Evolveum midPoint

Evolveum midPoint is an open-source identity governance platform for organizations that need to coordinate identities, accounts, roles, and access decisions. It is best suited to teams able to run and maintain a Java application; its governance coverage is broad, but production deployment carries database and subscription requirements.

Overview

MidPoint brings identity repositories together with controls for assigning and reviewing access. It can manage accounts, groups, and organizational units, while giving users a role catalog for access requests and administrators an audit trail of identity-related operations. Evolveum describes it as suitable for organizations of different types and sizes. The Apache License and European Union Public License make the software open source, though some production capabilities require an active support subscription.

Key features

• Provisioning and synchronization: MidPoint can automatically create and manage accounts, groups, and organizational units, and supports directory synchronization. Its connector catalog includes LDAP, Active Directory, database tables, and CSV files, giving administrators several common identity sources and targets to work with.
• Access requests: Users request application access from a role catalog, and policy can send requests for approval before assigning approved roles. That offers a structured approval route for organizations that need to govern access changes.
• Access reviews: Certification campaigns let reviewers decide whether access is still needed and support remediation afterward. This makes the review process part of the system rather than leaving decisions without a follow-up path.
• Auditing: The audit trail records operations involving identity objects, roles, policies, and configuration. Administrators can examine those records when they need to trace changes.
• Authentication and security: MidPoint supports SAML 2.0 and TOTP. Evolveum says security issues receive its highest priority whether or not the reporter subscribes. Its security guide also advises limiting access to remote services to trusted entities, since their use can affect service availability.

Pricing

The midPoint plan costs nothing, with no license fee. That makes it a plausible choice for organizations prepared to manage an open-source deployment, but it is not a blanket promise of subscription-free production use: clustering and selected features require an active support subscription, and production use of features such as clustering and a generic repository database requires one.

For midPoint 4.10 and newer, PostgreSQL is the only supported production database. Evolveum sells third-level product support subscriptions with service levels of 8×5 next business day or 24×7. These terms matter for teams planning a different production database or relying on subscription-gated capabilities.

Platforms

MidPoint is a Java application deployable on Linux, Windows, or macOS, with Linux recommended. macOS is not supported for production use. The directory identifies API, web, and self-hosted platforms as well, but platform choice does not change the production database requirement: PostgreSQL is the supported database for version 4.10 and newer.

Who it's for

MidPoint fits organizations that need lifecycle provisioning alongside access requests, certification campaigns, and audit records, and have the technical capacity to deploy and operate Java software. It is less suitable for teams that need production on macOS, depend on a non-PostgreSQL database for newer releases, or require clustering without a support subscription.

Pros and cons

Pros

• Broad governance workflow: Provisioning, role-based requests, approval policies, access reviews, and auditing cover multiple stages of identity administration.
• Open-source licensing: The free plan has no license fee, and the software is available under the Apache License and European Union Public License.
• Connector range: LDAP, Active Directory, database-table, and CSV connectors give teams several familiar integration options.
• Security issue priority: Evolveum says it prioritizes security issues independently of subscription status.

Cons

• Production constraints: Newer releases support PostgreSQL as the only production database, and macOS is not production-supported.
• Subscription gates: Clustering and selected features require an active support subscription, so the free license alone may not cover a desired production setup.
• Operational exposure: Remote services need to be restricted to trusted entities because they can affect service availability.

Alternatives

Soffid Identity Governance Administration is worth considering if free binary downloads with registration suit your adoption path; source downloads do not require registration, and a free trial is available.

Corma may suit teams seeking a freemium option centered on identity-provider connection, a browser extension, SSO, and 10 apps; its Essential plan is €3 a month billed annually.

Oracle Cloud Infrastructure Secret Management is an alternative for readers comparing a free secret-management service rather than a full identity governance platform.

Stitchflow offers a free first workflow built and tested in your environment, with an ongoing plan priced at $1,000 a month.

SailPoint IdentityIQ is another paid identity governance option, typically contracted for three years with annual billing upfront.

Beta Systems Garancy Suite is an alternative with one-time purchase and subscription models, both requiring a pricing inquiry.

Saviynt Enterprise Identity Cloud offers Essentials and Pro tiers for organizations comparing paid identity-security packages.

ConductorOne may appeal to teams looking for usage-based billing or a platform-pricing option.

Browse more options in Identity Governance Software and Identity and Access Management Software.

Verdict

Choose midPoint if your organization wants open-source identity governance that spans provisioning, access approvals, reviews, and auditing, and can work within its Java, PostgreSQL, and subscription conditions. Look elsewhere if your deployment depends on production macOS, a different database for newer releases, or subscription-free clustering.