Which open-source IT asset management software fits your team
Pick Snipe-IT if your core question is who holds which laptop, license or accessory, and you have no service desk or CMDB requirement. Pick GLPI if asset records must sit alongside ITIL tickets, problems and changes in one suite. Pick iTop if configuration modeling, impact analysis and change control matter more than inventory breadth. GLPI is distributed under GPL-3.0-or-later, and Snipe-IT and iTop are both under AGPL-3.0, all OSI-approved licenses, so the license alone will not separate them. Paid tiers are optional in each case. Snipe-IT's self-hosted software is free, and its hosted plans start at $399.99 per year and add email support, automated upgrades and server maintenance, per its pricing page. Budget for the server, the database and the staff who run them either way.
Each option's advantage depends on a different condition. GLPI helps most when tickets and assets must share one record, since it covers ITIL tickets, problems and changes alongside asset management, and native inventory comes from the GLPI Agent since version 10. Network discovery and SNMP inventory need the separate GLPI Inventory plugin, so confirm that plugin fits your scope before you commit. iTop helps most when you need a CMDB with graphical impact analysis and customizable SLAs. Its free Community edition covers up to 10 agents, Atelier covers up to 50 and Forge covers more than 50, so agent count drives the paid tier. iTop runs on premises or as SaaS. Review the GLPI assets documentation to see how assets are modeled before you map your fleet.
Snipe-IT fits when the job is asset custody: checking out laptops, licenses, accessories and consumables to people, tracking purchase dates for depreciation, and importing users from LDAP or Active Directory with local account fallback. Its SAML login supports identity providers such as Entra ID, Okta and Authentik, so match that list to your own provider. Before you choose, confirm three things in a test environment: whether your identity provider's SAML flow works with the product, how many agents or endpoints you will manage, and whether you need ticketing at all. Load a sample of your real asset records and check the result, since the import and ownership model will shape your daily work for years.
Which open-source asset tool suits which scenario
This table maps four common situations to the tool that fits each one best and names the condition that makes the choice hold. Read it by matching your primary need first, then checking the condition in the why column before you shortlist.
| Scenario | Best fit | Why and the condition that makes it hold |
|---|---|---|
| Small team tracking laptops, licenses and accessories with no ITSM need | Snipe-IT | Tracks who has which laptop, purchase dates for depreciation and software licenses, and checks out accessories and consumables. Holds if you do not need tickets, problem or change records, and the self-hosted software is free under AGPL-3.0. |
| One tool for tickets, problems, changes and asset records | GLPI | Handles ITIL tickets, problems and changes alongside asset management under GPL-3.0-or-later. Holds if your team can run PHP with MySQL or MariaDB and accepts that network discovery and SNMP need the separate GLPI Inventory plugin. |
| Customizable CMDB with impact analysis and SLA management | iTop | Offers a fully customizable CMDB, graphical impact analysis, customizable SLA management and data consistency audits under AGPL-3.0. Holds if you have people to model your configuration items, and confirm the agent-based tier that matches your console or agent count with Combodo. |
| Discovering network devices by SNMP | GLPI (with GLPI Inventory) | Network discovery and SNMP inventory come from the separate GLPI Inventory plugin, while the GLPI Agent handles hardware and software inventory on endpoints. Holds if you install and test the plugin on your network. Confirm SNMP device coverage in your own environment before you commit. |
What GLPI, Snipe-IT and iTop each do and how they are licensed
These four cards cover the three platforms on the shortlist and one inventory source that often feeds GLPI. Each card says what the product is built to track, how its license works and what to verify before committing, because asset tracking, CMDB depth and service management are different jobs.
GLPI: ITSM and asset suite
GLPI is GPL-3.0-or-later and maintained by Teclib', which also sells GLPI Network subscriptions and cloud hosting. It combines ITIL tickets, problems and changes with asset management, contracts and CMDB data, so it suits teams that want one platform for service desk and inventory. Native inventory comes from the GLPI Agent, while network discovery and SNMP inventory need the separate GLPI Inventory plugin. Check that plugin coverage matches your network before you commit.
Snipe-IT: asset and license tracking
Snipe-IT is AGPL-3.0 licensed and built on Laravel 12. It tracks who holds which laptop, purchase dates for depreciation and software license assignments, and it checks out assets, licenses and accessories to people. It is a narrower tool than a full ITSM suite, so it fits teams whose main problem is ownership and lifecycle rather than incident handling. Confirm that its asset model matches your reporting needs before you migrate records.
iTop: CMDB and service management
iTop is an AGPL-3.0 ITSM and CMDB platform from Combodo. It covers helpdesk and incident management, service and contract management, change management, customizable SLA management and graphical impact analysis. Its data model is the main reason to choose it, because impact analysis depends on how well your CMDB is modeled. Combodo sells support, training and consultancy, and extensions come through the iTop Hub, so review those dependencies in your scope.
OCS Inventory NG: inventory source for GLPI
OCS Inventory NG is an inventory source that teams sometimes pair with GLPI. No supplied fact covers its license or its current version, so confirm both with its maintainers before you rely on it. Check how its agents report into GLPI, which data fields arrive and who supports the integration. Treat it as an open question in the design, not a settled part of the stack.
How the three options compare on core asset capabilities
This table sets GLPI, Snipe-IT and iTop side by side on the capabilities that usually decide an asset management shortlist. Cells marked for confirmation have no supplied fact, so check them with the vendor or in a test environment before you rely on them. The main takeaway is that GLPI covers the widest ITSM and inventory ground, Snipe-IT is the simplest asset register, and iTop is the CMDB-first option.
| Capability | GLPI | Snipe-IT | iTop |
|---|---|---|---|
| License | GPL-3.0-or-later, maintained by Teclib' | AGPL-3.0 | AGPL-3.0, sponsored and supported by Combodo |
| Latest release in the facts | 12.0.0, published October 7, 2026 | v8.8.0, published September 30, 2026 | 3.3.0, published September 15, 2026 |
| ITSM scope | Tickets, problems and changes plus asset management | Asset tracking focus, not a full ITSM suite | Helpdesk, incident, change, SLA and contract management |
| Automated inventory | Native inventory through the GLPI Agent since version 10 | Confirm agent-based inventory options with the vendor | Confirm inventory collection options for your estate |
| Network discovery and SNMP | Needs the separate GLPI Inventory plugin | Confirm with the vendor | Confirm with Combodo or the iTop Hub |
| CMDB depth | Asset and infrastructure models, confirm depth against your CI types | Asset register with checkout and component tracking, not a CMDB | Fully customizable CMDB with graphical impact analysis and consistency audits |
| LDAP | Authentication against LDAP directories, tried after the internal database | LDAP sync imports users and allows LDAP login with local fallback | Confirm directory options for your edition |
| SAML | Confirm SAML provider support for your version | Named providers include Entra ID, Okta, Google Workspace and Authentik | Confirm SAML support for your edition |
| REST API | Confirm API scope for your version | JSON REST API covers most web interface actions | Confirm API scope with Combodo documentation |
| Database support | MySQL 8.0 or later, or MariaDB 10.11 or later (GLPI README) | MySQL 5.7+ or MariaDB | MySQL 5.7 or later or MariaDB 10.6 to 11.8, MariaDB preferred |
| Docker availability | Official Docker image listed among distribution options | Docker image available per the README | Confirm with Combodo |
| Paid tiers | Teclib' GLPI Network subscriptions, self-hosted from 100 euros per month | Free self-hosting, hosted plans from $399.99 per year | Community free for up to 10 agents, Atelier up to 50, Forge above 50 |
What the free and paid editions cost you
Self-hosting the free edition of any of these tools means you pay for people and infrastructure, not for the software. Snipe-IT is the clearest case: its pricing page says the self-hosted software is and always will be free, while hosted plans start at $399.99 per year and add email support, automated upgrades and server maintenance. That hosted fee buys operations you would otherwise staff yourself, including upgrades, which matter because Snipe-IT's requirements call for PHP 8.2 or later and below 8.6 and MySQL 5.7+ or MariaDB. Hosted and subscription plans are commercial products, not open source, so read their terms as you would any vendor contract. GLPI sells subscriptions rather than a hosted free tier. Per the GLPI Network subscriptions page, GLPI Network public cloud costs 19 euros per user per month and private cloud 21 euros per user per month with a 25-user minimum, while self-hosted subscriptions run from 100 euros per month (Basic, up to 10 agents and 500 assets) to 4,500 euros per month (Enterprise), which includes level 3 support and access to GLPI Network marketplace plugins. Before comparing those figures with your own headcount, confirm which plugins and support levels your scope needs, because the marketplace and level 3 support are the parts you would be paying for beyond the GPL software. iTop prices by agent count rather than by user. Combodo offers iTop Community free for up to 10 agents, iTop Atelier for up to 50 agents and iTop Forge for more than 50, each on premises or as SaaS, and sells commercial support, training and consultancy separately. Ask Combodo to define an agent for your environment and to state in writing whether each tier includes upgrades, support hours and hosting. In any written quote from any of these vendors, request the per-year or per-month price, the agent or user count it covers, what is one-time (setup, migration, training) and what recurs (licenses, support, hosting), and the renewal and price-change terms.
How each platform handles LDAP and SAML sign-in
GLPI authenticates users by trying a sequence of sources in a fixed order. According to the GLPI user documentation, it checks the internal database first, then LDAP directories, then IMAP mail servers, and then other external methods such as REMOTE_USER. Because the order is set, an account that exists locally is matched before a directory entry with the same name is considered, which affects how you plan account ownership and password resets.
- Internal database first: local accounts are tried before any external source, so keep the list of local administrators short and documented.
- LDAP directories: directory sources can be added as authentication servers, and you should confirm the filter and attribute mapping against your own directory schema.
- IMAP as a source: the documented chain includes IMAP mail servers, so confirm whether your mail platform is an appropriate identity source before relying on it.
- REMOTE_USER: this method depends on the web server or reverse proxy passing an authenticated user name, so the proxy configuration becomes part of your sign-in design.
- Version check: confirm the authentication screens and method list in the release you deploy, since the GLPI 12.0.0 release adds session review and step-up authentication for certain administrative actions.
Confirm with your Teclib' contact or your own test instance how SAML is handled in the edition and version you plan to run, because the supplied user documentation does not describe SAML in the chain above.
Snipe-IT separates directory import from single sign-on. Its LDAP sync imports and updates users from LDAP or Active Directory, and users can log in with LDAP credentials. If the LDAP login fails, the platform falls back to a local account, according to the Snipe-IT LDAP documentation. SAML is a separate path, and the Snipe-IT SAML documentation lists identity providers including Entra ID, Google Workspace, Okta, OneLogin, JumpCloud, Shibboleth and Authentik.
- LDAP import: the sync brings users into the asset system so that check-outs can be assigned to people rather than typed names.
- LDAP login with local fallback: the fallback protects administrator access during a directory outage, but it also means local accounts remain valid sign-in paths that need their own password policy.
- Entra ID and Google Workspace: both are listed as SAML providers, so confirm the attribute names and group claims your tenant sends.
- Okta, OneLogin and JumpCloud: these hosted directories are also listed, which suits organizations that already run one of them as the central identity source.
- Shibboleth and Authentik: these are listed as well, which is useful for federated education and self-hosted identity environments.
Before go-live, test a user who exists only in the directory, a user who was removed from it, and a local administrator, because each path behaves differently when the directory is unavailable.
The supplied facts for iTop do not confirm its LDAP or SAML options. The README describes a customizable CMDB, helpdesk, service and change management, but it does not state how users sign in to it. Do not assume that iTop supports either protocol, and do not design around a feature until Combodo confirms it for the version you plan to run. Treat this as an open question rather than a settled capability.
- LDAP support: ask Combodo whether directory authentication or directory user import is available in the edition you plan to use.
- SAML support: ask whether SAML single sign-on is supported natively or only through an extension distributed via the iTop Hub.
- Edition differences: ask whether the Community, Atelier and Forge editions differ on authentication features, since the agent-based tiers are priced differently.
- Hosting model: confirm whether the on-premises and SaaS options provide the same sign-in features, because identity integration may differ between them.
- Support and documentation: ask for the current authentication documentation for the release line you plan to install, along with any known limits.
Get these answers in writing before the identity design is approved, because a missing feature can change the architecture and the cost of supporting local accounts.
How to choose and pilot an asset platform
This sequence turns a shortlist of GLPI, Snipe-IT and iTop into a tested choice by checking your asset rules, inventory sources, directory login, data load, upgrade path and quoted cost against the number of endpoints and users you will reach.
Define asset classes and assignment rules
The IT asset owner and a service desk lead list every asset class in scope, such as laptops, monitors, peripherals, licenses, consumables and components, and write down who or what each can be assigned to. Note which classes need depreciation dates, which need license seat counts and which need check-out and check-in history. Finish with a one-page assignment matrix. You know this step is done when each class has an owner, a required field list and a sample check-out scenario that every shortlisted platform can be tested against.
Decide whether tickets and CMDB links are in scope
The IT service owner decides whether asset records must link to incidents, changes, contracts or configuration items. Snipe-IT centers on asset tracking, while GLPI and iTop add ITIL-style tickets, problems and changes, and iTop adds CMDB relationships and impact analysis. If ticketing is out of scope, record that decision so the pilot does not test features you will not use. You know this step is done when the team has a signed list of required linkages and a list of processes that stay in a separate tool.
Confirm how endpoints will report inventory
The endpoint or desktop team maps each device group to a collection method. For GLPI, confirm whether the GLPI Agent covers hardware and software inventory on Windows, macOS and Linux, and whether network discovery and SNMP need the separate GLPI Inventory plugin. For Snipe-IT and iTop, confirm which external tool or import will populate records. Document the agent version, the reporting interval and the server endpoint for a sample group of devices. You know this step is done when a test device appears in the pilot instance with hardware and software fields populated.
Test LDAP and SAML against a sample directory
The identity team builds a small test group in a non-production directory and runs sign-in tests for each candidate. Check how GLPI tries its internal database, LDAP, IMAP and external methods in order, whether Snipe-IT's LDAP sync updates users and falls back to local accounts, and whether SAML login works with your identity provider. Record which user attributes map to asset owners and which administrator groups get rights. You know this step is done when a test user signs in, keeps the correct role after a directory change, and an account removed from the directory loses access as expected.
Load a representative asset set
The asset administrator prepares a sample of a few hundred records that includes every asset class, shared licenses, a loaned device and a retired item. Load it through CSV import or the REST API, and confirm that required fields, custom fields and assignments survive. iTop documents CSV import and GLPI supports inventory through agents, so test the path you will actually use in production. Check duplicate handling and record counts after each load. You know this step is done when the pilot report matches the source file and a person can find a device by serial number, owner or license.
Rehearse the upgrade and plugin steps
The platform engineer restores a copy of the pilot database and files into a separate environment, then runs the vendor's update procedure. For GLPI, back up the database, the files and the config directory including glpi.key and glpicrypt.key, replace the application files and run the database update. Since GLPI 11.0, plugins are suspended after a new version is detected and must be reactivated after major updates, so list every plugin you depend on and test each one. For Snipe-IT and iTop, record the equivalent steps from their documentation. You know this step is done when the rehearsal ends with a working instance, a documented rollback and a list of reactivated plugins.
Compare written quotes against your real counts
The procurement lead asks each vendor or partner for a written quote based on the endpoint, agent and user counts you expect to reach, not the counts in the pilot. For GLPI, compare self-hosted subscription tiers against limits such as agents and assets, and compare any cloud option by user. For iTop, confirm which Community, Atelier or Forge tier matches your agent count. For Snipe-IT, confirm whether self-hosted use stays free and what hosted support adds. Ask who pays for hosting, upgrades, plugin support and integration work. You know this step is done when each quote states the counts, the support level and the recurring fees side by side.
What running each platform takes from your team
Running any of these three platforms is mostly a question of how many runtime components your team must keep patched and how often upgrades touch them. GLPI's README lists PHP 8.3 or later with MariaDB 10.11 or later or MySQL 8.0 or later, but its installation docs list PHP 8.2 or later with MySQL 8.0 or MariaDB 10.6 for GLPI 11.0 and say only MySQL and MariaDB are supported. Before you size hosts, confirm which of those version sets applies to the release you plan to deploy. Snipe-IT is lighter on paper: it requires PHP 8.2 or later and below 8.6, MySQL 5.7+ or MariaDB, and Apache with mod_rewrite or IIS with URL Rewrite, and the README notes a Docker image is available. iTop 3.3.x requires PHP 8.2 to 8.4, MariaDB 10.6 to 11.8 (preferred) or MySQL 5.7 or later, and GraphViz for its diagrams, so add GraphViz to your build and patch list before you choose an image.
GLPI's upgrade path carries the most recurring discipline. The update procedure in the installation docs requires a backup of the database, the files and the config directory, including glpi.key and glpicrypt.key, followed by replacing application files and running php bin/console db:update. Since GLPI 11.0, plugins are suspended when a new version is detected and must be reactivated after major updates. If your team depends on plugins for inventory, approvals or reporting, plan a test upgrade that checks each plugin's status before users return. Losing the key files can leave encrypted data unreadable, so store copies outside the application directory and test restoration, not just the backup job.
Effort rises with four drivers: the number of plugins and custom integrations you run, the volume of assets and history in the database, the number of agents or console users, and the number of directory and identity sources you bind. For iTop, Combodo suggests an all-in-one server with 2 vCPU and 4 GB of memory for fewer than 200 tickets a month and under 20 console users, and separate web and database servers of up to 8 vCPU and 16 GB for larger installations. Measure your own ticket and user counts against those bands before you accept a sizing. In a quote, ask the implementer to name every plugin, connector and directory binding in scope, who patches the runtime and database, and what the recurring upgrade test costs in effort.
Questions buyers ask before hiring help with asset management
What drives the cost of implementing GLPI or Snipe-IT?
Scope drives most of the cost: how many asset classes you track, how many sites and users are involved, and which integrations you need. The main cost components are the engagement itself (planning, configuration, integration, data migration, testing, documentation and handover) and, separately, the infrastructure and any paid software you choose. Agent rollout across Windows, macOS and Linux endpoints, LDAP or SAML identity setup, and cleaning existing spreadsheet or CMDB data all add effort. Ask any provider for a written, fixed-scope proposal that lists each deliverable, the assumptions behind it and the client responsibilities. DeployOpen does not publish a price list, and a quote follows from the written scope.
Can a small team run GLPI or Snipe-IT without outside help?
Yes, a team with Linux and web server skills can install and run either one, but the ongoing work is what most teams underestimate. Snipe-IT's self-hosted software is free, and its requirements are PHP 8.2 or later and below 8.6 with MySQL 5.7 or MariaDB, plus Apache with mod_rewrite or IIS with URL Rewrite. GLPI requires PHP 8.3 or later with MariaDB 10.11 or MySQL 8.0 for its current README, and its update procedure means backing up the database, files and configuration keys, replacing application files, and running php bin/console db:update. Staff must also own agent deployment, directory integration and patching. Confirm that your team can cover those tasks on a recurring basis before deciding.
How long does a pilot take to set up?
No supplied figure exists for pilot duration, so do not rely on any number from a vendor or consultant until it appears in writing. Duration depends on the number of asset types, how clean your source data is, whether agents must reach endpoints across several networks, and how many identity sources you connect. Ask any provider for a fixed-scope proposal that states the pilot's start and end conditions, the number of endpoints or assets in scope, the integrations included, the acceptance criteria and the dates that depend on your side, such as directory access and sign-off. DeployOpen agrees scope, deliverables and timelines in writing before work starts.
What does the work need from our team?
Implementation needs named people from your side, and delays usually come from missing access or decisions rather than from the software. Expect to provide: a service account or read access to Active Directory or LDAP for user and group sync, SAML metadata for your identity provider if you use single sign-on, existing asset exports and purchase or license records, and a list of asset owners who can confirm data. Someone must approve data standards such as naming, locations and lifecycle states, and someone must sign off the acceptance tests. Agree these responsibilities in the proposal so that both sides know who is blocking progress.
Is the free edition enough for asset tracking?
The free edition is enough for many teams that need to track hardware, assignments and licenses, because the self-hosted software is the core product. Snipe-IT says its self-hosted software is and always will be free, and its hosted plans start at $399.99 per year and add email support, automated upgrades and server maintenance. GLPI's free self-hosted use does not include the paid GLPI Network subscriptions, which add level 3 support and marketplace plugins. Before deciding, confirm whether you need vendor support windows, managed upgrades or features that sit in paid plugins or tiers, and check current terms directly with each vendor.
What changes if we move from GLPI, Snipe-IT or iTop later?
Switching is mostly a data mapping and process exercise, not a software swap. Each platform has its own data model for assets, users, locations, contracts and assignments, so the first step is an export and a field-by-field map that records what is lost or transformed. GLPI's inventory agent and Snipe-IT's REST API both give you ways to pull data out, and iTop supports CSV import, but you should test each export on real records. Agents may need to be reconfigured, integrations rebuilt, and historical audit trails archived separately. Plan for a parallel run and keep the old system read-only until reconciliation passes.
Do we need a CMDB or just asset tracking?
Choose a CMDB only if you need to model relationships between configuration items, services and changes, because a CMDB adds data maintenance work. iTop is built around a customizable CMDB with graphical impact analysis and data consistency audits, and GLPI covers ITIL tickets, problems and changes alongside assets. Snipe-IT focuses on who has which device, purchase dates for depreciation and software licenses, so it is simpler to run. Ask yourself which questions your auditors and service owners will ask, and let those drive the choice of platform and the scope of the engagement.
How DeployOpen scopes and delivers asset management work
DeployOpen plans, implements, customizes, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For asset management, that means agreeing in writing what GLPI, Snipe-IT or iTop must track, connect and report on before any build work starts.
How we scope
- Written scope names the asset classes, assignment workflows and lifecycle states to be tracked in your chosen platform.
- Scope lists which directories and identity providers handle sign-in, such as LDAP or SAML, and who owns each setting.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work begins.
How we build
- Installation runs inside your own infrastructure, with the database, web server and hosting stack matched to the platform's documented requirements.
- Inventory collection, import of existing asset records and integration with your directory are configured and tested against your environment.
- Customizations, plugins and integrations are documented so your team can maintain them after handover.
How we hand over
- Handover covers configuration documentation, backup and restore procedures, and the update steps specific to your platform version.
- Your team receives a record of who holds administrative access and how sign-in, license assignments and role mappings are set up.
- Compliance-relevant evidence, such as access settings and backup records, is organized for your assessors, who issue any audit reports.
How we support
- Ongoing support, upgrades and testing are available as retainers once the platform is live.
- Upgrade planning checks plugin compatibility and database requirements before each new release is applied.
- Ask any provider to confirm which update, backup and availability tasks fall to you and which fall to them.
