4 Best Open Source IGA Platforms in 2026: Identity Governance Compared

The four best open source IGA platforms in 2026 are midPoint, OpenIAM, Apache Syncope and Soffid IAM. All four cover the full identity governance and administration scope — provisioning, roles, access reviews, audit — rather than just login. Below we compare them on licence, governance depth, 2026 release state and the situations each one fits, and we say which tools we deliberately left out.

Updated 8 October 2026. Originally published June 2025. We are a midPoint Gold Partner, so read the midPoint section with that in mind — we have tried to be as even-handed as our experience allows.

Commercial identity governance is consolidating into cloud-only subscriptions. Microsoft Identity Manager leaves extended support on 9 January 2029, SAP Identity Management ends mainstream maintenance on 31 December 2027, and the replacements on offer are mostly US-hosted SaaS. For European organisations under NIS2, DORA or KRITIS, that raises a question that did not exist five years ago: can we keep identity governance under our own control without losing enterprise capability?

Open source IGA is the practical answer — but only if the platform actually does governance. Many “open source IAM” lists mix authentication servers (Keycloak, Authentik, Gluu) with true IGA platforms. Single sign-on is not identity governance. Governance means the complete lifecycle: HR-driven onboarding and offboarding, role management, access requests and certification campaigns, segregation of duties, and an audit trail that satisfies an auditor. We only evaluated platforms that deliver that scope with an open source core.

How we evaluated the platforms

Five criteria, applied to every candidate:

• Full IGA scope. Provisioning and deprovisioning, role model, access requests, access certification, policy and SoD enforcement, audit and reporting. Authentication-only products were excluded.
• Genuinely open source core. The governance engine itself must be available under an OSI-approved licence, not just a free tier or a plugin.
• Alive in 2026. At least one release in the last twelve months and a visible roadmap.
• Production references. Deployments beyond a few thousand identities, ideally in regulated sectors.
• Data sovereignty. Can be run entirely on infrastructure you control, in the EU, without phoning home.

We run identity programmes for banks, universities and public-sector organisations across Central Europe, mostly on midPoint, and we have migrated customers off Microsoft Identity Manager, SAP IDM and several commercial IGA suites. That experience shapes the judgements below.

This article compares open source platforms with each other. If your shortlist is midPoint against the commercial market leader instead, read our separate midPoint vs SailPoint comparison.

Open source IGA platforms compared

Two things the table cannot show. First, “open source” is not binary: midPoint and Syncope publish everything; OpenIAM and Soffid publish a core and sell the rest. Second, governance depth varies more than feature lists suggest — a checkbox for “access certification” says nothing about whether campaigns scale to 100,000 reviewable items. Ask for a reference at your size.

midPoint: the most complete open source IGA platform

Developer: Evolveum (Bratislava, Slovakia) · Licence: Apache 2.0 and EUPL 1.2 · In production since: 2011 · Web: evolveum.com · Releases: docs.evolveum.com/midpoint/release

midPoint was designed as an identity governance platform from the first commit, not as an authentication server with provisioning bolted on. That shows in the data model: users, roles, organisations, services and — since our own extension work — AI agents are first-class objects with the same lifecycle, policies and audit. There is no enterprise edition; the version on GitHub is the version banks run.

What it does that the others don’t

• Simulations. Any change — a new role, a rewritten mapping, an HR feed with bad data — can be run against production data in simulation mode and reviewed before it touches a single account. On migrations this is the feature that removes the weekend-outage risk.
• Policy rules and SoD. Segregation-of-duties and assignment constraints are enforced at assignment time and in certification campaigns, not reported after the fact.
• Role mining. Built-in clustering of existing entitlements into candidate business roles, with outlier detection, so a role model can be derived from reality rather than from workshops.
• Organisational structures. Multiple parallel hierarchies (line management, projects, locations, tenants) drive inducements and approvals; this is where HR-driven automation lives.
• Scale. The native PostgreSQL repository and the midScale work put tens of millions of identities and large certification campaigns within reach of a single deployment.

Releases and support

Evolveum ships one feature release a year and maintains a long-term support line. 4.10 is the current feature release, 4.8 LTS is supported until October 2028, and 4.11 is scheduled for 15 October 2026. Commercial subscriptions come from Evolveum; implementation, training and operations come from partners — Inalogy is a midPoint implementation partner and one of seven Gold partners worldwide.

Deployment

On-premises on PostgreSQL (the native repository), Docker and Kubernetes on any cloud, or as a managed service: our IAM Factory runs midPoint on German infrastructure for customers who want the sovereignty without the operations. Keycloak is the usual companion for authentication, with midPoint governing the identities Keycloak authenticates.

Where it is not the right fit

midPoint is a governance engine, not a bundle. If what you actually need is single sign-on and MFA for a hundred SaaS apps, midPoint alone is the wrong tool — pair it with Keycloak or buy an access-management product. It also rewards configuration discipline: mappings and policies are expressed in a declarative model, and teams that skip the data-model design phase pay for it later. Budget for an experienced partner or for training.

Best for: organisations replacing Microsoft Identity Manager, SAP IDM or a commercial IGA suite that want complete governance, European data sovereignty and no licence fees.

OpenIAM: converged IGA and access management

Developer: OpenIAM (USA) · Licence: Community Edition open source, Enterprise Edition commercial · Web: openiam.com

OpenIAM bundles identity governance, lifecycle management and access management (SAML, OIDC, MFA) behind a single identity store, which is attractive for organisations that want one product and one vendor. Workflows handle approvals, delegation and escalation; provisioning covers role assignment and policy evaluation; access reviews and compliance reports are included. Deployment is container-first: Kubernetes with Helm charts, OpenShift, and Terraform templates for AWS, Azure and GCP.

The open source question

OpenIAM publishes a Community Edition that is, by the vendor’s own description, the previous generation of the Enterprise Edition. The CE will always trail the commercial product, and the depth of governance features you get without a subscription is narrower than the marketing page suggests. Evaluate the CE as an open core, and price the Enterprise Edition if you need the full IGA scope with support. The current CE is 4.2.2 (December 2025).

Best for: enterprises that want governance and SSO in one platform, have a budget for the Enterprise Edition, and prefer a US vendor relationship.

Apache Syncope: synchronisation and provisioning under Apache governance

Developer: Apache Software Foundation, main contributor Tirasa (Italy) · Licence: Apache 2.0 · Top-level Apache project since: 2012 · Web: syncope.apache.org

Syncope’s strength is the hardest part of identity administration: keeping identity data consistent across dozens of systems with different schemas, APIs and failure modes. Its propagation and pull tasks, transformation rules and policy engine are mature, and it uses the same ConnId connector framework as midPoint, so connector coverage is broad. Workflows run on Flowable BPMN 2.0; a SCIM 2.0 extension exposes the identity store to SaaS targets; everything is available through a complete REST API.

Since the 3.x line Syncope has grown two optional components that move it towards a converged platform: WA (Web Access, an Apereo CAS-based SSO and MFA server) and SRA (Secure Remote Access, an API gateway). The 4.x line is current — 4.1.3 “Capriccio” shipped on 11 September 2026 and 4.0.x is still maintained — and the project’s governance under the ASF means no single vendor can change the licence.

Where it falls short

Governance is the thinner side. Access certification campaigns, segregation-of-duties enforcement and role analytics are either basic or need to be built on top. Syncope is best understood as an excellent identity administration and synchronisation engine; if certification and policy are the reason you are buying, test those specifically.

Best for: engineering-led organisations with complex synchronisation requirements, developers comfortable extending a Java platform, and anyone who wants the neutrality of an Apache project.

Soffid IAM: converged governance, access and PAM from Spain

Developer: Soffid (Palma, Spain) · Licence: open source core with commercial subscription · Web: soffid.com

Soffid is the broadest of the four by module count: identity governance, access management, privileged access management, identity risk & compliance, password management and identity analytics share one identity model. For organisations that would otherwise buy three products, that convergence is the pitch. It is Common Criteria certified and listed in the Spanish CCN-STIC catalogue, which matters for public-sector procurement in Spain and is a credible security signal elsewhere.

The connector library covers the usual enterprise targets, approval workflows handle delegation and escalation, and the audit and reporting layer is built for regulated environments. Development is active — the public repositories receive commits monthly through 2026 — and the company sells subscriptions, consulting and implementation.

Where to look closely

Outside Spain and Latin America the partner ecosystem is small, and the community around the open source core is thin compared with midPoint or Syncope. Confirm which modules are in the open source core and which require a subscription before you plan on “free”.

Best for: public-sector and regulated organisations, especially in Southern Europe, that want governance and PAM from a single European vendor.

Which open source IGA platform fits which situation

• Replacing Microsoft Identity Manager or SAP IDM with a hard deadline: midPoint. Simulations and the org-structure model map directly onto what those products did, and the migration path is well trodden — see our guides to replacing MIM and SAP IDM end of life.
• One product for governance and SSO, budget available: OpenIAM Enterprise Edition, or midPoint plus Keycloak if you want both halves open source.
• Synchronisation across many systems, strong engineering team: Apache Syncope.
• Governance plus PAM from one European vendor, public-sector procurement: Soffid.
• Governing non-human and AI identities alongside people: midPoint — its object model treats AI agents as identities with roles and lifecycle, which none of the others do today.
• HR-driven automation with messy edge cases (rehires, multiple contracts, leave): midPoint or Syncope; see our HR lifecycle write-up.

What did not make the list, and why

• Keycloak, Authentik, Gluu, Ory. Excellent open source access management — authentication, SSO, MFA, OAuth. They do not govern identities: no HR-driven lifecycle, no certification, no SoD. Keycloak is our standard companion to midPoint, not a substitute.
• miniOrange. A commercial SSO/MFA/CIAM product with free tiers. It is not open source — the company markets itself as an alternative to Keycloak and Gluu — and it is not an IGA platform.
• Grouper, FreeIPA, OpenLDAP. Group management and directory services. Valuable infrastructure, but not governance.
• Commercial suites with “community” downloads that are time-limited or developer-only. A trial is not open source.

Migrating from a commercial platform: what the timeline looks like

With SAP IDM maintenance ending on 31 December 2027 and MIM extended support ending on 9 January 2029, the planning window is now. A realistic open source IGA migration for a mid-size organisation runs 9–18 months from design to full cut-over; large, multi-entity environments take longer. The phases that decide success:

1. Data model and authoritative sources first. Decide what HR (or several HR systems) is allowed to drive, how identities are correlated, and which attributes are owned where. Most failed IGA projects skipped this.
2. Connectors early. Inventory target systems and test the hard ones (mainframe, SAP, bespoke apps) in week one, not month six. Prefer a platform whose connector framework you can extend yourself.
3. Parallel run with simulation. Reconcile the new platform against the old one read-only, review the differences, then switch provisioning system by system. midPoint’s simulation mode makes this a routine task rather than a leap of faith.
4. Governance after administration. Switch on certification campaigns and SoD once the account data is clean; a campaign over dirty data trains reviewers to click “approve”.
5. Operations and ownership. Decide before go-live who runs the platform — your team, a partner, or a managed service — and train for it. Licence cost goes to zero; the budget moves to people.

Frequently asked questions

What is open source IGA?

Identity governance and administration (IGA) software whose core — provisioning, role management, access requests and certification, policy enforcement, audit — is published under an open source licence such as Apache 2.0, EUPL or LGPL. You can run it yourself, inspect it, extend it and choose who supports it.

Which open source IGA platform is the most complete?

midPoint. It is the only one of the four with every governance feature — certification, SoD, role mining, simulations, organisational structures — in the open source product, with no enterprise edition held back.

Is Keycloak an IGA platform?

No. Keycloak is an access management server for authentication, SSO and MFA. It has no HR-driven lifecycle, access certification or segregation-of-duties enforcement. The common pattern is midPoint for governance and Keycloak for authentication.

Is miniOrange open source?

No. miniOrange is a commercial SSO, MFA and CIAM product with free tiers; its core is proprietary and it positions itself as an alternative to open source servers such as Keycloak. It is also not an identity governance platform.

Can open source IGA replace Microsoft Identity Manager or SAP IDM?

Yes — this is the most common reason organisations adopt midPoint today. MIM extended support ends 9 January 2029 and SAP IDM mainstream maintenance ends 31 December 2027; both are replaced with HR-driven provisioning, role management and governance that the old products never had.

What does an open source IGA implementation cost?

Licence fees are zero for midPoint and Syncope and optional for OpenIAM and Soffid. The budget goes to implementation (design, connectors, migration), optional vendor subscription, and operations. For a mid-size organisation that is typically a fraction of the licence-plus-services cost of a commercial suite — and, unlike licences, it does not scale with headcount. For midPoint specifically, see our midPoint implementation pricing page.

Open source IGA in 2026: control is the feature

All four platforms are mature enough to run identity governance for organisations with hundreds of thousands of identities, and three of the four are built in the European Union. What separates them is how much governance is genuinely open, how much engineering they expect from you, and how large the ecosystem around them is. midPoint leads on governance depth and openness; Syncope on synchronisation and neutrality; OpenIAM and Soffid on convergence with access management and PAM.

If you are planning a Microsoft Identity Manager or SAP IDM replacement, or you want to see what an open source IGA platform looks like against your own HR data and target systems, reach out. We will run a scoped assessment — your sources, your systems, your constraints — and tell you honestly which of these platforms fits, including when the answer is not midPoint. Let’s talk.