Release 3.9.1 is a thirtieth midPoint release.  It is the first maintenance update for 3.9.x version family code-named Galileo. The 3.9.1 release brings release brings bugfixes and minor improvements.

Release date: 14th November 2019
End of support: 9th November 2020

Galileo Galilei (1564 - 1642) was Italian polymath. He was an astronomer, physicist and engineer. Galileo studied speed and velocity, gravity and free fall, the principle of relativity, inertia, motion, pendulums, inventing thermoscope, military compass, he is famous for using telescope for scientific observation of celestial bodies. Overall Galileo made significant achievements in many fields of human knowledge, science and technology.

Similarly to Galileo himself, the reach of midPoint 3.9 is surprisingly broad. There are significant user interface improvements, improvements to security (especially multi-tenant authorizations), major improvements to internal provisioning mechanism and a large selection of smaller improvements. There are several major improvements to the midPoint ecosystem: significant improvements to connector framework, major release of LDAP connector, new GUI testing framework, containerization improvements and so on. MidPoint 3.9 is yet another major milestone on a midPoint journey.


Majority of the work on the Watt release was done by the Evolveum team. However, this release would not be possible without the help of our partners, customers, contributors, friends and families. We would like to express our thanks to all the people that contributed to the midPoint project both by providing financial support, their own time or those that maintain a pleasant and creative environment for midPoint team. However, midPoint project would not exist without proper funding. Therefore we would like to express our deepest gratitude to all midPoint subscribers that made midPoint project possible.


midPoint 3.9 provides following features:

Changes with respect to version 3.9

Changes with respect to version 3.8

PostgreSQL 9.4 and earlier is no longer supported.
Microsoft SQL Server 2012 is no longer supported.
Tomcat 8.0.x is no longer supported (Tomcat 8.0.x is EOL).
XPath2 is no longer supported. Please migrate your XPath2 scripts to Groovy, JavaScript or Python.

Next major midPoint version is version 4.0. Major release 4.0 have introduce changes, that are not strictly compatible with midPoint 3.x. Schema elements that were deprecated for a long time or elements that were never really used were removed. Therefore this move should not affect midPoint deployments that are maintained properly. MidPoint 3.9.x includes a tool to check whether your deployment is likely to be affected by midPoint 4.0, which may give you sufficient time to prepare for 4.0 release. You can use new verify command for Ninja command-line tool to check your deployment.

MidPoint 3.9.1 is a good-bye for midPoint 3.x family. MidPoint 3 was a significant phase in midPoint lifetime. But it is time to move on. We do not plan any further midPoint 3.x releases (unless there is a severe security issue or similar critical bug). Of course, bugfixes will be backported to support branches as usual, according to support lifetime for each 3.x release. Nevertheless, we strongly recommend to upgrade all midPoint deployments to midPoint 4.0.x as soon as possible.


Release 3.9.1 (Galileo Update 1) is intended for full production use in enterprise environments. All features are stable and well tested - except the features that are explicitly marked as experimental or partially implemented. Those features are supported only with special subscription and/or professional services contract.



MidPoint is known to work well in the following deployment environment. The following list is list of tested platforms, i.e. platforms that midPoint team or reliable partners personally tested with this release. The version numbers in parentheses are the actual version numbers used for the tests.

It is very likely that midPoint will also work in similar environments. But only the versions specified below are supported as part of midPoint subscription and support programs - unless a different version is explicitly agreed in the contract.

Support for some platforms is marked as "deprecated". Support for such deprecated versions can be removed in any midPoint release. Please migrate from deprecated platforms as soon as possible.


Web Containers

Currently there are no plans to remove support for deployed midPoint installation using a WAR file. However, it is possible that this deployment form will get phased out eventually unless there are active subscribers preferring this deployment method. MidPoint subscription is strongly recommended if you plan to use this method in the future.


Supported Browsers

Recent version of browser as mentioned above means any stable stock version of the browser released in the last two years. We formally support only stock, non-customized versions of the browsers without any extensions or other add-ons. According to the experience most extensions should work fine with midPoint. However, it is not possible to test midPoint with all of them and support all of them. Therefore, if you chose to use extensions or customize the browser in any non-standard way you are doing that on your own risk. We reserve the right not to support customized web browsers.

Microsoft Internet Explorer compatibility mode is not supported.

Important Bundled Components

ConnId1.5.0.0ConnId Connector Framework
LDAP connector bundle2.0LDAP, Active Directory and eDirectory connector
CSV connector2.2Connector for CSV files
DatabaseTable connector1.4.2.0Connector for simple database tables

Download and Install

MidPoint deployment method has changed in midPoint release 3.7. Stand-alone deployment is now the default deployment method. MidPoint default configuration, scripts and almost everything else was adapted for this method.

Release Form


Install Instructions


Installing midPoint 3.9.1


From Git repository (tag "v3.9.1")

Building MidPoint From Source Code

Java API [JAR]

Schema Doc [ZIP]


MidPoint is software that is designed for easy upgradeability. We do our best to maintain strong backward compatibility of midPoint data model, configuration and system behavior. However, midPoint is also very flexible and comprehensive software system with a very rich data model. It is not humanly possible to test all the potential upgrade paths and scenarios. Also some changes in midPoint behavior are inevitable to maintain midPoint development pace. Therefore we can assure reliable midPoint upgrades only for midPoint subscribers. This section provides overall overview of the changes and upgrade procedures. Although we try to our best it is not possible to foresee all possible uses of midPoint. Therefore the information provided in this section are for information purposes only without any guarantees of completeness. In case of any doubts about upgrade or behavior changes please use services associated with midPoint subscription or purchase professional services.

Upgrade from midPoint 3.0, 3.1, 3.1.1, 3.2, 3.3, 3.3.1, 3.4, 3.4.1, 3.5, 3.5.1, 3.6, 3.6.1, 3.7, 3.7.1 and 3.7.2

Upgrade path from MidPoint 3.0 goes through midPoint 3.1, 3.1.1, 3.2, 3.3, 3.4.1, 3.5.1, 3.6.1 and 3.7.2. Upgrade to midPoint 3.1 first. Then upgrade from midPoint 3.1 to 3.1.1, from 3.1.1 to 3.2 then to 3.3, then to 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8 and finally to 3.9.

Upgrade from midPoint 3.9

Both midPoint 3.9.1 data model (schema) and database schema are compatible with midPoint 3.9. No special migration steps are needed to migrate the data. Upgrade of software packages is enough to upgrade to midPoint 3.9 to midPoint 3.9.1.

Upgrade from midPoint 3.8

MidPoint 3.9 data model is essentially backwards compatible with previous midPoint versions. However as the data model was extended in 3.9 the database schema needs to be upgraded using the usual mechanism. There were also other changes that may affect some deployments:

Changes in initial objects since 3.8

MidPoint has a built-in set of "initial objects" that it will automatically create in the database if they are not present. This includes vital objects for the system to be configured (e.g. role superuser and user administrator). These objects may change in some midPoint releases. But to be conservative and to avoid configuration overwrite midPoint does not overwrite existing objects when they are already in the database. This may result in upgrade problems if the existing object contains configuration that is no longer supported in a new version. Therefore the following list contains a summary of changes to the initial objects in this midPoint release. The complete new set of initial objects is in the config/initial-objects directory in both the source and binary distributions. Although any problems caused by the change in initial objects is unlikely to occur, the implementors are advised to review the following list and assess the impact on case-by-case basis: 

Bundled connector changes since 3.8 and 3.8.1

Behavior changes since 3.8 and 3.8.1

Public interface changes since 3.8

Important internal changes since 3.8

These changes should not influence people that use midPoint "as is". These changes should also not influence the XML/JSON/YAML-based customizations or scripting expressions that rely just on the provided library classes. These changes will influence midPoint forks and deployments that are heavily customized using the Java components.

Known Issues and Limitations

There is a support to set up storage of credentials in either encrypted or hashed form. There is also unsupported and undocumented option to turn off credential storage. This option partially works, but there may be side effects and interactions. This option is not fully supported yet. Do not use it or use it only at your own risk. It is not included in any midPoint support agreement.

Native attribute with the name of 'id' cannot be currently used in midPoint (). If the attribute name in the resource cannot be changed then the workaround is to force the use of legacy schema. In that case midPoint will use the legacy ConnId attribute names (icfs:name and icfs:uid).

JavaDoc is temporarily not available due to the issue in Java platform. This issue is fixed in Java 9 platform, but backport of this fix to Java 8 is (quite surprisingly) not planned. This should be fixed in midPoint 4.0 with Java 11 support.

As all real-world software midPoint 3.9 has some known issues. Full list of the issues is maintained in jira. As far as we know at the time of the release there was no known critical or security issue.

There is currently no plan to fix the known issues of midPoint 3.9 en masse. These issues will be fixed in future maintenance versions of midPoint only if the fix is requested by midPoint subscriber. No other issues will be fixed - except for severe security issues that may be found in the future.

The known issues of midPoint 3.9 may or may not be fixed in midPoint 4.0. This depends on the available time, issue severity and many variables that are currently difficult to predict. The only reliable way how to make sure that an issue is fixed is to purchase midPoint subscription. Or you can fix the bug yourself. MidPoint is always open to contributions.

This may seem a little bit harsh at a first sight. But there are very good reasons for this policy. And in fact it is no worse than what you get with most commercial software. We are just saying that with plain language instead of scrambling it into a legal mumbo-jumbo.

See Also