Feature Synergy

MidPoint has good support for organizational structures. While good organizational structure support is still not entirely common sight in identity management field, this single feature in itself won’t make midPoint really unique. What makes midPoint unique is the way how organizational structure works with other objects. Organizational structure support in a traditional identity management is all about divisions, sections and users. While midPoint can do all of that, we went a tiny bit beyond the tradition here. In fact it is quite a big bit. Organizational units (a.k.a. "orgs") in midPoint can hold broad variety of objects. Of course, there are users and other organizational units. But roles and services can be placed into the organizational structure as well. This may seem a simple idea, but it is very powerful. Firstly, midPoint can have more than one organizational tree. And in fact it does not need to be a tree at all, any acyclic oriented graph will do. This makes ideal condition for organizational structure to support use-cases such as xref:/midpoint/reference/admin-gui/request-access#role-catalog. And the story does not end here. Role catalogs are often organized by applications. Applications have their owners. MidPoint organizational units in fact behave almost like a roles themselves, therefore they may have owners. Now it is simple to model catalog catagories as applications, each application having its owner. And all of this can be combined with authorizations to create a delegated administration configuration: application owners can create new roles for their applications. Organizational structure, roles and authorizations working seamlessly together.

MidPoint has a very powerful mechanism of policy rules. Policy rules can be applied to a lot of aspects related to identity management and governance: approval processes, object lifecycle, organizational management, compliance - to just name a few. However, each policy rule is small and relatively simple statement. It is combination of policy rules that makes all of this really powerful. But how do we combine policy rules together? If there only was a nice and elegant way how to combine privileges together to form something like roles. Oh wait, there is a way! What if we combine policy rules to actual roles. It worked so well for authorizations. And no surprise that it also works for policy rules. But wait a minute! We have policy rules that apply to roles. For example policy rules that define role lifecycle, approval policies and so on. Therefore let’s group those policy rules to a role and apply that role to other roles. Hey, look! We have metaroles. They have just appeared out of thin air. And how useful they are! And now, as metaroles are just roles, what if we apply policy rules to metaroles, so now we have metametaroles …​ and there are turtles all the way down.

There is myriads of synergy examples in midPoint: