MidPoint 4.11

Last modified 12 Oct 2026 18:38 UTC
Table of Contents
This is a planned release. It is not complete yet. Therefore the information presented here is likely to be incomplete and inaccurate. For information regarding the latest stable release please see MidPoint 4.10.5 (Braille Update 5) .

Release 4.11 is a seventy-second midPoint release, code-named Braille. The 4.11 release brings accessibility improvements, compliance features as well as many incremental improvements and bugfixes.

Planned releaseOctober 2026
Release type Feature release

Louis Braille (1809-1852) was a French educator. He invented a reading and writing system named after him, intended for use by visually impaired people. Braille invented the system at an early age, and dedicated most of his life to improve his system. The system invented by Braille opened up the world of knowledge and learning to the visually impaired people.

Similarly to Braille's system, midPoint 4.10 brings major improvements in accessibility. Self-service part of midPoint user interface was meticulously reviewed and improved to correctly support tools used by the visually impaired people. Moreover, midPoint 4.10 brings many incremental improvements and new features in various areas, reminiscent of Braille's relentless improvements of his system through his life. Overall, midPoint 4.10 opens up the world of identity management and governance to everybody.

Changes With Respect to Version 4.10

New Features and Major Improvements

  • MidPoint expression language: secure expression language for use in mappings and customization.

  • New Smart Integration features:

    • Suggestions of object types (delineation).

    • Suggestions of focus type.

    • Suggestions of correlators.

    • Suggestions of mappings.

    • Suggestions of simple associations.

    • Object Type / Object Class statistics.

    • Correlators simulation.

    • Inbound mappings simulation.

    • Dedicated #smartIntegration authorization for suggestion operations.

  • Connector generator wizard: AI-assisted, low-code wizard that generates a working manifest-based connector JAR for an external application without hand-writing connector code.

    • Supports SCIM, REST and SQL protocols.

    • Guided workflow using wizard:

      • start from scratch or import an existing low-code connector

      • basic information (application identification, connector coordinates)

      • application documentation discovery with AI processing

      • connection setup (base URL, authentication methods, AI-generated authentication scripts, credentials, connectivity endpoint discovery and testing)

      • object class discovery, schema generation

      • Support for per-operation code generation scripts (search all, search by ID, search filter)

      • Limited support for create, update, delete, relationships

    • Runs in a limited offline mode (skeleton scripts, no documentation processing, no relationships) when the Connector Generator microservice is not configured.

    • In-progress connector developments are tracked as ConnectorDevelopmentType objects, listed under Connectors > Connector developments.

    • Protected by the dedicated #connectorWizard authorization, not granted by any out-of-the-box role (Superuser reaches it only via #all), because the wizard generates and executes connector code.

  • UI/UX improvements:

    • Improved Object Type wizard.

    • Improved Mappings page.

    • Improved Correlation page.

  • Multi-tab Browser Support. See MID-11050.

  • Support for PostgreSQL 18

  • MID-11358 Added connector signature verification for production environments without an active subscription, including import of signed allowed-connectors list and subscription compliance enforcement. See TODO link to docs

  • ITSM ticketing: the built-in manual connector can now manage provisioning tickets on a real ITSM system, using a dedicated ticketing resource. The ticket is managed as a projection (a shadow of the work kind) of the midPoint case.

  • New work shadow kind for work items (issues, tickets, cases, work packages).

  • Cases can now hold projections: the new ProjectionHolderType schema type is a common parent of FocusType and CaseType.

  • TOTP support: new totp authentication module brings multi-factor authentication based on time-based one-time passwords to flexible authentication. Users can set up and reset their authenticator application in the self-service user interface. See MID-11049.

  • Focus policies in activities: focus-based policy rules can now be configured and evaluated per task activity, not only for the whole task. This allows separate focus-based thresholds for individual activities of composite tasks, including the restartActivity and skipActivity policy actions. See MID-11051.

TODO

Other Improvements

  • Added support for Slovenian (sl), Latvian (lv) language.

  • Multiple libraries updated, including spring boot.

  • Many improvements in accessibility of the self-service, approval process and identity recovery user interface (WCAG 2.2 compliance).

  • MID-10997 Added support for additional footer.

  • MID-11036 Implemented support for exporting reports and tables to XLSX.

  • MID-11229 Implemented streaming export for XLSX format.

  • MID-10918 Improved audit record for skipped approval stage.

  • MID-9476 Improved Search Box in Object Collection View.

  • MID-10867 Added support for java 25.

  • MID-10875 Added Order constraints tab for Assignments panel.

  • MID-10335 Fixed inconsistency in the connector loading process.

  • MID-10936 Changed the logger for SQL functional tracing from org.hibernate.SQL to com.evolveum.midpoint.repo.sqlbase.querydsl.SqlLogger.

  • Improved handling of clockwork collisions in multi-thread setup, problem was reflected in duplication of assignments. See MID-10714.

  • Improved patch management of docker images, updated tagging of docker images. See Container Images Naming Conventions.

  • Implemented new configuration options for processing uploaded images.

  • MID-8802 Added displayName and preferredName to UserType.

  • Upgraded AdminLTE to 4.1. See MID-11538.

  • Added support for "null" expression. See MID-11867.

  • Fixed handling of admin assign/unassign governance/member authorization. See MID-11850.

  • Upgraded Apache CXF to 4.2.2. See MID-11948

  • Added configurable validation and processing of uploaded files, including content type verification, image conversion, and metadata stripping. See MID-11849.

  • Custom deployment colors (header color or skin) or a custom logo are now taken as an indication that midPoint runs in a production environment. See MID-11977.

  • Added lifecycle state configuration for construction inducement. See MID-11922.

  • Added English (Europe) locale. See MID-10286.

  • Added auditing of Smart Integration service calls, including request payload recording and full-text payload search. See MID-11325.

  • Form multipart limit (adminGuiConfiguration/formMaxMultiparts) now defaults to the Tomcat server.tomcat.max-part-count value instead of a fixed 100.

  • Improved security filtering of transient pending objects before GUI rendering. See MID-12062

  • Changed password hints to be stored as ProtectedStringType instead of plain strings. See MID-12111 and migration guide.

  • Account activation now uses a dedicated authentication sequence and a one-time link. This is mainly used when password hashing is enabled. See Account Activation Authentication Sequence for the required configuration.

  • Fixed object marks not being removed immediately after unassigning the policy that induces them. See MID-10641.

  • Registration confirmation notifier doesn’t send cleartext username and password by default.

  • Password hint is now hidden by default in the self-service user interface.

  • Added option to relax email address validation when sending notifications (mail.mime.address.strict JVM property). See MID-11048.

  • Added mapping authoritativeness indicators based on mapping strength and range to mapping tables and previews. See MID-12021.

  • Added quick actions to apply Correlate later, Do not touch, and Invalid data marks directly from simulation results. See MID-11583.

  • Improved correlation configuration with selection and creation of inbound mappings directly from correlation items. See MID-12036 and MID-11920.

  • Improved reporting of Smart Integration suggestion errors, including access to operation details and the related task. See MID-11393.

  • Added GUI support for configuring mapping iteration settings and reviewing iteration settings in mapping suggestions. See MID-11712 and MID-11753.

  • Added a configurable Smart Integration service response timeout using smartIntegration/serviceResponseTimeout. See MID-11902.

  • Improved object class search in Smart Integration to support case-insensitive matching and searching object class documentation. See MID-11394.

  • Improved default mapping range initialization based on target cardinality while preserving custom ranges. See MID-12404.

  • Added GUI editor for role auto-assignment, including the condition. See MID-4684.

  • Added support for range in mappings in GUI. See MID-11767.

  • Added support for filter expressions and conditions in GUI. See MID-11865.

  • Improved handling of conditions in GUI. See MID-11864.

  • Added support for value expression returning null in GUI. See MID-11768.

TODO

Other Bug Fixes

  • Fixed unassignment with relation specification from Governance members. See MID-10955.

  • Fixed object types configuration usage on the members panel. See MID-10896.

  • Fixed Comment column behavior on the certification work items panel. See MID-10912.

  • Fixed session storage for Task Errors panel. See MID-10975.

  • Fixed expression filter usage for configured search items. See MID-10977.

  • Fixed 'Duplicate' action for certification definition. See MID-10456.

  • Fixed exporting of the 'Display name' columns on the certification items page. See MID-10873.

  • Fixed required comment validation while approving certification item. See MID-10974.

  • Fixed translation of the left menu items for collection views. See MID-10998.

  • Fixed polystring translation. From now, orig value of the polystring is never translated. See MID-10996.

  • Fixed attempt to modify immutable definition. See MID-11001.

  • Fixed schema type object updates and prism context schema registry reload. See MID-10983.

  • Fixed ConcurrentModificationException in RelationUtil. See MID-10940

  • Fixed correlation case closing on resolution error. See MID-11094

  • Fixed the execution of the 'Delete all closed tasks' action. See MID-11069

  • Fixed the usage of the multiple ProtectedStringType fields in the same panel. See MID-11072

  • Fixed misleading information in audit log during password reset. See MID-11077

  • Fixed authentication exception handling while user login. See MID-10953

  • Fixed progress bar colors in the Certification items dashboard panel. See MID-10930

  • Extended the list of the searchable items for UserType. See MID-11012

  • Fixed report data type name and exported file name to be unique. See MID-10978

  • Fixed the mapping for stage deadline column in certification cases table. See MID-11023

  • Fixed the path traversal vulnerability in the report import. See MID-11014

  • Fixed certification case stage outcome information. See MID-11026

  • Fixed admin gui configuration merging. See MID-11045

  • Fixed correlation work item panel. See MID-10993

  • Fixed recipient converter while sending notification. See MID-11038

  • Fixed page storage for dashboard widget collection. See MID-11055

  • Fixed oversized IN queries in fetchChildren causing PostgreSQL parameter limit errors. See MID-11089

  • Fixed getOptions conversion to avoid overriding default retrieval when <retrieve> is omitted. See MID-11088

  • Fixed missing estimatedOldValues in raw audit (EXECUTE_CHANGES_RAW). See MID-10027

  • Fixed modification of query of report fails when the query is defined using midPoint query language. See MID-11093

  • Fixed access request shows unrelated conflicts. See MID-10994

  • Fixed false replace updates in admin GUI dateTime comparison (seconds normalization issue). See MID-11078

  • Improved login and self-dashboard performance. See MID-10972

  • Fixed hide export button in the popup. See MID-11160

  • Delineation suggestions: filter parsing broken after recent GUI change. See MID-11175

  • Fixed work item search by name causing repository mapping error. See MID-8834

  • Fixed translation of archetype display labels in assignment picker and summary panel. See MID-11177

  • Fix 10k limit in certification queries using iterative search. See MID-11043

  • Fixed generic "Fatal error" message in object tables to show available list/search error details. See MID-10911

  • Improved user list performance with orgRelation authorization for users managing many organizations. See MID-11179

  • Fixed extension schema containers displaying. See MID-10954

  • Fixed duplicated "No response" option for campaign. See MID-11166

  • Fixed Campaigns scheduling menu item visibility. See MID-11176

  • Fixed axiom query parsing for saved filters. See MID-11183

  • Updated saved filters merging strategy. See MID-11181

  • Improved CSV export to use streaming data loading and export. See MID-10990

  • Fixed text formatting in disabled text area. See MID-11216

  • Fixed Privileged access initial object. See MID-11004

  • Fixed assignment name for policy rule. See MID-11005

  • Fixed object list view columns while report creation. See MID-10967

  • Fixed role analysis attribute queries for enum-based attributes such as effective status. See MID-10504

  • Fixed skipped approval processing for role ADD operations that could leave empty ADD deltas. See MID-11101

  • Fixed loss of unsaved resource detail changes after running Test connection. See MID-10966

  • Fixed dashboard widget collections with inline filters by allowing explicit object type specification. See MID-9879

  • Fixed missing .zip extension when downloading tracing report files. See MID-11096

  • Fixed resource wizard mapping property autocomplete to find partial matches regardless of letter case. See MID-10415

  • Fixed missing input variable in resource activation existence mappings. See MID-10905

  • Fixed stale page recovery after viewing page source causing internal server error. See MID-9998

  • Hided conflict warning on Shopping cart panel of the Request Access wizard in case of prune action. See MID-11250 and behavior changes since 4.10.

  • Fixed NPE when selecting deprecated action in resource object type editor. See MID-10957

  • Fixed tooltip lifecycle in search popovers to prevent blinking, stuck, and duplicate tooltips. See MID-10908

  • Fixed detailed resource lifecycle changes to use the proper confirmation and save flow. See MID-10700

  • Fixed multithreaded Ninja export race causing rare ArrayIndexOutOfBoundsException. See MID-10910

  • Fixed reference matches queries failing when the target filter is wrapped in parentheses. See MID-10903

  • Updated spring boot to 4.0. See MID-11002

  • Fixed serialization of focus preview changes page by avoiding retained live model context. See MID-11082

  • Fixed bucketed task workers continuing after root task suspension. See MID-11217.

  • Improved debug logging for OIDC opaque-token issuer discovery failures. See MID-11292.

  • Fixed structured-copy handling of reference values in asynchronous script execution. See MID-10587.

  • Fixed default login redirect to home page. See MID-10269

  • Updated spring boot to 4.1. See MID-11547

  • Fixed Wicket Ajax login redirects to preserve the servlet context path. See MID-11687

  • Fixed merging of the resource capabilities without id. See MID-11218

  • Fixed download report file extension. See MID-11312

  • Fixed reference value update in search panel. See MID-11400

  • Fixed Role catalog query for Roles of teammates. See MID-11221

  • Fixed defaultOperationPolicy merging in objectType of the resource. See MID-11412

  • Fixed encoding handling issues in csv report import and export. See MID-11413

  • Fixed custom relation translation. See MID-11523

  • Fixed CSV export for Tasks table. See MID-11652

  • Fixed breaking too long labels into lines. See MID-11711

  • Fixed breaking too long labels into lines. See MID-11714

  • Fixed empty recipient filter expressions bypassing notification redirection to file. See MID-11828

  • Fixed saving dynamic extension attributes. See MID-11716

  • Fixed recursive processing of post-initial objects in midpoint.sh and ninja.sh scripts. See MID-11201

  • Improved handling of unavailable OIDC issuers during GUI authentication. See MID-11293

  • Fixed resolver errors caused by unnecessary JAXB namespace imports in serialized enum schemas. See MID-10558

  • Fixed suspension of iterative scripting tasks when a threshold policy action is triggered. See MID-11073

  • Fixed obsolete property references in default authorization roles. See MID-10570

  • Fixed intermittent freezing of composition activities with subtasks in clustered deployments. See MID-11928.

  • Fixed search authorization denial for queries with type filters when read access is item-limited. See MID-11221.

  • Fixed standalone audit database schema upgrades missing the ROLE_ANALYSIS_OUTLIER object type. See MID-11884

  • Fixed visibility of sort icon for empty header cell. See MID-11860

  • Fixed multiple times clicking on Submit request button in Role catalog. See MID-11939

  • Fixed GUI handling of business role duplication when role creation requires approval. See MID-11784

  • Fixed worker progress reporting for distributed bucketed tasks. See MID-11186

  • Fixed authentication flow reuse across shared HTTP sessions. See MID-10821

  • Fixed stale resource reference in duplicated reconciliation tasks. See MID-12053

  • Fixed simulated reference attributes being requested from connectors. See MID-11807

  • Fixed automatic setting of archetypeRef when creating a new object from an archetyped collection view. See MID-11914.

  • Fixed GUI visualization failure for dynamic Prism containers without a compile-time class. See MID-11550

  • Fixed Velocity expressions rendering schema enum values in upper case. See MID-11086

  • Fixed self-registration confirmation not invalidating the used email nonce, which blocked subsequent password reset requests. See MID-12082.

  • Fixed stale effective marks remaining on focus objects when one of several marking policy rules stops matching. See MID-12154.

  • Fixed endless discovery loop causing stalled tasks and OOM when resource repeatedly reported "Already exists" on modification issue. See MID-11979.

  • Fixed transient effectiveOperationPolicy being persisted and displayed in audited shadow ADD deltas. See MID-11951.

  • Fixed unbounded growth of task operation results during iterative item processing. See MID-12197

  • Fixed persisted ItemPath values losing dynamic schema extension namespace declarations. See MID-11241

  • Fixed additional connector failure when connectorRef is specified using a filter. See MID-9537

  • Fixed Name and Display Name columns to honor configured display styles in object tables. See MID-11787

  • Fixed activation support detection for object-type configured capabilities in the projection details header. See MID-11954

  • Fixed unlock user action from users list table. See MID-12184

  • Fixed Approve/Reject action buttons visibility for correlation case. See MID-12358

  • Fixed extremely long input to subtype throws error. See MID-12169

  • Fixed Can’t hide query playground for superuser (with #all authorization). See MID-10848

  • Fixed visualization item descriptiveness handling for added and deleted containers. See MID-10620

  • Fixed displaying of the error while adding a delegation. See MID-12364

  • Fixed extra reviewer reference labels in certification campaign stage definitions. See MID-6647

  • Fixed access certification ignoring overridden system clock in deadlines, reminders, notifications and campaign cleanup. See MID-11008

  • Replaced Groovy usage in repository factory reset with a dedicated initial import activity and safe default password policy expression. See MID-12370

  • Fixed reviewer being able to submit a certification decision after the stage deadline has passed. See MID-11028.

  • Fixed unstable display order of certification work items. See MID-11047.

  • Fixed rendering of deltas of container items in audit report delta columns. See MID-10984.

  • Fixed page crash when searching audit records by delta changed item path. See MID-10985.

  • Fixed read-only fields being rendered as plain text without any visual container; they are now shown as greyed-out fields. See MID-11853.

  • Fixed activation outbound mappings being applied to unmanaged shadows. See MID-11029.

  • Fixed concurrency issue when parsing queries. See MID-11058.

  • Fixed dashboard widget showing "Unknown" for shadow collections. See MID-11102.

  • Fixed parsing of shadow attributes and identifiers in JSON format. See MID-10944.

  • Fixed handling of modification provenance metadata for phantom assignment additions. See MID-10979.

  • Reduced memory consumption when storing very large strings (e.g. traces) in the repository. See MID-11015.

  • Fixed duplicate trigger on task unpause that could leave task trees suspended or frozen. See MID-10496.

  • Fixed model loading for unassign action popup. See MID-11584.

  • Fixed report import for big data file. Report import uses streaming processing and has a maximal file size limit. See MID-11009.

  • Fixed operational-only shadow changes being incorrectly reported as affecting resource objects in simulations. See MID-11912.

  • Fixed viewing historical simulation results when referenced shadows have been deleted, and correlation simulation results when naming attributes are unavailable. See MID-11980 and MID-12273.

  • Fixed mapping suggestion actions failing after page deserialization. See MID-11627.

  • Fixed returning from a task to an empty resource page during resource creation. See MID-12073.

  • Fixed JavaScript escaping of operation result messages and localized date/time picker messages. See MID-12262.

  • Fixed incompatible discovered connector configuration value types that prevented returning to the Discovery step. See MID-11459.

  • Fixed script expression description updates and preservation when editing scripts or changing their language. See MID-11779 and MID-11988.

  • Fixed autocomplete filtering in numeric input fields when suggested values are provided as strings. See MID-12237.

  • Fixed correlation rule validation to require at least one correlation item before saving. See MID-12421.

Releases Of Other Components

TODO UDPATE

  • New version (1.5.2.0) of DatabaseTable Connector was released and bundled with midPoint. The connector suggest all names of columns for configuration properties related with name of column.

  • New version (2.8) of CSV Connector was released and bundled with midPoint. The connector suggest all names of columns for configuration properties related with name of column.

    • Fixed NPE with multivalue attributes when delimiter is not defined. (MID-8609).

    • Fix UTF-8 BOM character in csv file during of discovery functions. (MID-9497 and MID-9498).

  • New version (3.8) of AD/LDAP Connector was released and bundled with midPoint. The connector suggest all names of columns for configuration properties related with name of column.

    • Native association support.

    • Possibility to choose attributes that should not be returned by default.

    • Possibility to choose to encode string values in case of the presence of non standard ASCII characters.

    • Workaround for open-ldap mandatory member attribute.

    • Possibility to specify used auxiliary object classes in connector configuration.

    • Allow to send the LDAP_DIRSYNC_OBJECT_SECURITY flag in Active Directory sync request control.

Purpose and Quality

Release 4.11 (Čapek) is intended for full production use. It belongs to a feature release family, supported only for a reduced time period. Therefore it is intended for users that prefer new features over long-term stability.

All features are stable and well tested - except the features that are explicitly marked as experimental or partially implemented. Those features are supported only with special subscription contract.

Limitations

Following list provides summary of limitation of this midPoint release.

  • Functionality that is marked as Experimental Functionality is not supported for general use (yet). Such features are not covered by midPoint support. They are supported only for those subscribers that funded the development of this feature by the means of subscriptions and sponsoring or for those that explicitly negotiated such support in their support contracts.

  • MidPoint comes with bundled LDAP Connector. Support for LDAP connector is included in standard midPoint support service, but there are limitations. This "bundled" support only includes operations of LDAP connector that 100% compliant with LDAP standards. Any non-standard functionality is explicitly excluded from the bundled support. We strongly recommend to explicitly negotiate support for a specific LDAP server in your midPoint support contract. Otherwise, only standard LDAP functionality is covered by the support. See LDAP Connector page for more details.

  • MidPoint comes with bundled Active Directory Connector (LDAP). Support for AD connector is included in standard midPoint support service, but there are limitations. Only some versions of Active Directory deployments are supported. Basic AD operations are supported, but advanced operations may not be supported at all. The connector does not claim to be feature-complete. See Active Directory Connector (LDAP) page for more details.

  • MidPoint user interface has flexible (responsive) design, it is able to adapt to various screen sizes, including screen sizes used by some mobile devices. However, midPoint administration interface is also quite complex, and it would be very difficult to correctly support all midPoint functionality on very small screens. Therefore, midPoint often works well on larger mobile devices (tablets), but it is very likely to be problematic on small screens (mobile phones). Even though midPoint may work well on mobile devices, the support for small screens is not included in standard midPoint subscription. Partial support for small screens (e.g. only for self-service purposes) may be provided, but it has to be explicitly negotiated in a subscription contract.

  • There are several add-ons and extensions for midPoint that are not explicitly distributed with midPoint. This includes Java client library, various samples, scripts, connectors and other non-bundled items. Support for these non-bundled items is limited. Generally speaking, those non-bundled items are supported only for platform subscribers and those that explicitly negotiated the support in their contract.

  • MidPoint contains a basic case management user interface. This part of midPoint user interface is not finished. The only supported parts of this user interface are those that are used to process requests, approvals, and manual correlation. Other parts of case management user interface are considered to be experimental, especially the parts dealing with manual provisioning cases.

  • Smart Integration features which leverages LLMs, requires an external "Smart Integration" microservice to work properly (publicly available at our GitHub). For all such features there is also the requirement of either hosting your own LLM inference service, or use some third party LLM inference provider.

This list is just an overview, it may not be complete. Please see the documentation regarding detailed limitations of individual features.

Platforms

MidPoint is known to work well in the following deployment environment. The following list is list of tested platforms, i.e. platforms that midPoint team or reliable partners personally tested with this release. The version numbers in parentheses are the actual version numbers used for the tests.

It is very likely that midPoint will also work in similar environments. But only the versions specified below are supported as part of midPoint subscription and support programs - unless a different version is explicitly agreed in the contract.

Operating System

MidPoint is likely to work on any operating system that supports the Java platform. However, for production deployment, only some operating systems are supported:

  • Linux (x86_64)

  • Windows Server (2022)

We are positive that midPoint can be successfully installed on other operating systems, especially macOS and Microsoft Windows desktop. Such installations can be used to for evaluation, demonstration or development purposes. However, we do not support these operating systems for production environments. The tooling for production use is not maintained, such as various run control (start/stop) scripts, low-level administration and migration tools, backup and recovery support and so on. Please see Supported Platforms for MidPoint Deployment for details.

Note that production deployments in Windows environments are supported only for LTS releases.

Java

Following Java platform versions are supported:

  • Java 25. This is a recommended platform.

  • Java 21.

OpenJDK 25 is the recommended Java platform to run midPoint.

Support for Oracle builds of JDK is provided only for the period in which Oracle provides public support (free updates) for their builds.

MidPoint is an open source project, and as such it relies on open source components. We cannot provide support for platform that do not have public updates as we would not have access to those updates, and therefore we cannot reproduce and fix issues. Use of open source OpenJDK builds with public support is recommended instead of proprietary builds.

Databases

PostgreSQL is the only supported database for midPoint deployments since 4.10.

Although in previous versions of midPoint other databases were supported using object-relational mapping abstraction (Hibernate), it is no longer the case now. Native PostgreSQL repository implementation was developed and tuned specially for PostgreSQL database, taking advantage of native database features, providing improved performance and scalability. It is currently the only option.

Our strategy is to officially support the latest stable version of PostgreSQL database (to the practically possible extent). We make no commitments for future support of any other database engines. See Repository database support page for the details.

Only a direct connection from midPoint to the database engine is supported. Database and/or SQL proxies, database load balancers or any other devices (e.g. firewalls) that alter the communication are not supported.

Following database engines are supported:

  • PostgreSQL 18, 17, 16, 15, 14

PostgreSQL 17 is recommended.

Supported Browsers

  • Firefox

  • Safari

  • Chrome

  • Edge

  • Opera

Any recent version of the browsers is supported. That means any stable stock version of the browser released in the last two years. We formally support only stock, non-customized versions of the browsers without any extensions or other add-ons. According to the experience most extensions should work fine with midPoint. However, it is not possible to test midPoint with all of them and support all of them. Therefore, if you chose to use extensions or customize the browser in any non-standard way you are doing that on your own risk. We reserve the right not to support customized web browsers.

Important Bundled Components

Table 1. Important bundled components
Component Version Description

Tomcat

10.1.55

Web container

ConnId

1.7.0.0-SNAPSHOT TODO

ConnId Connector Framework

LDAP connector bundle

3.10-SNAPSHOT TODO

LDAP and Active Directory

CSV connector

2.10-SNAPSHOT TODO

Connector for CSV files

DatabaseTable connector

1.5.3.0

Connector for simple database tables

Download and Install

Release Form Download Install Instructions

Binary

https://evolveum.com/downloads/midpoint/4.11/midpoint-4.11-dist.zip

Installing MidPoint 4.11

Source

Evolveum/midpoint repository at GitHub, tag v4.11

Building MidPoint From Source Code

Java API JavaDoc

https://evolveum.com/downloads/midpoint/4.11/midpoint-api-4.11-javadoc/

JAR

SchemaDoc

https://evolveum.com/downloads/midpoint/4.11/midpoint-4.11-schemadoc/

ZIP

Upgrade

MidPoint is a software designed with easy upgradeability in mind. We do our best to maintain strong backward compatibility of midPoint data model, configuration and system behavior. However, midPoint is also very flexible and comprehensive software system with a very rich data model. It is not humanly possible to test all the potential upgrade paths and scenarios. Also, some changes in midPoint behavior are inevitable to maintain midPoint development pace. Therefore, there may be some manual actions and configuration changes that need to be done during upgrades, mostly related to feature lifecycle.

This section provides overall overview of the changes and upgrade procedures. Although we try to our best, it is not possible to foresee all possible uses of midPoint. Therefore, the information provided in this section are for information purposes only without any guarantees of completeness. In case of any doubts about upgrade or behavior changes please use services associated with midPoint subscription programs.

Please refer to the MidPoint Upgrade Guide for general instructions and description of the upgrade process. The guide describes the steps applicable for upgrades of all midPoint releases. Following sections provide details regarding release 4.11.

Upgrade From MidPoint 4.10

MidPoint 4.11 data model is backwards compatible with previous midPoint version. Please follow our Upgrade guide carefully.

Be sure to be on the latest maintenance version for 4.10, otherwise you will not be warned about all the necessary schema changes and other possible incompatibilities.

Note that:

  • There are database schema changes (see Database schema upgrade).

    • New tables for ApplicationType, ConnectorDevelopmentType were added.

    • Few other smaller changes.

  • Version numbers of some bundled connectors have changed. Connector references from the resource definitions that are using the bundled connectors need to be updated.

  • See also the Actions required information below.

Upgrade From Other MidPoint Versions

Upgrading from other versions than those listed above is not supported directly. Upgrade to the latest maintenance release of a minor version that supports upgrading to 4.11 first (listed above).

Deprecation, Feature Removal And Major Incompatible Changes Since 4.10

This section is relevant to the majority of midPoint deployments. It refers to the most significant functionality removals and changes in this version.

  • The PolyStringType.orig value is no longer treated as a translation key. Previously, due to the old PolyStringType structure, there were situations where the orig value of a polystring was interpreted as a translation key. For example, this occurred when a polystring was defined within a DisplayType object as a label for an object collection view. In such cases, if no explicit translation key was provided, midPoint attempted to translate the orig value. Starting from 4.11 version, the orig value will never be translated. Please ensure that all PolyStringType values in your environment are defined correctly. If localization is required, explicitly define translation keys or language-specific values within the polystring.

  • Iteration specification (e.g., in object template or focus mapping) has a new boolean property useTokenOnlyOnConflict and changed default value for start. By default, useTokenOnlyOnConflict is true, which means the token expression is not evaluated for the first (non conflicting) attempt. The default start value is now 0 when maxIterations is defined, and 1 when it is not. The default of 0 when maxIterations is present preserves backward compatibility for existing deployments (even when adding end), ensuring that new records continue to be iterated starting from 0 consistently with existing records. This can potentially break existing configurations that use a custom token expression and expect it to be evaluated on the first (non conflicting) attempt. In that case, set useTokenOnlyOnConflict to false explicitly.

  • The deprecated configuration attributes realm, issuerUri, jwkSetUri, nameOfUsernameClaim, singleSymmetricKey, trustedAlgorithm, trustingAsymmetricCertificate and keyStoreTrustingAsymmetricKey have been removed from OidcResourceServerAuthenticationModuleType. These attributes can be used in the token definition instead (see attributes jwt and opaqueToken).

  • Container images for midPoint 4.11.0 and later versions are built to run as non-root user midpoint with UID 1000. This means that any containerized (Docker/compose or Kubernetes) deployment with pre-existing volume/PVC needs to make the content on the persistent volumes writable to the new user. If a midPoint container detects at startup that $MP_DIR is not writable by the running user, it prints out a warning and suggested steps for Kubernetes deployments.

    Remediation depends on the concrete deployment style and all the cases cannot be covered universally, but possible options are:

    • Set securityContext.fsGroup: 1000 on the pod and k8s will relabel the volume group on mount.

    • Add an initContainer executing the ownership change, e.g. chown -R 1000:1000 on the relevant directories.

    • For Docker volumes, run: docker run --rm -v <volume>:/var --user 0 busybox chown -R 1000:1000 /var

    Take the options above as examples and adapt them to the specifics of your deployment. Check further details about the new Container Image Naming, and also the document describing the container image changes, including the container user change.

Changes In Initial Objects Since 4.10

This section is relevant to the majority of midPoint deployments.

MidPoint has a built-in set of "initial objects" that it will automatically create in the database if they are not present. This includes vital objects for the system to be configured (e.g., the role Superuser and the user administrator). These objects may change in some midPoint releases. However, midPoint is conservative and avoids overwriting customized configuration objects. Therefore, midPoint does not overwrite existing objects when they are already in the database. This may result in upgrade problems if the existing object contains configuration that is no longer supported in a new version.

The following list contains a description of changes to the initial objects in this midPoint release. The complete new set of initial objects is in the repo/system-init/src/main/resources/initial-objects directory in the source distribution and in the doc/config/initial-objects directory in the binary distribution.

Actions required: Please review the changes and apply them appropriately to your configuration. Ninja can help with updating existing initial objects during upgrade procedure using initial-objects command. For more information see here.

New initial objects:

  • 064-archetype-governance-policy.xml

  • 100-archetype-smart-integration-focus-object-type-statistics.xml

  • 100-archetype-smart-integration-resource-object-class-statistics.xml

  • 100-archetype-smart-integration-resource-object-type-statistics.xml

  • 100-archetype-smart-integration-schema-match.xml

  • 739-mark-shadow-correlation-owner-found.xml

  • 740-mark-shadow-correlation-owner-not-found.xml

  • 741-mark-shadow-correlation-owner-not-certain.xml

  • 742-mark-item-value-added.xml

  • 743-mark-item-value-removed.xml

  • 744-mark-item-value-modified.xml

  • 745-mark-item-value-not-changed.xml

  • 746-mark-item-value-change-not-applied.xml

  • 747-mark-item-value-failed.xml

  • 748-mark-projection-operational-changes-only.xml

  • 602-origin-artificial-intelligence.xml

  • 603-origin-system-intelligence.xml

Modified:

  • 062-archetype-classification.xml - Change display icon.

  • 029-archetype-application.xml - Poly-string translation keys added.

  • 501-archetype-task-reconciliation.xml - Poly-string translation keys added.

  • 502-archetype-task-recomputation.xml - Poly-string translation keys added.

  • 503-archetype-task-import.xml - Poly-string translation keys added.

  • 504-archetype-task-live-sync.xml - Poly-string translation keys added.

  • 505-archetype-task-async-update.xml - Poly-string translation keys added.

  • 506-archetype-task-cleanup.xml - Poly-string translation keys added.

  • 507-archetype-task-report.xml - Poly-string translation keys added.

  • 508-archetype-task-single-bulk-action.xml - Poly-string translation keys added.

  • 509-archetype-task-iterative-bulk-action.xml - Poly-string translation keys added.

  • 536-archetype-task-certification-start-campaign.xml - Poly-string translation keys added.

  • 537-archetype-task-certification-close-current-stage.xml - Poly-string translation keys added.

  • 538-archetype-task-certification-reiterate-campaign.xml - Poly-string translation keys added.

  • 702-archetype-person.xml - Poly-string translation keys added.

  • 705-archetype-shadow-policy-mark.xml - Poly-string translation keys added.

  • 200-lookup-languages.xml - Added Slovenian (sl) and Latvian (lv) languages.

  • 210-lookup-locales.xml - Added Slovenian (sl) and Latvian (lv) locales.

  • 250-mark-privileged-access.xml - Added archetype.

  • 710-mark-focus-activated.xml to 716-mark-focus-role-membership-changed.xml - Added display label and help with translation keys.

  • 730-mark-projection-activated.xml to 738-mark-projection-resource-object-affected.xml - Added display label and help with translation keys.

  • 899-dashboard-compliance.xml - Widget colors updated to --bs-* CSS variables.

  • 015-security-policy.xml - Added otp credentials policy for TOTP. Password hint is hidden by default (passwordHintConfigurability set to neverConfigure).

  • 380-object-template-person.xml - Fixed max. iterations for the "Full name" construction. Added displayName mapping from preferredName, falling back to fullName. Added range=all to the mappings for name, fullName, and displayName.

  • 110-report-user-list.xml - Added displayName column.

  • 050-user-administrator.xml - Added displayName.

  • 300-policy-require-classification.xml - Added archetype.

  • 300-policy-require-owner.xml - Added archetype.

  • 000-system-configuration.xml - Poly-string translation keys added. Added smartIntegration configuration. Added rw-type-delineation panel to resource wizard configuration. Added search items for Persons view. Allowed null expression evaluator in safe expression profile. SQL logger in functional-sql-logging tracing profile changed to com.evolveum.midpoint.repo.sqlbase.querydsl.SqlLogger. Added new logger com.evolveum.midpoint.common.CachedResourceBundleMessageSource with level ERROR to avoid log pollution.

  • 041-role-approver.xml - Removed obsolete authorization item references and added personalNumber alongside deprecated employeeNumber.

  • 042-role-reviewer.xml - Removed obsolete authorization item references and added personalNumber alongside deprecated employeeNumber.

  • 010-value-policy.xml - Replaced the default Groovy password policy expression with MEL for safe-expression compatibility.

Please review source code history for detailed list of changes.

Copies of initial object files are located in doc/config/initial-objects directory of midPoint distribution packages. These files can be used as a reference during upgrades. On-line version can be found in midPoint source code.

Schema Changes Since 4.10

This section is relevant to the majority of midPoint deployments. It describes what data items were marked as deprecated, or removed altogether from the schema. You should at least scan through it - or use the ninja tool to check the deprecations for you.
Table 2. Items being deprecated

Type

Item or value

Note

DefaultExpressionProfilesConfigurationType

bulkActions

Use unprivilegedPrincipal for actions provided via GUI or REST, and expression profiles based on types/archetypes for actions in repository objects.

DefaultExpressionProfilesConfigurationType

privilegedBulkActions

Use privilegedPrincipal for actions provided via GUI or REST, and expression profiles based on types/archetypes for actions in repository objects.

PolicyRuleType

enabled

Kept for compatibility with activity policies. Use processing in activity policies to switch policies on/off for specific task.
Table 3. Items being removed

Type

Item or value

Note

DefaultExpressionProfilesConfigurationType

customWorkflowNotifications

Deprecated since 4.8.

OidcResourceServerAuthenticationModuleType

realm, issuerUri, jwkSetUri, nameOfUsernameClaim, singleSymmetricKey, trustedAlgorithm, trustingAsymmetricCertificate, keyStoreTrustingAsymmetricKey

Deprecated since 4.8. Use items in token definition (jwt or opaqueToken) instead.
Table 4. Items being added

Type

Item or value

Note

AuditEventRecordType

payload

Generic payload (name, content type, content) attached to audit record.

AuditEventTypeType

externalServiceCall

New audit event type.

SystemConfigurationAuditType

externalServices

Audit of external service calls (experimental).

UserType

displayName, preferredName

New properties, see behavior changes below.

FocusType

email, phoneNumber, physicalAddress

Multi-value containers for contact information.

CredentialsType

otps

OTP (TOTP) credentials.

CredentialsPolicyType

otp

Policy for OTP credentials.

AuthenticationModulesType

totp

TOTP authentication module.

PolicyConstraintsType

executionTime, executionAttempts, itemProcessingResult

Activity related constraints, with corresponding PolicyConstraintKindType values.

PolicyActionsType

restartActivity, skipActivity

Activity related policy actions.

PolicyRuleType

order

Order of policy rule evaluation.

ActivityPoliciesType

processing

Switches activity policies processing on/off for the task.

ActivityStateType

haltingInformation

Marks activity halted by policy action.

DefaultExpressionProfilesConfigurationType

privilegedPrincipal, unprivilegedPrincipal, authorizedObjects, bulkActionsInAuthorizedObjects

New default expression profile settings.

SystemConfigurationExpressionsType

defaultScriptLanguage

Default language for script expressions.

SystemConfigurationType

smartIntegration

Smart integration configuration.

AdminGuiConfigurationType

fileUploadConfiguration

Upload validation and image processing configuration.

IterationSpecificationType

start, end, useTokenOnlyOnConflict

Iteration range and token evaluation control.

TaskExecutionEnvironmentType

conflictResolution

Resolution of write-write conflicts on focal objects.

SchemaHandlingType

complexAttributeType

Definition of complex attribute types.

ShadowKindType

work

New shadow kind for work items (issues, tickets).

FileFormatConfigurationType

xlsx

XLSX report file format, with FileFormatTypeType value xlsx.

ValueMetadataType

validation

Validation state of the value.

ImportOptionsType

compatFor

Object types for which compatibility mode is enabled.

ConnectorType

discoveryTimestamp

Protected timestamp of connector discovery.

SearchItemType

displayOrder

Order of search item.

VirtualContainerItemSpecificationType

display, label, validator

Display and validation of virtual container item.

WorkDefinitionsType

various

New activities, e.g. correlation, initialDataImport, mapping simulations, smart integration and connector development activities.

New schema files common-smart-integration-3.xsd, common-connector-dev-3.xsd and common-complex-attributes-3.xsd were added.

Other changes:

  • Activity policies (activity/policies/policy) now use common PolicyRuleType, PolicyConstraintsType and PolicyActionsType. Types ActivityPolicyType, ActivityPolicyConstraintsType, ActivityPolicyActionsType and related action and trigger types were removed. Item names did not change, existing activity policy configuration stays valid.

  • PasswordType.hint changed type from string to ProtectedStringType.

  • linkRef was moved from FocusType to new supertype ProjectionHolderType. CaseType now extends ProjectionHolderType as well.

  • DefaultExpressionProfilesConfigurationType items bulkActions and privilegedBulkActions are now optional.

  • ShadowAssociationTypeDefinitionType.associationObject (experimental) changed type from AssociatedResourceObjectTypeDefinitionType to ResourceObjectTypeDefinitionType.

  • ReportDataType.data (experimental) changed type from string to anyType.

Actions required:

  • Inspect your configuration for deprecated items, and replace them by their suggested equivalents. Make sure you don’t use any removed items. You can use ninja tool for this.

Behavior Changes Since 4.10

  • Request access wizard behaves differently in case when conflicting situation occurs and prune action will be used for resolving the conflict.

    Previously, the wizard showed warning on the Shopping cart panel about conflicting roles or other shopping cart items even in case when prune action resolves the situation automatically. In order to correspond to the definition of the prune action, which says that "The removal of the conflicting assignments is automatic and silent", it was decided to hide the warning from Shopping cart panel. See also MID-11250.

  • displayName was added to UserType and is populated by the default person object template from preferredName, falling back to fullName.

    Existing users may not have displayName populated immediately after upgrade. Most user-facing places use fallback display logic, but places that display the raw displayName value may remain empty until the value is materialized. To populate displayName for existing person users, set preferredName where needed and recompute the users so the person object-template mapping is applied. See also MID-8802.

Known Issues and Limitations

As all real-world software midPoint 4.11 has some known issues. Full list of the issues is maintained in bug tracking system. As far as we know at the time of the release there was no known critical or security issue.

There is currently no plan to fix the known issues of midPoint 4.11 en masse. These issues will be fixed in future maintenance versions of midPoint only if the fix is covered by a support agreement or subscription. No other issues will be fixed - except for severe security issues that may be found in the future.

The known issues of midPoint 4.11 may or may not be fixed in following releases. This depends on the available time, issue severity and many variables that are currently difficult to predict. The only reliable way how to make sure that an issue is fixed is to purchase midPoint support. Or you can fix the bug yourself. MidPoint is always open to contributions.

This may seem a little bit harsh at a first sight. But there are very good reasons for this policy. And in fact it is no worse than what you get with most commercial software. We are just saying that with plain language instead of scrambling it into a legal mumbo-jumbo.

Credits

Majority of the work on the Čapek release was done by the Evolveum team. However, this release would not be possible without the help of our partners, customers, contributors, friends and families. We would like to express our thanks to all the people that contributed to the midPoint project both by providing financial support, their own time or those that maintain a pleasant and creative environment for midPoint team. However, midPoint project would not exist without proper funding. Therefore we would like to express our deepest gratitude to all midPoint subscribers that made midPoint project possible.

Disclaimer

Planned release dates are just that: they are planned. We do not promise or guarantee release dates. Software development is a creative activity that includes a lot of inherent risk. We are trying really hard to provide the best estimates. We are not able to provide precise dates for releases or deliveries. Do not rely on midPoint release dates. Plan your project properly to address the risk of delayed midPoint releases.

Planned scope of midPoint releases is also an estimate. MidPoint development process always includes the balancing of the iron triangle. Therefore planned release scope may change at any time. There is a method to make sure that midPoint releases will work well for your project and that method is platform subscription.

We do not make any claims that midPoint is perfect. Quite the contrary. MidPoint is a practical software, developed by living and breathing developers and deployed in a real world. There are both known and unknown issues in midPoint. Also, midPoint is not feature-complete. New features are introduced in midPoint all the time. But not all of them are completed. There are always some limitations. As the license states, midPoint is provided "AS IS". Please do not rely on midPoint functionality that you have not tested to make sure that it works. MidPoint support and subscription programs are a way how to handle those issues. But even with support service, do not rely on functionality that is not documented. If you plan to use undocumented or non-existing functionality, platform subscription is the right service for you.

Was this page helpful?
YES NO
Thanks for your feedback