|repository||Interprets queries issued against repository objects.||almost all, except the ones described below|
|provisioning (connectors)||Interprets queries issued against resource objects, i.e. objects that reside on particular resources (AD, LDAP, CSV, ...).||ShadowType (some parts of them)|
|workflow engine||Interprets queries issued against work items, because they are kept in Activiti repository.||WorkItemType|
|in-memory evaluator||Interprets queries/filters issued against objects already loaded into memory. Typically used for authorization evaluation.||all|
Let us summarize main differences here.
Note that "ok" means "fully supported". "N/A" means "not applicable", i.e. not supported at all. The state is current as of midPoint 3.7.1.
|Equal||ok||Right-side items are not supported. The |
|Right-side items are not supported. Only ||Right-side items are not supported.|
|Ref||ok||N/A||Only ||ok; Additionally, there are two parameters driving the behavior of filters with null oid and targetType: |
|And, Or, Not||ok||ok||Only ||ok|
|Type||ok||N/A||N/A||supported but not much tested|
General constraint for provisioning queries: It is not possible to mix both on-resource and repository items in one query, e.g. to query for both
Filters can be created using Java API (traditional or fluent one) or via XML.