evolveum midPoint Documentation

midPoint is an Identity Governance and Administration (IGA) platform designed for managing identity provisioning, governance, compliance, and access management. It acts as a security perimeter for both internal networks and external resources.

Core Capabilities:

• Identity Governance: Managing the lifecycle and rights of identities.
• Security & Compliance: Auditing, reporting, and entitlement management.
• Access Management: Managing organizational structures, credentials, and request approvals.
• Provisioning: Automated user provisioning and deprovisioning.
• Synchronization: Identity synchronization via liveSync, reconciliation, discovery, and import.
• Extensibility: Custom schema extensibility and support for ConnId connectors.
• Automation: Workflow-driven identity management processes and notifications.
• Integration Interfaces: Access midPoint via Local Java APIs, Remote SOAP web services, or REST APIs.

Dashboards in midPoint provide a centralized overview of critical metrics to support identity governance and administration (IGA). They allow managers to monitor compliance, track operational efficiency, and proactively respond to risks by automating data aggregation and presentation.

Key capabilities:

• Role-based customization: Create multiple dashboards tailored to different stakeholders (e.g., security officers vs. HR personnel).
• Visual alerting: Customize look and behavior, including distinct color coding to highlight warnings or non-compliant situations.
• Metric monitoring: Track counts of active employees, failed resources, suspended tasks, and more.
• Compliance integration: When combined with collection domains and policy rules (using object marks), dashboards can monitor organizational compliance and trigger warnings when actions are required.

midPoint provides several ways to select objects based on specific criteria, depending on whether you are an end-user in the GUI or a developer/engineer configuring the system:

1. Basic Search: Designed for end-users in the GUI. It allows searching by selecting values of preselected object attributes or relations. This is configurable by an engineer.
2. midPoint Query Language (MPL): The universal and recommended language for searching objects. It is used in the GUI (as Advanced Search), within configuration objects, and in Groovy scripts. It is the primary tool for querying objects in configuration and automation.
3. XML Query Language: The original querying method. It is currently deprecated. While still supported, it is recommended to switch to midPoint Query Language.
4. Full Text Search: A convenience feature available only in the GUI for searching specific data. It is not enabled by default and must be configured by an engineer. It is less powerful than midPoint Query Language.

The PostgreSQL schema is organized into logical regions. Use these categories to locate specific tables and objects:

• Infrastructure: Schema, extensions, enum types, shared identifiers, repository metadata, and support routines.
• References: Tables storing object and container references (archetype, projection, role membership, etc.).
• Focus and Users: Focus base data, users, generic objects, and focus identities.
• Roles and Services: Abstract roles, services, archetypes, policies, and applications.
• Organization: Organization objects and hierarchy closure support.
• Resources and Shadows: Resources, shadows, shadow partitions, connectors, and resource object reference data.
• System Objects: Node, system configuration, and security policy.
• Reports and Dashboards: Reports, dashboards, object collections, and forms.
• Role Analysis: Role analysis sessions, clusters, and outliers.
• Lookup Tables: Lookup table objects and key-value row data.
• Cases and Certification: Case management, access certification campaigns, and work items.
• Templates and Messages: Object templates, sequences, forms, and message templates.
• Assignments: Assignment and inducement containers and metadata.
• Tasks: Task objects, containers, and execution data.
• Simulations: Simulation result objects and event mark references.
• Marks: Mark objects for classifying repository objects and events.
• Schema Objects: Schema repository objects.
• Extension Items: Extension item catalog and indexed extension value storage.
• Schema Versioning: Procedures and metadata for tracking schema changes.

An objectTemplate is a configuration object that defines rules for how a specific object type (most commonly a user) should be constructed or updated.

Key capabilities include:

• Property Mappings: Using mappings to compute user properties (e.g., concatenating givenName and familyName into a fullName).
• RBAC Configuration: Implementing Rule-based RBAC by assigning roles to users automatically based on specific property values (e.g., organizational unit or employee type) using conditional mappings.
• Item Handling: Defining how specific items (like emailAddress) are displayed in the user interface, including setting them as emphasized so they appear even if empty.

Important Limitation: An object template operates on a single object (the target user) and only has access to that object's data. It cannot access other objects or variables like $projection.

<objectTemplate oid="c0c010c0-d34d-b33f-f00d-777222222333">
    <name>User Template CSV sync</name>
    <description>Alternative User Template Object.</description>

    <mapping>
        <description>Sets full name as concatenation of givenName and familyName.</description>
        <strength>weak</strength>
        <source>
            <path>givenName</path>
        </source>
        <source>
            <path>familyName</path>
        </source>
        <expression>
            <script>
                <code>givenName + ' ' + familyName</code>
            </script>
        </expression>
        <target>
            <path>fullName</path>
        </target>
    </mapping>

    <item>
        <ref>emailAddress</ref>
        <displayName>Email Address</displayName>
        <emphasized>true</emphasized>
    </item>
</objectTemplate>