MidPoint 4.9 "TODO"

Shadow caching

Native Repository Support for searchContainersIteratively for all container types

Added support for external data in protected strings, that can be resolved via secrets providers. This allows to store secrets in external systems, such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, etc. For more information see .

Improvements regard shadow associations (work in progress)

Query Support for searching in value metadata of objects

Ninja

Role mining

The indication of official vs. unofficial build was added to the About page. See MidPoint JAR Signature Status for details.

We have added a new algorithm to detect which users are in the production-like environment. It would have the following impact, depending on your subscription status.

Duplication function of object or container showed in table.

Adding panel in gui, that support of creating new archetype for reference in resource object type.

Changing of input field for documentation element to multi-line text field.

Adding possibility for use 'Preview' button with development configuration on page details.

Adding 'Shadow reclassification' task as a new separate activity of the task type.

New implementation and look of date time picker.

Support for item deltas targeting value metadata only (without need to replace whole container value)

Resolving the issue for creating a new member object with predefined by archetype options on members panel.

Resolving several issues for Self Service → Credentials page.

Functionality that is marked as Experimental Functionality is not supported for general use (yet). Such features are not covered by midPoint support. They are supported only for those subscribers that funded the development of this feature by the means of subscriptions and sponsoring or for those that explicitly negotiated such support in their support contracts.

MidPoint comes with bundled LDAP Connector. Support for LDAP connector is included in standard midPoint support service, but there are limitations. This "bundled" support only includes operations of LDAP connector that 100% compliant with LDAP standards. Any non-standard functionality is explicitly excluded from the bundled support. We strongly recommend to explicitly negotiate support for a specific LDAP server in your midPoint support contract. Otherwise, only standard LDAP functionality is covered by the support. See LDAP Connector page for more details.

MidPoint comes with bundled Active Directory Connector (LDAP). Support for AD connector is included in standard midPoint support service, but there are limitations. Only some versions of Active Directory deployments are supported. Basic AD operations are supported, but advanced operations may not be supported at all. The connector does not claim to be feature-complete. See Active Directory Connector (LDAP) page for more details.

MidPoint user interface has flexible (responsive) design, it is able to adapt to various screen sizes, including screen sizes used by some mobile devices. However, midPoint administration interface is also quite complex, and it would be very difficult to correctly support all midPoint functionality on very small screens. Therefore, midPoint often works well on larger mobile devices (tablets), but it is very likely to be problematic on small screens (mobile phones). Even though midPoint may work well on mobile devices, the support for small screens is not included in standard midPoint subscription. Partial support for small screens (e.g. only for self-service purposes) may be provided, but it has to be explicitly negotiated in a subscription contract.

There are several add-ons and extensions for midPoint that are not explicitly distributed with midPoint. This includes Java client library, various samples, scripts, connectors and other non-bundled items. Support for these non-bundled items is limited. Generally speaking, those non-bundled items are supported only for platform subscribers and those that explicitly negotiated the support in their contract.

MidPoint contains a basic case management user interface. This part of midPoint user interface is not finished. The only supported parts of this user interface are those that are used to process requests, approvals, and manual correlation. Other parts of case management user interface are considered to be experimental, especially the parts dealing with manual provisioning cases.

Linux (x86_64)

Windows Server (2022)

Java 21. This is a recommended platform.

Java 17.

Firefox

Safari

Chrome

Edge

Opera

Inspect your configuration for deprecated items, and replace them by their suggested equivalents. Make sure you don’t use any removed items. You can use ninja tool for this.

The default configuration for caching was changed. Currently, only mapped attributes are cached by default. (Except for the situation when the caching is enabled by cachingOnly property in the read capability.) See commits [4775c1](https://github.com/Evolveum/midpoint/commit/4775c14884d42aa758c19b5693ec07dcacdeb147) and the following one - TODO.

When processing live sync and asynchronous update changes that contain only the object identifiers, a more aggressive approach to fetching actual objects was adopted: We now always fetch the actual object, if possible. The reason is that the cached version may be incomplete or outdated. (This may still change before 4.9 the release, though.) See commits [4775c1](https://github.com/Evolveum/midpoint/commit/4775c14884d42aa758c19b5693ec07dcacdeb147) and the following one - TODO.

The behavior of disableTimestamp and disableReason in the shadow activation container was changed. Before 4.9/4.8.1, these properties were updated only if there was an actual change in the administrative status from something to DISABLED. Since 4.9/4.8.1, both of these properties are updated even if the administrative status is already DISABLED: the disableReason is determined anew, and the disableTimestamp is updated if the status and/or the reason are modified. See MID-9220.

Automatic caching of association binding attributes (the "value" side, i.e. valueAttribute in the association definition) is no longer provided. It is recommended to mark them as secondary identifiers.

The filtering of associations was changed slightly. In particular, even if the required auxiliary object class is not present for the subject, the association values are still shown - if they exist on the resource. (They were hidden before.) TODO reconsider this

"<a:indexed/>" and "<a:indexOnly/>" annotations - when present but without any value - was interpreted as "false". This was now changed to a more intuitive interpretation (similar to a:object, a:container, etc), where annotation present but without value means "true". Also, "a:container" and other markers were interpreted as "true", even if the value was actually "false". This is now fixed as well.

Years-old ref-style schema annotations like <r:identifier ref="icfs:uid"/> are no longer supported. They are not used since midPoint 2.0. If you happen to use them in your manually configured resource XSD schemas, please replace them with the supported <r:identifier>icfs:uid</r:identifier> style.

Support for getting/setting objects embedded in references marked as a:objectReference directly, like LensElementContext.getObjectOld(). This feature was used only internally by midPoint.

TODO Either bring back the support of <xsd:documentation> in resource schemas (not used by ConnId, but may be used for manually entered schemas), or document the feature drop here. === Java and REST API Changes Since 4.8

Internal APIs were massively changed with regard to passing prismContext object between methods. This object has been statically available for quite a long time. Now it was definitely removed from methods' signatures.

Likewise, the internals of prism definitions were changed in 12808d. You should not be affected by this; however, if you use some of the unofficial/undocumented APIs, please check your code.