Open-source identity governance compared

Neither is better in general, so the choice depends on your provisioning model and target systems. midPoint is an identity governance and administration platform built on the ConnId connector framework, with documented connectors for LDAP, Active Directory, Microsoft Entra ID, SCIM2 and CSV. Syncope also synchronizes identity data across systems through ConnId, with connectors including Active Directory, SOAP, CSV and PowerShell, and it adds an Admin UI with delegated administration and an end-user UI for self-service. Connector coverage for your specific applications usually decides the outcome more than the feature list. Ask both projects or vendors to show a working connector for each system you must integrate, and run a reconciliation test against a copy of your directory before you commit.

Keycloak is not required, but most deployments still need an access management layer for sign-in. Evolveum states that midPoint is an identity management system, not an access management or SSO server, and it does not implement the server side of OAuth2, OpenID Connect or SAML. Keycloak supports OpenID Connect, OAuth 2.0 and SAML 2.0 and federates users from LDAP or Active Directory, which makes it a common pairing for midPoint. Syncope includes Web Access as its own hub for authentication and single sign-on over SAML 2.0 and OpenID Connect, so Keycloak is optional there, though teams with an existing Keycloak estate often keep it. Confirm which applications need single sign-on, which protocols they use and whether an existing product already covers them.

The open-source code may be enough for a capable internal team, but paid support is a separate decision with its own recurring cost. Evolveum states that midPoint has no enterprise edition, every line of its code is open source, and the company sells subscriptions for support, training and professional services. Its Product Support subscriptions cover resolving product bugs with an 8x5 next-business-day or 24x7 SLA, and its Platform Subscriptions add feature development and roadmap influence. The subscription page lists no prices, so request a written quote. For Syncope, confirm with the Apache project community and any commercial provider what support terms exist, since none were supplied. DeployOpen supports open-source platforms on retainer, with ongoing scope agreed in writing.

No pilot duration or cost is supplied for either platform, so ask for both in writing before you plan. The main drivers are the number of authoritative sources, the number and type of target systems, the state of your identity data, and how many approval workflows, roles and access policies must be designed. Connector maturity matters too: Evolveum classifies its catalog connectors from supported to community and experimental, so check each one you need. A focused pilot usually covers one authoritative source, a small set of target systems, one reconciliation cycle and one access request workflow. DeployOpen's engagements are typically fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts, and a quote follows from that scope.

An in-house team with directory, Java and database skills can run either platform, but the work is ongoing, not a one-time install. For midPoint, Evolveum recommends Java 25 for version 4.11 and later (Java 21 is supported), and PostgreSQL as its native repository, ideally on a separate database server. Multi-node deployments need a sticky HTTP load balancer, a shared central database, cache invalidation between nodes over HTTPS and Quartz for distributed task scheduling. Syncope supports PostgreSQL 18 or later, MariaDB 12 or later, MySQL 9 or later and Oracle Database 23 or later for internal storage. Assess whether your team can handle connector upkeep, patch cycles and on-call coverage, or whether a retainer should cover some of that work.

The identity team owns the authoritative sources, attribute mappings, account lifecycle rules and approval owners, while the database team owns the repository and its availability. Expect to provide service accounts with the permissions each connector needs, such as directory bind accounts for LDAP or Active Directory, along with test accounts in non-production systems. The identity team also decides which attributes are authoritative and how conflicts are resolved during reconciliation. The database team must provision PostgreSQL or another supported database, plus backups, patching windows and a secure network path for the platform. Ask for a written responsibility matrix in the scope, so each team knows who signs off on each deliverable.

Schedule around the published support windows, and confirm the dates on Evolveum's release page before you plan. midPoint 4.8 is the long-term support line, supported until October 17, 2028. midPoint 4.10 is a feature release supported until November 26, 2027, its current maintenance release is 4.10.5, and 4.9 support ends October 18, 2026. Midpoint 4.11 is planned for October 21, 2026, and it recommends Java 25. A common approach is to stay on 4.8 LTS for stability and plan a dated upgrade later, or to pilot 4.11 in a non-production environment first. Whichever path you choose, test every connector against the new version and include upgrade testing and rollback steps in the written scope.