Page tree
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 24 Next »


In Progress

This release is planned. Therefore the information presented here is incomplete and inaccurate.
For information regarding the latest stable release please see Release 4.1


Release 4.2 is a TODO midPoint release code-named Maxwell. The 4.2 release brings TODO.

Planned release date: Fall 2020
Release type: Feature release
End of support: Fall 2021

James Clerk Maxwell

 James Clerk Maxwell (1831 - 1879) was TODO


Majority of the work on the Pasteur release was done by the Evolveum team. However, this release would not be possible without the help of our partners, customers, contributors, friends and families. We would like to express our thanks to all the people that contributed to the midPoint project both by providing financial support, their own time or those that maintain a pleasant and creative environment for midPoint team. However, midPoint project would not exist without proper funding. Therefore we would like to express our deepest gratitude to all midPoint subscribers that made midPoint project possible.


There are too many features in midPoint 4.2 to list them in details. The Features page lists the features of most recent midPoint release.

Changes with respect to version 4.1

New Features and Improvements

  • Major features
  • User interface improvements
    • Improved user experience of the search bar
    • "Copy environment info" button on the About page
    • Selection of columns for CSV exports
    • Audit log viewer user experience improvements
    • Minor shopping cart user experience improvements
  • Model, Provisioning and Synchronization
  • Miscellaneous improvements
    • Indestructible objects: accidental delete prevention
    • Authentication policy for node group
    • Expression profiles for GUI/report column expressions
  • Internals and Development
    • Decoupling of audit and repository databases
    • Code cleanups and dependency upgrades
    • Axiom data modeling language (experimental)
    • Data provenance metadata (experimental)

Deprecation, Feature Removal And Incompatible Changes

  • Support for all SOAP services was removed. Please use RESTful interface instead. It is still possible to create custom SOAP services in overlay projects. However, midPoint no longer includes SOAP infrastructure (Apache CXF SOAP components). Overlay authors are responsible for specifying appropriate dependencies and maintenance of their compatibility with current and future midPoint versions.
  • Use of HQL query language for audit log queries and dashboard widgets is deprecated. Please use midPoint query language instead.
  • .NET remote connector server is no longer supported.
  • Apache Tomcat 8.5 is no longer supported.
  • Use of Jasper-based reports in midPoint is deprecated in favor of the new "native" reports. Preliminary plan is to keep Jasper-based reports supported for several releases, but it is recommended to migrate the reports as soon as possible.
  • Support for Microsoft Internet Explorer is deprecated.
  • Support for MySQL and MariaDB is deprecated. Those databases will be supported for some time (possibly long time), but support for them will be eventually removed. It is strongly recommended to use PostgreSQL instead.
  • Explicit deployment to an external web container is deprecated.
  • TODO: MidPoint plug-in for Eclipse IDE was never officially supported. Despite that, it now has a deprecated status. The plan is to replace Eclipse with IntelliJ IDEA environment eventually.
  • Unofficial option to use Spring Security modules is no longer available. It was replaced by flexible authentication mechanisms.
  • Unofficial JasperSoft Studio plugin for midPoint is no longer available. There is no plan to make it available again.
  • TODO

Releases Of Other Components

  • ConnId framework was released as Evolveum release This adds support for "is null" or "not present" filters.
  • TODO: New versions of LDAP Connector and Active Directory Connector were released during the course of midPoint 4.2 development.
  • TODO: Official release of Java REST client is planned shortly after midPoint 4.2 release.
  • TODO: Overlay projects and other associated artifacts were released together with midPoint 4.2.

Purpose and Quality

Release 4.2 (Maxwell) is intended for full production use. It is a feature release, supported only for a reduced time period. Therefore it is intended for users that prefer new features over long-term stability.

All features are stable and well tested - except the features that are explicitly marked as experimental or partially implemented. Those features are supported only with special subscription contract.


Following list provides summary of limitation of this midPoint release.

  • Functionality that is marked as EXPERIMENTAL is not supported for general use (yet). Such features are not covered by midPoint support. They are supported only for those subscribers that funded the development of this feature by the means of platform subscription or for those that explicitly negotiated such support in their support contracts.
  • MidPoint comes with bundled LDAP Connector. Support for LDAP connector is included in standard midPoint support service, but there are limitations. This "bundled" support only includes operations of LDAP connector that 100% compliant with LDAP standards. Any non-standard functionality is explicitly excluded from the bundled support. We strongly recommend to explicitly negotiate support for a specific LDAP server in your midPoint support contract. Otherwise only standard LDAP functionality is covered by the support. See LDAP Connector page for more details.
  • MidPoint comes with bundled Active Directory Connector (LDAP). Support for AD connector is included in standard midPoint support service, but there are limitations. Only some versions of Active Directory deployments are supported. Basic AD operations are supported, but advanced operations may not be supported at all. The connector does not claim to be feature-complete. See Active Directory Connector (LDAP) page for more details.
  • Functionality developed in scope of midPrivacy data provenance prototype is part of this release. However, it is not considered to be production-ready and it should be considered experimental .
  • MidPoint user interface has flexible (fluid) design and it is able to adapt to various screen sizes, including screen sizes used by some mobile devices. However, midPoint administration interface is also quite complex and it would be very difficult to correctly support all midPoint functionality on very small screens. Therefore midPoint often works well on larger mobile devices (tablets) it is very likely to be problematic on small screens (mobile phones). Even though midPoint may work well on mobile devices, the support for small screens is not included in standard midPoint subscription. Partial support for small screens (e.g. only for self-service purposes) may be provided, but it has to be explicitly negotiated in a subscription contract.
  • There are several add-ons and extensions for midPoint that are not explicitly distributed with midPoint. This includes Java client library, various samples, scripts, connectors and other non-bundled items. Support for these non-bundled items is limited. Generally speaking those non-bundled items are supported only for platform subscribers and those that explicitly negotiated the support in their contract.
  • MidPoint contains a basic case management user interface. This part of midPoint user interface is not finished. The only supported part of this user interface is the part that is used to process requests and approvals. Other parts of case management user interface are considered to be experimental, especially the parts dealing with manual provisioning cases.
  • Multi-node task distribution had a limited amount of testing, due to inherent complexity of the feature. It is likely that there may be problems using this feature. We recommend not to use this feature unless it is absolutely necessary.

This list is just an overview and it may not be complete. Please see the documentation regarding detailed limitations of individual features.


MidPoint is known to work well in the following deployment environment. The following list is list of tested platforms, i.e. platforms that midPoint team or reliable partners personally tested with this release. The version numbers in parentheses are the actual version numbers used for the tests.

It is very likely that midPoint will also work in similar environments. But only the versions specified below are supported as part of midPoint subscription and support programs - unless a different version is explicitly agreed in the contract.

Support for some platforms is marked as "deprecated". Support for such deprecated versions can be removed in any midPoint release. Please migrate from deprecated platforms as soon as possible.


  • OpenJDK 11 (11.0.6). This is a recommended platform.

OpenJDK 11 is a recommended Java platform to run midPoint.

Support for Oracle builds of JDK is provided only for the period in which Oracle provides public support (free updates) for their builds. As far as we are aware, free updates for Oracle JDK 11 are no longer available. Which means that Oracle JDK 11 is not supported for MidPoint any more. MidPoint is an open source project, and as such it relies on open source components. We cannot provide support for platform that do not have public updates as we would not have access to those updates and therefore we cannot reproduce and fix issues. Use of open source OpenJDK builds with public support is recommended instead of proprietary builds.

Web Containers

MidPoint is bundled with an embedded web container. This is the default and recommended deployment option. See Stand-Alone Deployment for more details.

Apache Tomcat is supported as the only web container for midPoint. Support for no other web container is planned. Following Apache Tomcat versions are supported:

  • Apache Tomcat 9.0 (9.0.37)

Apache Tomcat 8.0.x and 8.5.x are no longer supported.

Explicit deployment to web container is DEPRECATED

Explicit deployment to an external web container was supported since the beginning of midPoint. That was the usual practice at the time when midPoint started. But that was some time ago and the world is a different place now. MidPoint supports stand-alone deployment model for several years. It is now the default and recommended deployment model. It works very well and it simplifies a lot of things. Therefore in order to simplify midPoint maintenance and support we are deprecating the explicit deployment model. Support for explicit deployment will be removed soon. Stand-alone deployment will be the only supported option in the future.


MidPoint supports several databases. However, performance characteristics and even some implementation details can change from database to database. Since midPoint 4.0, PostgreSQL is the recommended database for midPoint deployments.

  • H2 (embedded). Supported only in embedded mode. Not supported for production deployments. Only the version specifically bundled with midPoint is supported.
    H2 is intended only for development, demo and similar use cases. It is not supported for any production use. Also, upgrade of deployments based on H2 database are not supported.
  • PostgreSQL 12, 11 and 10. PostgreSQL 12 is strongly recommended option.
  • MariaDB (10.0.28) - DEPRECATED
  • MySQL 5.7 (5.7) - DEPRECATED
  • Oracle 12c
  • Microsoft SQL Server 2016 SP1

Our strategy is to officially support the latest stable version of PostgreSQL database (to the practically possible extent). PostgreSQL database is the only database with clear long-term support plan in midPoint. We make no commitments for future support of any other database engines. See Repository Database Support page for the details.

Only a direct connection from midPoint to the database engine is supported. Database and/or SQL proxies, database load balancers or any other devices (e.g. firewalls) that alter the communication are not supported.

Supported Browsers

  • Firefox
  • Safari
  • Chrome
  • Edge
  • Opera
  • Microsoft Internet Explorer (DEPRECATED)

Any recent version of the browsers is supported. That means any stable stock version of the browser released in the last two years. We formally support only stock, non-customized versions of the browsers without any extensions or other add-ons. According to the experience most extensions should work fine with midPoint. However, it is not possible to test midPoint with all of them and support all of them. Therefore, if you chose to use extensions or customize the browser in any non-standard way you are doing that on your own risk. We reserve the right not to support customized web browsers.

Microsoft Internet Explorer compatibility mode is not supported.

Important Bundled Components

Tomcat9.0.24 TODOWeb container
ConnId1.5.0.17ConnId Connector Framework
LDAP connector bundle3.0 TODOLDAP, Active Directory and eDirectory connector
CSV connector2.4 TODOConnector for CSV files
DatabaseTable connector1.4.3.0 TODOConnector for simple database tables

Download And Install


MidPoint is software that is designed for easy upgradeability. We do our best to maintain strong backward compatibility of midPoint data model, configuration and system behavior. However, midPoint is also very flexible and comprehensive software system with a very rich data model. It is not humanly possible to test all the potential upgrade paths and scenarios. Also some changes in midPoint behavior are inevitable to maintain midPoint development pace. Therefore we can assure reliable midPoint upgrades only for midPoint subscribers. This section provides overall overview of the changes and upgrade procedures. Although we try to our best it is not possible to foresee all possible uses of midPoint. Therefore the information provided in this section are for information purposes only without any guarantees of completeness. In case of any doubts about upgrade or behavior changes please use services associated with midPoint subscription or purchase professional services.

TODO: document changes needed in channels for upgrade from 4.1. Like for security policies, we had to update the channels to make to even serve login page (we are using flexible auth, modules: ldap, loginForm and httpBasic). 

Upgrade From MidPoint 4.0.x

MidPoint 4.1 data model is not completely backwards compatible with previous midPoint versions. However, vast majority of data items is compatible. Therefore the usual upgrade mechanism can be used. There are some important changes to keep in mind:

  • Version numbers of some bundled connectors have changed. Therefore connector references from the resource definitions that are using the bundled connectors need to be updated.
  • Archetypes were applied to server tasks. Archetype definitions will be imported automatically from initial objects. However, existing tasks will not be re-imported and therefore these archetypes will not be applied to tasks. Archetypes need to be applied to existing tasks manually. Archetypes does not affect core functionality of the task, therefore the tasks should still work even without the archetypes. However, archetypes are needed to utilize midPoint GUI to its full potential, therefore applying archetypes to tasks is strongly recommended.
  • Although the database schema was not changed, a minor change occurred by introducing the "incomplete" flag. You need to reindex objects that contain data that are not returned from search by default (such as jpegPhoto). It is not strictly necessary, but reindex operation is recommended to fix several issues that were present in midPoint 4.0.

Upgrade From MidPoint 3.9.x Or Older

Upgrade from midPoint 3.9.x or older is not supported directly. Please upgrade to midPoint 4.0.x first.

Changes In Initial Objects Since 4.0

MidPoint has a built-in set of "initial objects" that it will automatically create in the database if they are not present. This includes vital objects for the system to be configured (e.g. role superuser and user administrator). These objects may change in some midPoint releases. But to be conservative and to avoid configuration overwrite midPoint does not overwrite existing objects when they are already in the database. This may result in upgrade problems if the existing object contains configuration that is no longer supported in a new version. Therefore the following list contains a summary of changes to the initial objects in this midPoint release. The complete new set of initial objects is in the config/initial-objects directory in both the source and binary distributions. Although any problems caused by the change in initial objects is unlikely to occur, the implementors are advised to review the following list and assess the impact on case-by-case basis: 

  • 000-system-configuration.xml: Updated dashboard links, changes related to archetyped tasks, predefined tracing configurations.
  • 040-role-enduser.xml: End user authoriztion fix.
  • 110-report-user-list.xml: Using report.resolveLinkRefs() instead of using shadow search.
  • 1*-report-certification-*.xml: Fixed certifiation report fatal error.
  • 5*-archetype-task-*.xml: Task archetypes (new files)

Bundled connector changes since 4.0

  • LDAP ad AD connectors were upgraded to the latest available version 3.0. This is a major connector release and it brings some non-compatible changes.
    • Powershell scripting is no longer a part of AD connector. Use of Powershell is still possible by combining AD connector and Powershell connector. See Active Directory connector page for details.
    • Configuration property baseContextsToSynchronize was renamed to baseContextToSynchronize.
  • CSV connector was upgraded to the latest version.

Behavior Changes Since 4.1

  • Flexible authentication implementation was extended to cover REST service. If you already have configuration for flexible authentication, then you have to add appropriate section for REST service. In case that you are not using flexible authentication, REST service authentication will work in the same way as in midPoint 4.1.
  • TODO
  • Property publicHttpUrlPattern is used in System Configuration Object to create links in notifications. Property defaultHostname was used for this purpose before.
  • Changes in mapping evaluation ( MID-5953 - Getting issue details... STATUS , MID-6040 - Getting issue details... STATUS ).
  • Change in Users in Midpoint report. Re-import of report definition is needed ( MID-5908 - Getting issue details... STATUS ).
  • Following expression variables are still deprecated: user, account, shadow. These variables will be removed soon. Please change your script to use focus a projection variables instead.
  • Property subtype is still deprecated. It will be removed soon. Please change your configuration to use archetypes instead.

Public Interface Changes Since 4.0

  • Prism API was changes in several places. However, this is not yet stable public interface therefore the changes are are not tracked in details.
  • There were changes to the IDM Model Interface (Java). Please see source code history for details.
  • IDM Model Web Service Interface (SOAP) is deprecated. SOAP will be removed soon.

Important Internal Changes Since 4.0

These changes should not influence people that use midPoint "as is". These changes should also not influence the XML/JSON/YAML-based customizations or scripting expressions that rely just on the provided library classes. These changes will influence midPoint forks and deployments that are heavily customized using the Java components.

  • There were changes in internal code structure, most notably changes in Prism and GUI. Heavy customizations of midPoint 4.0.x may break in midPoint 4.1.

Known Issues and Limitations

As all real-world software midPoint 4.1 has some known issues. Full list of the issues is maintained in jira. As far as we know at the time of the release there was no known critical or security issue.

There is currently no plan to fix the known issues of midPoint 4.1 en masse. These issues will be fixed in future maintenance versions of midPoint only if the fix is covered by a support agreement or subscription. No other issues will be fixed - except for severe security issues that may be found in the future.

The known issues of midPoint 4.1 may or may not be fixed in following maintenance releases or in midPoint 4.2. This depends on the available time, issue severity and many variables that are currently difficult to predict. The only reliable way how to make sure that an issue is fixed is to purchase midPoint support. Or you can fix the bug yourself. MidPoint is always open to contributions.

This may seem a little bit harsh at a first sight. But there are very good reasons for this policy. And in fact it is no worse than what you get with most commercial software. We are just saying that with plain language instead of scrambling it into a legal mumbo-jumbo.

Some of the known issues are listed below:

  • There is a support to set up storage of credentials in either encrypted or hashed form. There is also unsupported and undocumented option to turn off credential storage. This option partially works, but there may be side effects and interactions. This option is not fully supported yet. Do not use it or use it only at your own risk. It is not included in any midPoint support agreement.
  • Native attribute with the name of 'id' cannot be currently used in midPoint ( MID-3872 - Getting issue details... STATUS ). If the attribute name in the resource cannot be changed then the workaround is to force the use of legacy schema. In that case midPoint will use the legacy ConnId attribute names (icfs:name and icfs:uid).


Planned release dates are just that: they are planned. We do not promise or guarantee release dates. Software development is a creative activity that includes a lot of inherent risk. We are trying really hard to provide the best estimates. We are not able to provide precise dates for releases or deliveries. Do not rely on midPoint release dates. Plan your project properly to address the risk of delayed midPoint releases.

Planned scope of midPoint releases is also an estimate. MidPoint development process always includes the balancing of the iron triangle. Therefore planned release scope may change at any time. There is a method to make sure that midPoint releases will work well for your project and that method is platform subscription.

We do not make any claims that midPoint is perfect. Quite the contrary. MidPoint is a practical software, developed by living and breathing developers and deployed in a real world. There are both known and unknown issues in midPoint. Also, midPoint is not feature-complete. New features are introduced in midPoint all the time. But not all of them are completed. There are always some limitations. As the license states, midPoint is provided "AS IS". Please do not rely on midPoint functionality that you have not tested to make sure that it works. MidPoint support and subscription programs are a way how to handle those issues. But even with support service, do not rely on functionality that is not documented. If you plan to use undocumented or non-existing functionality, platform subscription is the right service for you.

See Also

  • No labels