Release 3.1 is a eleventh midPoint release code-named Sinan. The Sinan release brings new usability features and significantly improved user interface. It also improves performance, diagnostics and overall product quality.
Release date: 2nd February 2015
Majority of the work on the Sinan release was done by the Evolveum team. However, this release would not be possible without the help of our partners, customers, contributors, friends and families. We would like to express a great gratitude to all the people that contributed to the midPoint project.
We would also like to thank:
- Slovak Centre of Scientific and Technical Information for their support in developing connectors for SAS, AIX and also supporting and testing other midPoint features. We would also like to thank our partner INFOkey for their great cooperation.
- Deepak Natarajan from Axapoint for the help with testing midPoint and especially for a very valuable feedback and ideas.
- The IT professionals from Union who helped to shape midPoint by their feedback and support.
- Confluxsys for their valuable ideas and help with midPoint testing.
- AMI Praha, PosAm and Datalan for their continuous support and cooperation.
- Jason Everling for the real academic use cases testing and great feedback and improvement proposals.
- Mauro Graziosi for his contribution of a spanish translation.
- ... and many others that we regrettably cannot mention yet.
midPoint 3.1 provides following features:
- Basic user data model suitable for easy integration
- Numerous built-in properties based on IDM de-facto standards (LDAP inetOrgPerson, FOAF, ...) and experience
- Extensibility by custom properties
- Off-the-shelf support for user password credentials
- Off-the-shelf support for user activation
- Enabled/disabled states (extensible in the future)
- Support for user validity time constraints (valid from, valid to)
- Object template to define policies, default values, etc.
- Ability to use conditional mappings (e.g. to create RB-RBAC setup)
- Ability to include other object templates
- Global and resource-specific template setup
- Account provisioning (create, read, update, delete accounts)
- Enabling and disabling accounts
- Support for mapping and expressions to determine account attributes
- Support of multi-value attributes
- Processing and computation fully based on relative changes
- Multi-layer attribute access limitations
- Provisioning dependencies
- Higher-order dependencies (enables partial support for circular provisioning dependencies)
- Provisioning robustness - ability to provision to non-accessible (offline) resources
- Provisioning consistency - ability to handle provisioning errors and compensate for inconsistencies
- Support for tolerant attributes
- Ability to select tolerant and non-tolerant values using a pattern (regexp)
- Matching rules to support case insensitive attributes (extensible)
- Ability to execute scripts before/after provisioning operations
- Advanced support for account activation (enabled/disabled states)
- Standardized account activation that matches user activation schema for easy integration
- Ability to simulate activation capability if the connector does not provide it
- Support for account lock-out
- Support for account validity time constrains (valid from, valid to)
- Support easy activation existence mappings (e.g. easy configuration of "disables instead of delete" feature)
- Support for mapping time constraints in activation mappings that allow configuring time-related provisioning features such as deferred account delete or pre-provisioning.
- Ability to specify set of protected accounts that will not be affected by IDM system
- Integration of Identity Connector Framework (ConnId)
- Support for Evolveum Polygon connectors
- Support for ConnId connectors
- Support for OpenICF connectors
- Unified Connector Framework (UCF) layer to allow more provisioning frameworks in the future
- Automatic generation and caching of resource schema from the connector
- Local connector discovery
- Support for connector hosts and remote connectors, identity connector and connectors host type
- Remote connector discovery
- Web-based administration GUI (AJAX)
- Ability to execute identity management operations on users and accounts
- User-centric views
- Account-centric views (browse and search accounts directly)
- Resource wizard
- Layout automatically adapts to screen size (e.g. for mobile devices)
- Easily customizable look & feel
- Built-in XML editor for identity and configuration objects
- Flexible identity repository implementations and SQL repository implementation
- Live synchronization
- Ability to execute scripts before/after reconciliation
- Correlation and confirmation expressions
- Conditional correlation expressions
- Concept of channel that can be used to adjust synchronization behaviour in some situations
- Generic Synchronization allows synchronization of roles to groups to organizational units to ... anything
- Advanced RBAC support and flexible account assignments
- Advanced internal security mechanisms
- Fine-grained authorization model
- Delegated administration
- Several assignment enforcement modes
- Ability to specify global or resource-specific enforcement mode
- Ability to "legalize" assignment that violates the enforcement mode
- Customization expressions
- PolyString support allows automatic conversion of strings in national alphabets
- Mechanism to iteratively determine unique usernames and other identifiers
- Reporting based on Jasper Reports
- Comprehensive logging designed to aid troubleshooting
- Multi-node task manager component with HA support
- Rule-based RBAC (RB-RBAC) ability by using conditional mappings in user template
- Password policies
- Partial multi-tenancy support
- Lightweight deployment structure
- Support for Apache Tomcat web container
- Import from file and resource
- Simple handling of provisioning errors
- Protected accounts (accounts that will not be affected by midPoint)
- Segregation of Duties (SoD)
- Export objects to XML
- Enterprise class scalability (hundreds of thousands of users)
- API accessible using a web service, REST and local JAVA calls
- Workflow support (based on Activiti)
- Administration documentation publicly available in the wiki
- Architectural documentation publicly available in the wiki
- Schema documentation automatically generated from the definition (schemadoc)
Changes with respect to version 3.0
- Resource wizard.
- Improved role and organization user interface.
- Improved entitlement GUI.
- Notification support for roles and organizations.
- GUI progress indicator for provisioning operations.
- Support for account lock-out attributes. Also for lock-out attributes simulation.
- Conditional roles and assignments/inducements.
- Changes in assignment parameters are provisioned immediately, reconciliation is no longer needed.
- OID-bound mode for attributes.
- Multi-tenancy improvements in GUI.
- Generic synchronization improvements in GUI.
- Improved provisioning dependencies.
- Support for iteration in inbound expressions (object template)
- Significant performance improvement
- Improved performance of organization structure ("org closure table").
- Improved import and reconciliation performance (parallelization).
- Polygon versions of LDAP, DBTable and CSVFile connectors (see this mailing list post)
- Significantly improved paging support in LDAP connector
- Support for case-insensitive attribute names.
- Improved authorization and delegated administration support in GUI.
- Support for "priority attributes" to work around some connector problems.
- Improved reporting engine based on Jasper Reports.
- Numerous user experience improvements.
Release 3.1 (Sinan) is intended for full production use in enterprise environments. All features are stable and well tested.
MidPoint is known to work well in the following deployment environment. The following list is list of tested platforms, i.e. platforms that midPoint team or reliable partners personally tested this release. The version numbers in parentheses are the actual version numbers used for the tests. However it is very likely that midPoint will also work in similar environments. Also note that this list is not closed. MidPoint can be supported in almost any reasonably recent platform (please contact Evolveum for more details).
- OpenJDK 7 (1.7.0_65)
- Sun/Oracle Java SE Runtime Environment 7 (1.7.0_45, 1.7.0_40, 1.7.0_67, 1.7.0_72)
- Sun/Oracle Java SE Runtime Environment 8 (runtime only)
Please note that Java 6 environment is no longer supported.
- Apache Tomcat 6 (6.0.32, 6.0.33, 6.0.36)
- Apache Tomcat 7 (7.0.29, 7.0.30, 7.0.32, 7.0.47, 7.0.50)
- Apache Tomcat 8 (8.0.14)
- Sun/Oracle Glassfish 3 (3.1)
- BEA/Oracle WebLogic (12c)
- H2 (embedded, only recommended for demo deployments)
- PostgreSQL (8.4.14, 9.1, 9.2, 9.3)
Supported MySQL version is 5.6.10 and above (with MySQL JDBC ConnectorJ 5.1.23 and above).
MySQL in previous versions didn't support dates/timestamps with more accurate than second fraction precision.
- Oracle 11g (22.214.171.124.0)
- Microsoft SQL Server (2008, 2008 R2, 2012)
Following list contains platforms that midPoint is known not to work due to various issues. As these platforms are obsolete and/or marginal we have no plans to support midPoint for these platforms.
- Java 6 and older
- Sun/Oracle GlassFish 2
Download and Install
Upgrade from midPoint 2.x
Upgrade from version 2.x is possible but it is not publicly supported. It requires several manual steps. Evolveum provides this upgrade as part of the subscription or professional services.
Upgrade from midPoint 3.0
Several steps need to be executed:
- Update database schema. MidPoint database schema was extended due to organization structure performance improvements (a.k.a. "org closure table"). Execute the following script:
- Update connector namespaces and versions. The default connectors that are bundled with midPoint were migrated from OpenICF to Evolveum Polygon project (see this mailing list post). Connector bundle names and types were changed to avoid confusion. Therefore the connector types and namespaces used in the resource definitions need to be changes according to the following table:
Background and History
midPoint is roughly based on OpenIDM version 1. When compared to OpenIDM v1, midPoint code was made significantly "lighter" and provides much more sophisticated features. Although the architectural outline of OpenIDM v1 is still guiding the development of midPoint almost all the OpenIDM v1 code was rewritten. MidPoint is now based on relative changes and contains advanced identity management mechanisms such as advanced RBAC, provisioning consistency and other advanced IDM features. MidPoint development is independent for more than two years. The development pace is very rapid. Development team is small, flexible and very efficient. Contributions are welcome.
For the full project background see the midPoint History page.