MidPoint 4.7 "Johnson"

Simulations. They cover various mechanisms of "what-if" analysis in midPoint. Now we can see expected effects of actions without the risk of damaging the system state. We can separate production-ready parts of the configuration from those being developed, and choose what configuration should be engaged during specific simulation. We can define binary "event marks" tagging individual objects being processed during simulation, as well as quantitative metrics for these objects and their changes. All these metrics can be aggregated, analyzed, and reported on, along with details of individual changes.

Extending password reset functionality with the multiple verifications. Within this improvement the logic of the security policies usage was reworked in such way that user currently can have multiple security policies referenced (e.g. one can be referenced from the organization structure, second - from the archetype). Therefore, an algorithm of the security policies merging was realised: the security policy referenced from the organization structure overrides the global security policy configuration, the security policy referenced from the archetype overrides the security policy referenced from the organization structure.

Simplification of application and business role creation using the role wizard. The business role wizard contains simple configuration steps for creating a role, assigning application roles and assigning members. The wizard for application roles contains similar steps, a step for creating a role, steps for assigning an application and a step for assigning members. See Wizard panel configuration for more details.

MidPoint now stores additional IGA-related value metadata for role membership references. The missing data will be populated automatically after the object is recomputed or changed. Utilizing these metadata, Indirect accesses report was added as an initial object (see this report example).

Initial implementation of Reference search.

Import preview for one shadow.

Delta viewer updated on several pages (focus save preview, audit event details, simulations, …​). See Delta visualization for more details.

Object Marks and Object Operation Policies. Added new mechanism for lightweight administrative / policy marking of objects (supported only with native repository, in this release marks are only supported for shadows). The functionality of protected shadows was reworked in favor of object marks and object operation policies, which allows for shadows to be explicitly marked as protected or excluded from synchronization.

ConnId handlers are disabled by default, there is no need to disable them explicitly.

New version (2.6) of CSV Connector was released and bundled with midPoint. The connector supports internal filtering of search results, it does not need ConnId result handlers any more.

New version (3.6.1) of LDAP connector bundle (including LDAP Connector and Active Directory Connector) was released and bundled with midPoint. This version fixes a bug with large integer numbers (MID-4424). Resource schema of LDAP and AD resources need to be refreshed (deleted and re-fetched) for the connector to operate correctly. Please see Upgrade section below for details.

Docker images will be released in Docker Hub soon after midPoint 4.7 release.

Overlay project examples will be released soon after midPoint 4.7 release.

MidPoint Studio version 4.7 will be released soon after midPoint 4.7 release.

Prism data representation library 4.7 was released together with midPoint 4.7.

Midpoint client Java library will be released soon after midPoint 4.7 release.

Functionality that is marked as Experimental Functionality is not supported for general use (yet). Such features are not covered by midPoint support. They are supported only for those subscribers that funded the development of this feature by the means of subscriptions and sponsoring or for those that explicitly negotiated such support in their support contracts.

MidPoint comes with bundled LDAP Connector. Support for LDAP connector is included in standard midPoint support service, but there are limitations. This "bundled" support only includes operations of LDAP connector that 100% compliant with LDAP standards. Any non-standard functionality is explicitly excluded from the bundled support. We strongly recommend to explicitly negotiate support for a specific LDAP server in your midPoint support contract. Otherwise, only standard LDAP functionality is covered by the support. See LDAP Connector page for more details.

MidPoint comes with bundled Active Directory Connector (LDAP). Support for AD connector is included in standard midPoint support service, but there are limitations. Only some versions of Active Directory deployments are supported. Basic AD operations are supported, but advanced operations may not be supported at all. The connector does not claim to be feature-complete. See Active Directory Connector (LDAP) page for more details.

MidPoint user interface has flexible (responsive) design, it is able to adapt to various screen sizes, including screen sizes used by some mobile devices. However, midPoint administration interface is also quite complex, and it would be very difficult to correctly support all midPoint functionality on very small screens. Therefore, midPoint often works well on larger mobile devices (tablets), but it is very likely to be problematic on small screens (mobile phones). Even though midPoint may work well on mobile devices, the support for small screens is not included in standard midPoint subscription. Partial support for small screens (e.g. only for self-service purposes) may be provided, but it has to be explicitly negotiated in a subscription contract.

There are several add-ons and extensions for midPoint that are not explicitly distributed with midPoint. This includes Java client library, various samples, scripts, connectors and other non-bundled items. Support for these non-bundled items is limited. Generally speaking, those non-bundled items are supported only for platform subscribers and those that explicitly negotiated the support in their contract.

MidPoint contains a basic case management user interface. This part of midPoint user interface is not finished. The only supported parts of this user interface are those that are used to process requests, approvals, and manual correlation. Other parts of case management user interface are considered to be experimental, especially the parts dealing with manual provisioning cases.

Production deployments of midPoint 4.7 in Microsoft Windows environment are not supported, as midPoint 4.7 is a feature release. Production deployments in Windows environments are supported only for LTS releases. For midPoint 4.7, Microsoft Windows is supported only for evaluation, demo, development and similar non-production purposes. Please see Supported Platforms for MidPoint Deployment for details.

Linux (x86_64)

OpenJDK 11 (11.0.16).

OpenJDK 17. This is a recommended platform.

Firefox

Safari

Chrome

Edge

Opera

There are database schema changes (see Database schema upgrade).

Version numbers of some bundled connectors have changed. Connector references from the resource definitions that are using the bundled connectors need to be updated.

See also the Actions required information below.

ConnId result handlers are disabled by default. Result handlers were enabled by default in previous midPoint versions as this was default set by ConnId framework. However, most connectors do not need result handlers, and the result handlers may even be harmful when used with some connector, the default setting was changed in midPoint 4.7.

New version (3.6.1) of LDAP connector bundle (including LDAP Connector and Active Directory Connector) was released and bundled with midPoint 4.7. This version fixes a bug with large integer numbers (MID-4424).

Scripts using objectVariableMode set to prismReference should, by default, be provided with the real value of the reference, however in some cases they were provided PrismReferenceValue instead. This is now fixed and real value of type Referencable is provided.

000-system-configuration.xml:

015-security-policy.xml: name attribute was replaced with identifier within authentication modules and sequences definition.

130-report-certification-definitions.xml, 140-report-certification-campaigns.xml, 150-report-certification-cases.xml, 160-report-certification-work-items.xml (previously 160-report-certification-decisions.xml) were fixed. Please see MID-8665 and commit 0d552a71.

310-dashboard-admin.xml was fixed. Please see MID-8362, MID-8084, and commit d774ddea.

A number of initial objects were added: object and event marks, four new object archetypes, two object collections, and six new reports.

name attribute is deprecated for AuthenticationSequenceType, identifier is added to be used instead of name as a unique sequence identifier.

name attribute is deprecated for AuthenticationSequenceModuleType, identifier is added to be used instead of name as a unique sequence module identifier.

name attribute is deprecated for CredentialsResetPolicyType, identifier is added to be used instead of name as a unique credentials reset identifier.

name attribute is deprecated for AbstractAuthenticationModuleType, identifier is added to be used instead of name as a unique authentication module identifier.

securityPolicyRef attribute is added to ArchetypeType. For now only structural archetypes can have a reference to a security policy.

Several authentication modules were added in order to be used for user identification or user authentication. For now the modules are used within password reset process. Following attributes are added to AuthenticationModulesType type: attributeVerification (used to verify user’s attributes values), focusIdentification (used to identify the user comparing their identifier(s) value), hint (used to give the user a possibility to remember their password). The related to flexible authentication functionality types were also extended to make the new modules work properly. So, CredentialsPolicyType type was extended with attributeVerification elements, each of them services the corresponding module.

Necessity of the authentication modules was extended with more values, therefore required, requisite and optional values can be used for AuthenticationSequenceModuleNecessityType type.

AuthenticationSequenceModuleType type was extended with acceptEmpty element, so that module can be skipped in case of empty credentials with acceptEmpty=true.

Inspect your configuration for deprecated items, and replace them by their suggested equivalents. You can use ninja tool for this.

The behavior of synchronization reaction to deleted situation was changed. Now it checks the existence of (other) accounts of given type, and invokes the actions only if there is none. See commit 89e139da.

The behavior of "Shadows cleanup" activity was changed. Now it checks for real existence of abandoned shadows, assuming that the resource in question has the read capability. See also MID-8350 and commit 9402fd3b.

Safe operations during preview changes

Create on demand is now safe to use in multithreaded tasks.

Users that run distributed report exports now need also the #modify authorization for ReportDataType objects instead of simple #add. It is because of the fix in the process of aggregation of these reports. See also commit 60f52da3.

User authentication while password reset procedure was improved with new authentication modules. For more information, please see Password Reset Configuration page for details.

Selection of resource objects for Live synchronization tasks was implemented (see MID-8537 and commit d929179c). Some configuration that are not 100% correct and rely e.g. on setting kind to account in a live sync task that returns unqualified objects (i.e. objects without kind and intent), would break down. Please check your settings. If your task expects that some objects may not be qualified, do not use kind and intent for specification of synchronized resource objects set.

Legalization of projections now creates constructions with specific object kind and intent. As an additional safety check, for unclassified projections (i.e. those with unknown kind or intent), we do not create legalization assignments. See MID-8562 and commit e57142b9.

When an assignment target (pointed to by targetRef) cannot be found during assignment deletion, the error is no longer logged. (Only at DEBUG level.) See MID-8366 and commit 75c10795.

The handling of authorizations of so-called elaborate items (e.g. task activity and activityState) was fixed. These are no longer ignored during authorization processing. If your authorizations relied on the original (faulty) behavior, please adapt them. See MID-8635 and commit 131cb46d.

There were only minor API changes in this release

Some now-obsolete methods in OperationResult were removed (see commit c90e5ee1).

Code in the provisioning-impl module was streamlined, so check any potential dependencies on it.

So-called proposed shadows are no longer marked using lifecycleState property. See MID-4833, commit b7d9c550, and the docs.