, each approval workflow and each certification campaign. Mark which connectors are standard and which are custom or heavily scripted, since custom work drives migration effort. Check each target against the ConnId connector documentation for midPoint to see whether a matching connector exists, is supported or is community-maintained. You are done when every target has a row showing its connector status in midPoint and an estimated effort category agreed with your team.
Estimate midPoint infrastructure on Java and PostgreSQL
With your platform team, size the midPoint deployment against the system requirements: a Java runtime of 21 or 25 (25 is recommended for version 4.11 and later, and 21 for 4.10 and older), a Linux virtual machine or Docker host for the application, and PostgreSQL on a separate database server. For multi-node setups, include the sticky HTTP load balancer and the shared database. Price the hardware, virtualization, storage, backup and monitoring in your own cloud or data center rates, not on this page. You are done when each midPoint node, the database server and the load balancer have a spec and a recurring cost line.
Decide the midPoint support tier
Choose between running midPoint without a vendor subscription, using in-house or partner staff, or buying an Evolveum Product Support subscription, which covers product bugs under an 8x5 next-business-day or 24x7 SLA. A Platform Subscription adds feature development and roadmap influence. Compare these against your risk tolerance and the lifecycle of the release line you plan to run, such as the long-term support release 4.8 or the feature release 4.10 with its published end dates. Ask Evolveum for current subscription prices, since the support page lists none. You are done when the tier is recorded with its annual cost and the release line it covers.
Cost the migration as a fixed-scope project
Request written, fixed-scope proposals from implementation partners and, if you choose, from Evolveum's consulting team, using the inventory from the earlier steps as the scope. Ask each bidder to separate design, connector build or adaptation, workflow porting, testing, parallel running, cutover, documentation and knowledge transfer, and to state deliverables and acceptance criteria. Also budget internal staff time for business owners and approvers. Treat the one-time migration cost as separate from the recurring run cost. You are done when each option has a written scope, a quote and a list of assumptions you have reviewed.
Run a parallel period and compare outcomes
Run midPoint alongside OIG against the same target systems for a period you agree in advance, comparing account states, reconciliation results, approval outcomes and audit records. Log every difference and assign it to a connector, a mapping, a workflow or a data issue. Keep the parallel period time-boxed in the project plan so the cost of running two stacks is visible in your model. You are done when the discrepancy log is closed or accepted by the business owners, and the recurring cost of both stacks during the overlap is recorded in your spreadsheet.
Build the side-by-side total cost model
Assemble one model with two columns, current OIG and midPoint, separating one-time costs (migration, testing, training, decommissioning) from recurring costs (Oracle licenses and support, WebLogic, SOA Suite and database hosting, midPoint infrastructure, subscription, staff). Add a sensitivity line for what drives each cost, such as user counts, connector count and renewal terms. Have finance and your architecture board review it, and keep the sources for every input. You are done when the model shows the break-even point your organization is willing to accept and the questions that remain open for vendors.
What the migration project costs and when it pays back
The one-time cost of moving is the project, not the software. It covers exporting the Oracle Identity Governance configuration to understand which resources, roles and approval processes are in use, mapping each target system to a ConnId connector and proving that reconciliation produces the same account state, porting approval workflows, and running OIG and midPoint side by side against the same targets until the results agree. Each of those tasks is paid for in people's time, either your own engineers, a specialist partner or Evolveum's professional services, and each is sized by the number of resources, custom workflows and certification campaigns you run today. Retiring WebLogic and SOA Suite comes last and carries its own work: decommissioning the domain, archiving audit data and closing the related database and host licenses.
Whether that project pays back depends on figures only you hold: your current Oracle license and annual support invoices, the infrastructure and database costs attributable to OIG, the staff hours spent on patching and upgrades, and the quoted cost of the migration itself. Build a simple model with those inputs and compare it with the midPoint components that recur: PostgreSQL hosting and backups, the compute for midPoint nodes, and an optional Evolveum support subscription, which the Evolveum support subscriptions page describes by SLA tier without listing prices. Ask for a written scope with named deliverables, assumptions about connector count and approval complexity, and what is excluded, so that two quotes can be compared on the same basis.
Before you compare quotes, decide how much of the current configuration you actually need to migrate, because retired roles and unused connectors often inflate the project. Check the scope against the migration topic for the steps involved, and treat it as a description of the work rather than a timeline. Ask every bidder to state what they will reuse from the existing OIG design, which parallel-run period they assume, and who signs off that reconciliation results match. A payback estimate that cannot be traced back to those written assumptions is not yet useful for a renewal decision.
How the comparison differs by starting point
Teams still on OIG 12.2.1.4 face a project decision before a renewal decision. The upgrade path to 14c requires a new middleware home, JDK 17, a schema upgrade and an irreversible domain reconfiguration, so the largest near-term costs are project labor and test effort rather than license lines. Compare that project against a migration to midPoint, which also carries its own build and cutover effort.
- Upgrade labor: Specialist time for the middleware home, schema upgrade and domain reconfiguration, usually the biggest one-time line.
- Retest scope: Every custom connector, approval process and scheduled reconciliation task must be revalidated after the upgrade.
- Dual running: Keeping an old environment available for rollback adds infrastructure and staff time for the duration of the project.
- midPoint build effort: Porting connectors, roles and workflows is a one-time project cost that does not need a WebLogic or SOA Suite refresh later.
- Support continuity: Ask Oracle which OIG release line is covered and for how long, then compare that date with the midPoint release calendar.
Confirm your current schema version, the number of custom Java plug-ins and the count of active connectors before requesting a quote from either side.
When an Oracle contract comes up for renewal, the dominant recurring line is usually the license support fee, which is set by contract rather than by any public list. The renewal decision also exposes the surrounding stack: WebLogic, SOA Suite and Oracle Database licenses and support often renew on separate schedules, so the total annual cost is easy to underestimate. Ask for every line item in writing.
- Annual support: Recurring fee that continues whether or not you change scope, so it is the first line to model against a zero license fee for midPoint.
- Adjacent Oracle products: Confirm which WebLogic, SOA Suite and Database licenses exist only to serve OIG and would end with it.
- Renewal terms: Check notice periods, price escalation clauses and whether support can be reduced to a shorter term.
- midPoint recurring cost: The optional Evolveum subscription is a separate, vendor-quoted line, and PostgreSQL and hosting costs recur in your own infrastructure.
- Exit timing: A migration takes project time, so a short renewal may still be needed to run both systems in parallel.
Ask Oracle for a written itemized renewal quote, then ask Evolveum for a support subscription quote matched to your environment before comparing totals.
Teams whose main driver is data residency or vendor lock-in often find that the cost comparison shifts toward infrastructure and staff ownership. midPoint runs on Linux virtual machines or Docker images inside your own network, with PostgreSQL as the repository, so identity data stays where your controls already apply. The cost question becomes who operates the stack and at what level of skill.
- Hosting location: Costs follow the chosen data center, cloud account or air-gapped network, and those costs are your own infrastructure spend.
- Operations staffing: Ongoing administration of Java, PostgreSQL, the load balancer and the scheduler is the main recurring labor line.
- Connector maintenance: ConnId connectors are Java code, so each supported target needs ownership for upgrades and fixes.
- Licensing exposure: Dual licensing under EUPL and Apache 2.0 removes license fees, but confirm your legal team accepts the EUPL terms for internal use.
- Exit cost: Keeping exports of configuration and data in an open format lowers the cost of any future change of platform.
Confirm with Evolveum which connectors are supported for your target systems and ask your own team to estimate operating hours before setting a budget.
Questions buyers ask before comparing OIG and midPoint costs
Does midPoint have a license fee?
No. midPoint is open source and has no license fee, and Evolveum states it has no enterprise edition: every line of midPoint code is published under open source licenses, and the project describes itself as open source, not open core. The repository is licensed under the European Union Public License (EUPL-1.2) with Apache 2.0 as a secondary license, so your cost sits in infrastructure, the migration project, and any support or staff you choose to pay for. Confirm the license terms that apply to your intended use with your legal team before you commit.
Is an Evolveum subscription required to run midPoint?
No. Evolveum offers two kinds of paid subscription, but neither is needed to run the software. Product Support subscriptions cover resolution of product bugs with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions add feature development and roadmap influence. Evolveum funds development through subscriptions, training and professional services. The support page lists no prices, so request a quote for the SLA tier you need and compare it with the support contract you pay Oracle today.
How much effort does a migration from OIG need?
The effort depends mostly on how much configuration you have, not on the product you leave. Work scales with the number of connected target systems, custom approval workflows, role definitions, reconciliation rules and custom Java or script logic in OIG. Each connector you need must be mapped to a ConnId connector, and some may be community or experimental in status, which adds build and test work. Ask any vendor for an effort estimate based on an inventory of your resources, roles, workflows and connectors, not a percentage of the license cost.
Can our own team migrate from OIG to midPoint without outside help?
It is possible for a team with strong Java, identity and directory skills, but the decision depends on your capacity and risk tolerance. midPoint is a Java application that uses PostgreSQL, runs on Linux or from Docker images, and needs a sticky HTTP load balancer and shared database in multi-node setups. Your team also has to re-create OIG workflows, certification campaigns and audit requirements in midPoint and test them against production-like data. Many organizations split the work, keeping knowledge in-house and buying specialist help for connectors, cutover and evidence.
What skills does a midPoint migration project need?
Plan for four skill areas: identity governance design (roles, access policies, certification and segregation of duties), Java and the midPoint object model, PostgreSQL administration and operations, and the directories and target systems you connect. Oracle-specific experience with WebLogic and SOA Suite helps you read the existing OIG configuration, but it does not transfer directly. Check the Java version your midPoint release needs before you hire or train, since the system requirements list different Java versions for different releases.
How long does a midPoint project take and what drives the duration?
Duration is set by scope and by how many connectors, workflows and approval paths you must port, plus how long you run OIG and midPoint in parallel against the same targets. Other drivers include data quality in your existing identity sources, the time needed for user acceptance testing, change control in your environment, and the release you target. Because midPoint 4.9 support ends on October 18, 2026, and midPoint 4.8 is a long-term support release supported until October 17, 2028, the release choice affects how often you must upgrade after go-live. Ask for a timeline built from a written scope.
What should we request in a quote for an OIG to midPoint migration?
Ask for a written scope with the resources, roles, connectors, workflows and reports included and excluded, and a deliverables list with acceptance criteria. The quote should separate one-time work (assessment, build, migration, testing, cutover, documentation) from recurring costs (infrastructure, PostgreSQL operations, Evolveum support if chosen, and ongoing maintenance or retainers). Request the timeline, staffing roles, assumptions about your environment, and how the team handles upgrades. Also ask who keeps the evidence needed for your compliance assessments, since an independent auditor or certification body issues any audit report.
How DeployOpen scopes a fixed-price midPoint implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For an Oracle Identity Governance exit, we start from a written scope that separates the one-time migration work from the recurring platform costs, so the cost comparison reflects your environment rather than a generic estimate.
How we scope
- Inventory the OIG connectors, target systems, roles, approval workflows and certification campaigns that the midPoint replacement must cover
- Agree in writing which WebLogic, SOA Suite and Oracle Database components will be retired and which must stay until cutover
- Define the midPoint subscription question early, including whether Product Support or a Platform Subscription is part of the quote
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts
How we build
- Deploy midPoint on Linux virtual machines or Docker images with PostgreSQL on a separate database server, sized to your identity volume
- Map each Oracle connector to a ConnId connector and test reconciliation against non-production copies of target systems
- Port approval processes and access request flows, then test segregation of duties rules and role mining outputs with your control owners
- Document configuration, runbooks and evidence so your compliance team can prepare for independent assessments
How we hand over
- Run parallel reconciliation with OIG and midPoint against the same targets to confirm results before any retirement step
- Deliver backup, restore and upgrade procedures for midPoint, PostgreSQL and the Java runtime in your own infrastructure
- Train your operations staff on daily administration, connector maintenance and troubleshooting before handover
- Hand over a decommissioning plan for WebLogic, SOA Suite and the Oracle Database, listing the licenses you should confirm with Oracle
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover
- Ask your quote to separate one-time migration work from recurring retainer, subscription and hosting costs
- Confirm with Evolveum which support tier and SLA fit your operating hours before you commit to a subscription
- Coordinate midPoint release upgrades against the published support dates for the LTS and feature branches you run
