Shadow

A shadow in midPoint is a repository object that represents an object on an external resource, such as an account on an LDAP server or a group of users in a cloud service. Resource object shadows are stored in the midPoint repository, meaning the information they contain is accessible without contacting the resource itself. They use fixed predetermined schema and usually contain only basic information about the resource object. Shadows serve as lightweight projections or pointers to their corresponding resource objects.

Shadows exist to bridge midPoint’s internal identity model and external resource identifiers. They provide a stable repository representation that links subjects (for example, users) to their remote resource-side counterparts that use identifiers native to the particular resource (LDAP DNs, UUIDs, database keys). As such, shadows enable reliable correlation of identities across various resources.

By representing resource objects in the repository, shadows decouple internal processing from repeated reads of external systems. Changes discovered on resources are recorded in shadows and changes to shadows can be translated into provisioning operations.

Structurally, a shadow combines fixed schema fields, an extensible attributes element, linkage references, lifecycle classification data, and optional caching metadata.

MidPoint usually works with fresh data it fetches from connected resources in an on-demand manner. This means that if it needs data from the resource, it connects to the resource and gets the data.

However, there may be cases when such an operation is too expensive to be performed too often. It may be that the resource is too slow, often down and impossible to reach, or rate-limited.

To reduce the traffic between midPoint and resources, midPoint can cache resource-side data in its internal repository database. The caching method is always passive; only the data needed for an activity are fetched and cached by midPoint.

MidPoint stores the data it uses in the shadow of the resource object the data relate to. When midPoint is to execute an activity that needs the same resource data, it uses the cached data instead of connecting to the resource.

The cache is built gradually as midPoint reads the resource objects. If you need to pre-populate the cache, use an operation that searches all the objects, such as reconciliation. See how to refresh the cache.