---
layout: release
release-version: '4.10.3'
---
= MidPoint 4.10 "Braille" - Update 3
:release-version: 4.10.3
:page-liquid:
:page-toc: top

Release {release-version} is a seventy-ninth midPoint release, code-named _Braille_.
The {release-version} release brings accessibility improvements and miscellaneous bug fixes.

++++
{% include release-data.html %}
++++

++++
{% capture dedicationContent %}
<p>
<a href="https://en.wikipedia.org/wiki/Louis_Braille">Louis Braille</a> (1809-1852) was a French educator.
He invented a reading and writing system named after him, intended for use by visually impaired people.
Braille invented the system at an early age, and dedicated most of his life to improve his system.
The system invented by Braille opened up the world of knowledge and learning to the visually impaired people.
</p>
<p>
Similarly to Braille's system, midPoint 4.10 brings major improvements in accessibility.
Self-service part of midPoint user interface was meticulously reviewed and improved to correctly support tools used by the visually impaired people.
Moreover, midPoint 4.10 brings many incremental improvements and new features in various areas, reminiscent of Braille's relentless improvements of his system through his life.
Overall, midPoint 4.10 opens up the world of identity management and governance to everybody.
</p>
{% endcapture %}
{% include release-dedication.html content=dedicationContent %}
++++

== Changes With Respect To Version 4.10.2

* Improved login and self-service dashboard loading speed. See bug:MID-10972[]
* Localized archetype label now correctly displays in the assignment picker and summary panel. See bug:MID-11177[]
* Fixed 10k limit in certification queries using iterative search.
    Campaigns with 10k+ cases now properly transition through their stages.
    See bug:MID-11043[]
* Improved user list load speed when listing users with `orgRelation` authorization for users managing many organizations. See bug:MID-11179[]
* Fixed duplicated "No response" option for campaign. See bug:MID-11166[]
* Fixed recipient converter while sending notification.
    All users returned by the `recipientExpression` filter now receive the notification.
    See bug:MID-11038[]
* Improved large dataset export by implementing streaming export. See bug:MID-10990[]
* Updated saved filters merging strategy to ensure multiple custom and pre-defined filters display as expected. See bug:MID-11181[]
* Upgraded libraries (Spring Boot, Wicket, Tomcat, LDAP connector, and others).
* Added option to relax email address validation on send. See bug:MID-11048[]
* Added default sort order to `AccessCertificationWorkItem` list for stable ordering between page loads. See bug:MID-11047[]
* Fixed CSV export filename missing the `.csv` extension. See bug:MID-11046[]
* Fixed authentication exception handling during the user log-in process. See bug:MID-10953[]
* Updated handling of String -> byte[]. See bug:MID-11015[]
* Implemented support for `notifyChange` REST call without explicitly providing the shadow OID. See bug:MID-11230[]
* Fixed GUI issue when requesting access to a role which the user already has assigned under a different relation. See bug:MID-10557[]
* Improved patch management of docker images, updated tagging of docker images. See https://docs.evolveum.com/midpoint/install/containers/container-image-naming/[docs].

== Changes With Respect To Version 4.10.1

* Updated libraries, mainly Spring Boot, wicket, NPM dependencies.
* Improved accessibility and usability (WCAG 2.2 AA compliance) of the self-service user interface.
* Fixed concurrency issue in iterativeScripting. See bug:MID-11058[].
* Page storage fixed for dashboard widget collection. See bug:MID-11055[].
* Fixed skip activation outbounds for unmanaged shadows. See bug:MID-11029[].
* Removed redundant ProvisioningService#getObject calls during context load. See bug:MID-11115[].
* Improve certification progress bar visibility. See bug:MID-10930[].
* Fixed admin gui configuration merging. See bug:MID-11045[]

== Changes with Respect To Version 4.10

* Fixed multiple issues connected to WCAG 2.2 requirements.
* Further fix for the Comment column behavior in the Certification items table. See bug:MID-10912[].
* Fixed session storage for Task Errors panel. See bug:MID-10975[].
* Fixed conflicts resolving in Request Access flow. See bug:MID-11001[].
* Fixed Duplicate action for certification definitions. See bug:MID-10456[].
* Fixed translation of the orig value of the poly string in case it is defined in the DisplayType label, help, tooltip etc. See bug:MID-10996[].
* Fixed export of the object/taget display name columns in the Certification items table. See bug:MID-10873[].
* Fixed translation of the left menu items for collection views. See bug:MID-10998[].
* Fixed SchemaType objects loading to prism context. See bug:MID-10983[].
* Fixed visibility of the create report button.
* Fixed report data object name and export file name to be unique. See bug:MID-10978[].
* Fixed searching by stage deadline in the Certification cases table. See bug:MID-11023[].
* Fixed ConcurrentModificationException in RelationUtil. See bug:MID-10940[].
* Fixed an issue where submitting a certification decision was possible after the stage deadline had passed. See bug:MID-11028[].
* Fixed the import report file name to be a generated UUID. See bug:MID-11014[].
* Fixed certification case stage outcome information. See bug:MID-11026[].
* Fixed searching for changed item path. See bug:MID-10985[].
* Fixed rendering of the delta when changed item is a container. See bug:MID-10984[].
* Fixed shadow attributes/id parsing exception. See bug:MID-10944[].
* Updated spring boot to 3.5.8.
* bug:MID-10997[] Added support for additional footer.

== Changes With Respect To Version 4.9

=== New Features and Major Improvements

* Self-service user interface is now very close to WCAG 2.2 AA compliance.
* Implemented multiple improvements related to background tasks:
** Better indication for failed tasks and their subtasks. See bug:MID-10410[].
** Configurable xrefv:/midpoint/reference/master/tasks/activity-policies/[policies] for executing activities. See bug:MID-10412[].
** Better xrefv:/midpoint/reference/master/tasks/task-errors/[search for errors] in task run history. See bug:MID-10411[].
* Added xrefv:/midpoint/reference/master/admin-gui/dashboards/compliance-dashboard/[Compliance dashboard].
* Improved expression security:
** Added xrefv:/midpoint/reference/master/expressions/expressions/filter/[Filter expression evaluator]. See bug:MID-10060[].
** Improved `safe` expression profile in default system configuration.
** Recommended xref:/midpoint/reference/expressions/expressions/security/[_semi-safe_ configuration of expression profiles] to provide reasonable level of xref:/midpoint/reference/expressions/expressions/security/[expression security] for some delegated administration scenarios.
* Improved ways to report audit delta in GUI and reports using xrefv:/midpoint/reference/master/security/audit/#improving-search-capabilities-for-changed-item-paths-in-audit-records[changed item paths].
Improved indexing of audit records with "add object" deltas.
See bug:MID-10413[].
* Added xrefv:/midpoint/reference/support-4.10/resources/resource-configuration/capabilities/#last-login-timestamp-capability[`lastLoginTimestamp` capability]. See bug:MID-10147[].
* Implemented xrefv:/midpoint/reference/master/admin-gui/admin-gui-config/#_default_gui_object_list_panel_configuration/[Default List View Panel Configuration] which brings a possibility to set the common paging options for list panels. See bug:MID-10414[].

=== Other Improvements

* Summary panel for roles now uses display name and identifier (same as for organizations and services). See bug:MID-10270[].
* Task execution constraints added to "advanced options" tab. See bug:MID-10218[].
* Removed max password length constraint from default password policy. See bug:MID-10305[].
* Added support for exclusion of metadata in `get`/`search` rest APIs. See bug:MID-10216[].
* StartupConfiguration incorporates `midpoint.` properties from Spring environment sources.
* Implemented xrefv:/midpoint/reference/support-4.9/resources/attribute-caching/#_caching_passwords[shadow password caching], with the possibility of storing them in reversible encrypted form.
* Improved handling of xrefv:/midpoint/reference/support-4.9/resources/resource-configuration/schema-handling/volatility/[volatile shadow attributes].
* Update GUI views after changing of the archetype, that is used in the view. See bug:MID-9776[].
* Adding support for PKCE (Proof Key for Code Exchange) as additional security for OIDC authentication module. See bug:MID-10155[].
* Adding new configuration attribute for OIDC authentication module, that is used for ID Token signing algorithm. See xref:/midpoint/reference/security/authentication/flexible-authentication/modules/oidc/[Oidc Module].
* Apply the Web Content Accessibility Guidelines (WCAG) to all login pages and self-service pages. See bug:MID-9847[].
** Used 'honeypot' instead of captcha on self-registration and post-authentication pages to protect against spam bots.
* Improved the documentation on the resource configuration. See bug:MID-10176[].
* Allow volatility configuration per mapping through the Resource Wizard. See bug:MID-10170[].
* Change the CSS style of sub-containers in the vertical form panel to create a new object for reference. See bug:MID-10030[].
* Documentation of xref:/midpoint/reference/resources/shadow/purpose/[shadow purpose] was added. See bug:MID-10419[].
* Some policy rule constraints allow to the `targetArchetypeRef` to specify objects by archetype. See bug:MID-10647[].
* Assignment modification constraint of policy rules allows specification of scope.
This can be used for approval of indirect role assignments and similar cases. See bug:MID-10663[].
* There are two new functions in midPoint function library for access to "governance" users (approvers/owners): `getRoleMemberUsers`, `getServiceMemberUsers`.
* Use delta's "visualizer" used by GUI also in notifications and other improvements in notifications. See bug:MID-6112[], bug:MID-10633[], bug:MID-10632[], bug:MID-10635[], bug:MID-10372[], bug:MID-10634[], bug:MID-10636[].
* Built-in archetypes for organizational structures and locations.
* xrefv:/midpoint/reference/master/roles-policies/policies/identity-governance-rules/[Compliance-related] marks (no classification, unowned, privileged access), object collections and policies.
* xrefv:/midpoint/reference/master/roles-policies/policies/privileged-access/[`Privileged access` classification] automatically sets `Privileged access` mark for directly affected roles and users.
* Updated various libraries, mainly: Spring Boot, Tomcat, PostgresSQL JDBC driver.
* Add OAuth 2 credential flow to mail servers notification configuration
* Added languages, specifically Korean, Dutch, and Ukrainian.
* Removed support for deprecated generic repository implementation (Oracle, SQL Server). See bug:MID-10866[].
* Date time picker now can use `adminGuiConfiguration/displayFormats/longDateTimeFormat`setting if available.
* Using private schema in PostgresSQL instead of the public schema. See bug:MID-9300[].

=== Major Bugfixes

* bug:MID-10213[] Fix synchronization of large number of tasks (>10 000).
* bug:MID-10204[] Fix error during preview of changes.
* bug:MID-10319[] Fixed incorrect error message displayed when performing "Unlock" action on user list page.
* bug:MID-10317[] Fixed missing message when user disable fails.
* bug:MID-10320[] Fixed ninja zip option used during export/import.
* bug:MID-10048[] Fix ClassCastException when creating duplicates of object types with new archetype
* bug:MID-10278[] Fix non-clickable part of a button in Edit Schema popup panel.
* bug:MID-10513[] Fixed css issues with popup modal background in Safari.
* bug:MID-10496[] Fixed issue of task not starting at next scheduled time.

=== Other Bug Fixes

* Fixed boolean column values for Quartz tables in Oracle 23 - "Quartz broken after DB upgrade". See bug:MID-10715[].
* Fixed "Couldn't get assignments conflicts" error occurring during Request access. See bug:MID-10124[].
* Fixed "No definition for item ... in outbound mapping for association" error. See bug:MID-10214[].
* Fixed the issue with policy rules `minAssignees`/`maxAssignees` not being triggered. See bug:MID-9869[].
* Fixed retrieving referenced objects with their own references when caching is enabled. See bug:MID-10271[].
* Fixed inconsistent behaviour for `deleted` situation in combination with `deleteFocus` reaction. See bug:MID-10195[].
* Fixed midPoint freezing when shadow partitioning, referenced objects, and shadow caching was used. See bug:MID-10231[].
* Added support for removing "dangling" non-tolerant reference attribute values (i.e., those that do not match any association). See bug:MID-10285[].
* Changes in default shadow caching policy are now correctly applied, without requiring any action on the user side. See bug:MID-10126[].
* Fixed `NullPointerException` occurring in mappings when the source reference value pointed to non-existing object. See bug:MID-10162[].
* "Native references" capability is now correctly shown in GUI. See bug:MID-10194[].
* Fixed handling of multi-valued resource configuration properties defined using `const` expression. See the last comment in bug:MID-7918[].
* Fixed repeated modifications of objects when manually attached object marks were used. See bug:MID-10121[].
* Fixed preview changes when auto-assigned roles with approvals were used. See bug:MID-10345[].
* Stopped generating passwords with "problematic" characters, like comma, apostrophe, ampersand, and so on.
Now it's possible to define characters that are accepted in the password, but not used when generating a new password value.
The default password policy was updated in this regard.
See bug:MID-9541[] and the xref:/midpoint/reference/security/credentials/password-policy/#_ignoreWhenGenerating[docs].
* Stopped displaying some shadow operational properties (like the synchronization timestamp, iteration, and so on) among changes in simulation results.
See bug:MID-9737[] and bug:MID-9986[].
* Midpoint Query Language Fixed inconsistent whitespace behavior when using `not` filter, modified grammar of query language. See bug:MID-9351[].
* Fixed code completions & validation for @metadata language concept in Midpoint Query language. See bug:MID-10324[].
* Fixed problem with handling syntax error in Midpoint Query Language. See bug:MID-8196[] and bug:MID-9585[].
* Fixed removal of the shadow transition mark in the mark table panel. See bug:MID-10228[].
* Fixed refresh names, help texts and search items for all saved search configurations. See bug:MID-10321[].
* Fixed phantom changes when displaying an existing object type in the resource wizard. See bug:MID-10284[].
* Added a popup to create a new item for the Schema Extension panel. See bug:MID-10283[].
* Harmonize the design of the mapping table panel for object template and resource object type mapping. See bug:MID-10291[].
* Removed the use of page parameters for view collection in popup tables. See bug:MID-10254[].
* Fixed display of row without object name for Task Errors panel. See bug:MID-10354[].
* Fixed the display of the 'User Dashboard Links' panel in the System Configuration panel. See bug:MID-10133[].
* Fixed the object class name column in the Resource Details panel. See bug:MID-10005[].
* Fixed saving of audit record with malformed username as parameter during login (User-Enumeration attack). See bug:MID-10383[].
* Add a save button to the wizard's table of object and association types. See bug:MID-10046[].
* Add an error message when the 'securityQuestionsForm' authentication module is the first in the authentication sequence. See bug:MID-10149[].
* bug:MID-10225[] Fix issue where opening of certification campaign stage hangs indefinitely.
* Fixed "preview changes" and "access request" functionality when some projections are hidden by authorizations. See bug:MID-10397[].
* bug:MID-10739[] Use SecureRandom instead of Random.
* Fixed different certification bugs. See bug:MID-10208[], bug:MID-10190[], bug:MID-10134[], bug:MID-10262[], bug:MID-10261[], bug:MID-10373[], bug:MID-10376[], bug:MID-10469[], bug:MID-10520[] and others.
* Fixed organizations list display bug. See bug:MID-10150[].
* Fixed the icon for Case type objects that was not displayed. See bug:MID-10164[].
* Fixed the issue with date field update. See bug:MID-10107[].
* Fixed the issue with wrong redirection after unassigning the object. See bug:MID-10151[].
* Fixed the issue with displaying Service type objects in the role catalog. See bug:MID-10206[].
* Password policy checks are being applied to an extension attribute of the ProtectedStringType. See bug:MID-10129[].
* Fixed empty required fields validation in UI in case the parent container is empty. See bug:MID-10210[].
* Fixed the issue with password policy check popover. See bug:MID-10128[].
* Fixed the sorting of the organisation tree in the Role catalog (from now, sorted by display name). See bug:MID-10246[].
* Fixed filtering of the work items in UI. See bug:MID-10167[].
* Fixed input string validation in the Flexible Authentication module. See bug:MID-10123[].
* Fixed the displaying of the historical user data. See bug:MID-10153[].
* Fixed error in logs during the work in the resource wizard. See bug:MID-10233[].
* Hided password strength bar for the protected string panel. See bug:MID-10129[].
* Fixed the error while creating new application service object with manager. See bug:MID-10277[].
* Fixed the error during self password update. See bug:MID-10316[].
* Fixed the usage of the MidpointFormValidator during object updates. See bug:MID-10127[].
* Fixed authorization check in GUI by using EndPointsUrlMapping actions check. See bug:MID-10336[].
* Fixed the displaying of the Policy rule panel. See bug:MID-10343[].
* Fixed the issue with duplicated error message displaying on the Repository objects page. See bug:MID-10344[].
* Made authorization error message more user-friendly. See bug:MID-10206[].
* Fixed default panels configuration of the details pages for start campaign and reiterate campaign tasks. See bug:MID-10205[].
* Fixed error on the Task Internal performance panel. See bug:MID-10445[].
* Fixed error on the task details page. See bug:MID-10395[].
* Fixed defaultAssignmentConstraints configuration usage during Request Access. See bug:MID-10425[].
* Fixed Person of interests step in Access Request to take into account objects filter and to analyze more carefully changing the persons of interest. See bug:MID-10398[].
* Fixed changing the mark for user object. See bug:MID-10423[].
* Fixed session storage for Cases table. See bug:MID-10473[].
* Fixed the issue with the displaying the value of the work item Name column. See bug:MID-10427[].
* Fixed the issue with dashboard resource widget. See bug:MID-10497[].
* Fixed the sorting of the first column in the collection view table. See bug:MID-10486[].
* Removed the button for credentials change on the Password panel of the object details page to be hidden without proper authorization. See bug:MID-10507[].
* Fixed error when setting read permission with filter on ReportDataType. See bug:MID-10498[].
* Fixed localization error while changing the password. See bug:MID-10471[].
* Fixed the accumulation of the authentication attempts. See bug:MID-10502[].
* Fixed loading the fresh user object on the Self Service Credentials page. See bug:MID-10544[].
* Fixed saving schema extension. See bug:MID-10437[].
* Fixed creation of the new generic PolicyType. See bug:MID-10463[].
* Fixed Access Request checkout step when validity is set to mandatory. See bug:MID-10459[].
* Fixed import object with ObjectReferenceType extension attribute. See bug:MID-10503[].
* Fixed deny rule for task delete operation. See bug:MID-10625[].
* Fixed setting of the assignment subtype. See bug:MID-10624[].
* Fixed sorting in the All Tasks table. See bug:MID-10640[].
* Fixed incorrect message while approving a work item. See bug:MID-10629[].
* Fixed Reconciliation report running. See bug:MID-10436[].
* Fixed displaying the list of the application classifications. See bug:MID-10638[].
* Fixed Object collection search item visibility on object list pages. See bug:MID-10648[].
* Fixed mark (*) visibility on the custom forms. See bug:MID-10656[].
* Fixed manual unlock of the user. See bug:MID-9856[].
* Improved the message on the mail nonce module panel during Reset password flow. See bug:MID-10679[].
* Fixed case details page displaying. See bug:MID-10690[].
* Fixed schema fetch error. See bug:MID-10665[].
* Connid version was upgraded to 1.6.0.0. See bug:MID-10552[].
* Fixed the error during saving the extension schema if there is ObjectReferenceType item. See bug:MID-10693[].
* Fixed the search with upper case letters on the Projections panel. See bug:MID-10713[].
* Fixed the initialization process of resource connector capabilities. See bug:MID-10644[], bug:MID-10676[].
* Fixed the usage and application of the archetype filter within authentication definition. See bug:MID-10683[].
* Fixed the reflexion of the custom system name on different pages. See bug:MID-10696[].
* Fixed the query for the certification items while loading self dashboard page. See bug:MID-10753[].
* Refactored container properties panel (e.g. object details page) not to wrap each property value field into a form.
This reduced the number of the csrf fields which is sent by request after the form submitting.
Also, increased the size of the http request header size to cope with big headers.
*Important*: be aware of overriding total request size (e.g. header size or multipart parts) in your environment in case of using custom settings (e.g. in custom application.yml or through JVM arguments).
The recommended values are: max-part-header-size: 768; max-part-count: 100.
See bug:MID-10748[].
* Extended multi-parts request configuration for AJP server.
It is possible to set custom max-part-header-size and max-part-count properties to AJP connector in application.yml.
If no multi-parts request configuration is set for AJP server, these properties will be taken from Tomcat server configuration.
See bug:MID-10824[].
* Fixed "Select all" functionality in the assignment restriction popup while creating a delegation. See bug:MID-10757[].
* Fixed loading and displaying the data on the Errors panel of the Task page. See bug:MID-10682[].
* Fixed NPE on the Internals configuration page. See bug:MID-10749[].
* Fixed "Matching rule" dropdown in Attribute override settings. See bug:MID-10710[].
* Fixed 500 error while creating an application role with a lack of permission. See bug:MID-10778[].
* Fixed intent dropdown on Accounts/Entitlements page to persist after navigation . See bug:MID-10697[].
* Fixed default sort property for "My requests" widget on Self Dashboard page. See bug:MID-10772[].
* Fixed authorization re-initialization during CompiledGuiProfile refresh functionality.
Authorizations list is wrapped into atomic reference in order to avoid calls to cleaned up authorizations list while refreshing the principal.
See bug:MID-10781[].
* Fixed inconsistent type of input variable after passing ObjectTemplate validation. See bug:MID-10773[].
* Fixed the possibility to modify the filter in the marking rule. See bug:MID-10405[].
* Fixed the title for the edit button on the reference autocomplete panel. See bug:MID-10807[].
* Fixed filter configuration panel on the Object collection details page.
The behavior of the filter configuration panel was changed to switch automatically to midPoint query (from xml query if was defined before) after filter configuration popup was used and configuration changes were confirmed there.
See bug:MID-10800[].
* Fixed the icon and missing description for object mark icons assignments. See bug:MID-10255[].
* Fixed resolving of the object reference while report preview. See bug:MID-9632[].
* Improved displaying of the container header while delta visualization. See bug:MID-10630[].
* Fixed mouse hover tooltip in object reference selection menu. See bug:MID-10807[].
* Fixed authorization check for the objects displayed in GUI during approval process. See bug:MID-10232[].
* Removed unnecessary blank row from Certification items export dialog. See bug:MID-10809[].
* Fixed name and display name columns' values on the Certification items page. See bug:MID-10806[].
* Fixed full-text search in the role catalog. See bug:MID-10819[].
* Fixed case-insensitive search for shadow association definitions. See bug:MID-10477[].
* Improved the time of the certification items list processing (e.g. during cert. items report creating or during displaying in the GUI). See bug:MID-10811[], bug:MID-10812[].
* Fixed some bugs in the Role mining GUI. See bug:MID-10842[].
* Fixed the error while creating a new resource as a copy of the template resource. See bug:MID-10476[].
* Fixed the relation dependent behavior while adding an item into shopping cart. See bug:MID-10851[].
* Fixed the extension attribute update behavior within Shopping cart step in the Request access wizard. See bug:MID-10861[].
* Fixed _allowToConfigureSearchItems_ configuration usage on the search panel. See bug:MID-10883[].
* Fixed style issue on the task summary panel. See bug:MID-10884[].
* Fixed reloading of the certification (responses) statistics model. See bug:MID-10882[].
* Fixed Back button behavior from the Certification items page. See bug:MID-10879[].
* Improved exception handling while parsing incorrect filter on the search panel.
From now,  if the user selects the filter saved for Advanced mode, and this filter has xml query configured instead of midPoint query, midPoint will parse such a (correct xml) query and apply it to the search.
Warning message that the filter should be reconfigured with a midPoint (Advanced) query will be displayed on the panel.
If the xml query cannot be parsed, the error message will be shown on the page. See bug:MID-10876[].
* Fixed creating an object with <dummy> tag. See bug:MID-10853[].
* Fixed visibility of the Certification items table in case there is only one row on the Self Dashboard page.
Previously, the implementation didn't show table's row in case there was only one active campaign.
It was decided that even one row can be informative for the user so that the user sees the name of the campaign from the Dashboard page, also sees its deadline and progress.
Therefore, the visibility for the Certification items table was changed from false to true in case of just one row in the table.
See bug:MID-10889[].
* Fixed _runPrivileged_ configuration usage for scripting policy actions. See bug:MID-10820[].
* Upgraded chartjs version to 0.6.
* Fixed slow authentication issue. See bug:MID-10885[].
* Fixed global policy rules not being triggered under some circumstances, see bug:MID-10779[].
* Updated dependencies, mainly spring boot (3.5.6), removed wss4j.
* Improved pre upgrade check for node version in ninja, bug:MID-10829[].
* Fixed projection not deleted when lifecycleState is set to `archived`. See bug:MID-10813[].
* Optimized repeated logins for policy scripting rules, bug:MID-10864[].
* Fixed missing messages for "More..." items in Access Certification search boxes. See bug:MID-10898[].
* Improved campaign operation button behavior not to start campaign action while running previous action task. See bug:MID-10897[].
* Fixed startTimestamp filter on campaign list page. See bug:MID-10900[].
* Fixed campaigns filtering by created timestamp.
Create metadata were added to campaign object while its creation. See bug:MID-10901[].
* Fixed datetime filter clear function in search box. See bug:MID-10899[].
* Fixed pie chart style on the Certification items page. See bug:MID-10916[].
* Current reviewers now displayed even for closed case items. See bug:MID-10935[].
* Unable to display report preview fixed. See bug:MID-10929[].
* Fixed shopping cart icon number does not decrease when resolving conflicts. See bug:MID-10925[].
* Fixed first and last links enable behavior on paging panel. See bug:MID-10945[].
* Fixed creating a duplicated container value while adding new value. See bug:MID-10926[].
* Fixed saving and displaying of the policy actions empty containers. See bug:MID-10928[].
* Fixed displaying of the certification campaign deadline value for Reviewer role. See bug:MID-10931[].
* Fixed displaying of the warning messages on the Shopping cart page. See bug:MID-10924[].
* Fixed behavior of Comment column in the Certification items table. See bug:MID-10912[].
* Improved loading time for Certification items and Campaigns tables. See bug:MID-10887[].
* Fixed "all tasks running" message. See bug:MID-10958[].
* Fixed displaying some approved and executed changes as "Waiting to be applied". See bug:MID-10828[].
* No longer evaluating timed actions on cancelled cases. See bug:MID-10934[].

=== Releases Of Other Components

* New version (1.5.2.0) of xref:/connectors/connectors/org.identityconnectors.databasetable.DatabaseTableConnector/[DatabaseTable Connector] was released and bundled with midPoint. The connector suggest all names of columns for configuration properties related with name of column.

* New version (2.8) of xref:/connectors/connectors/com.evolveum.polygon.connector.csv.CsvConnector/[CSV Connector] was released and bundled with midPoint. The connector suggest all names of columns for configuration properties related with name of column.
** Fixed NPE with multivalue attributes when delimiter is not defined. (bug:MID-8609[]).
** Fix UTF-8 BOM character in csv file during of discovery functions. (bug:MID-9497[] and bug:MID-9498[]).

* New version (3.8) of xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.LdapConnector/[AD/LDAP Connector] was released and bundled with midPoint. The connector suggest all names of columns for configuration properties related with name of column.
** Native association support.
** Possibility to choose attributes that should not be returned by default.
** Possibility to choose to encode string values in case of the presence of non standard ASCII characters.
** Workaround for open-ldap mandatory member attribute.
** Possibility to specify used auxiliary object classes in connector configuration.
** Allow to send the LDAP_DIRSYNC_OBJECT_SECURITY flag in Active Directory sync request control.

++++
{% include release-quality.html %}
++++

=== Limitations

Following list provides summary of limitation of this midPoint release.

* Functionality that is marked as xref:/midpoint/versioning/experimental/[Experimental Functionality] is not supported for general use (yet).
Such features are not covered by midPoint support.
They are supported only for those subscribers that funded the development of this feature by the means of
xref:/support/subscription-sponsoring/[subscriptions and sponsoring] or for those that explicitly negotiated such support in their support contracts.

* MidPoint comes with bundled xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.LdapConnector/[LDAP Connector].
Support for LDAP connector is included in standard midPoint support service, but there are limitations.
This "bundled" support only includes operations of LDAP connector that 100% compliant with LDAP standards.
Any non-standard functionality is explicitly excluded from the bundled support.
We strongly recommend to explicitly negotiate support for a specific LDAP server in your midPoint support contract.
Otherwise, only standard LDAP functionality is covered by the support.
See xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.LdapConnector/[LDAP Connector] page for more details.

* MidPoint comes with bundled xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.ad.AdLdapConnector/[Active Directory Connector (LDAP)].
Support for AD connector is included in standard midPoint support service, but there are limitations.
Only some versions of Active Directory deployments are supported.
Basic AD operations are supported, but advanced operations may not be supported at all.
The connector does not claim to be feature-complete.
See xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.ad.AdLdapConnector/[Active Directory Connector (LDAP)] page for more details.

* MidPoint user interface has flexible (responsive) design, it is able to adapt to various screen sizes, including screen sizes used by some mobile devices.
However, midPoint administration interface is also quite complex, and it would be very difficult to correctly support all midPoint functionality on very small screens.
Therefore, midPoint often works well on larger mobile devices (tablets), but it is very likely to be problematic on small screens (mobile phones).
Even though midPoint may work well on mobile devices, the support for small screens is not included in standard midPoint subscription.
Partial support for small screens (e.g. only for self-service purposes) may be provided, but it has to be explicitly negotiated in a subscription contract.

* There are several add-ons and extensions for midPoint that are not explicitly distributed with midPoint.
This includes xrefv:/midpoint/reference/support-4.9/interfaces/midpoint-client-java/[Java client library],
various https://github.com/Evolveum/midpoint-samples[samples], scripts, connectors and other non-bundled items.
Support for these non-bundled items is limited.
Generally speaking, those non-bundled items are supported only for platform subscribers and those that explicitly negotiated the support in their contract.

* MidPoint contains a basic case management user interface.
This part of midPoint user interface is not finished.
The only supported parts of this user interface are those that are used to process requests, approvals, and manual correlation.
Other parts of case management user interface are considered to be experimental, especially the parts dealing with manual provisioning cases.

This list is just an overview, it may not be complete.
Please see the documentation regarding detailed limitations of individual features.

== Platforms

MidPoint is known to work well in the following deployment environment.
The following list is list of *tested* platforms, i.e. platforms that midPoint team or reliable partners personally tested with this release.
The version numbers in parentheses are the actual version numbers used for the tests.

It is very likely that midPoint will also work in similar environments.
But only the versions specified below are supported as part of midPoint subscription and support programs - unless a different version is explicitly agreed in the contract.

=== Operating System

MidPoint is likely to work on any operating system that supports the Java platform.
However, for *production deployment*, only some operating systems are supported:

* Linux (x86_64)
* Windows Server (2022)

We are positive that midPoint can be successfully installed on other operating systems, especially macOS and Microsoft Windows desktop.
Such installations can be used to for evaluation, demonstration or development purposes.
However, we do not support these operating systems for production environments.
The tooling for production use is not maintained, such as various run control (start/stop) scripts, low-level administration and migration tools, backup and recovery support and so on.
Please see xref:/midpoint/install/bare-installation/platform-support/[] for details.

Note that production deployments in Windows environments are supported only for LTS releases.

=== Java

Following Java platform versions are supported:

* Java 21.
This is a *recommended* platform.

* Java 17.

OpenJDK 21 is the recommended Java platform to run midPoint.

Support for Oracle builds of JDK is provided only for the period in which Oracle provides public support (free updates) for their builds.

MidPoint is an open source project, and as such it relies on open source components.
We cannot provide support for platform that do not have public updates as we would not have access to those updates, and therefore we cannot reproduce and fix issues.
Use of open source OpenJDK builds with public support is recommended instead of proprietary builds.

=== Databases

*PostgreSQL is the only supported database* for midPoint deployments since 4.10.

Although in previous versions of midPoint other databases were supported using object-relational mapping abstraction (Hibernate), it is no longer the case now.
xrefv:/midpoint/reference/support-4.9/repository/native-postgresql/[Native PostgreSQL repository implementation] was developed and tuned specially for PostgreSQL database, taking advantage of native database features, providing improved performance and scalability.
It is currently the only option.

Our strategy is to officially support the latest stable version of PostgreSQL database (to the practically possible extent).
We make no commitments for future support of any other database engines.
See xrefv:/midpoint/reference/support-4.9/repository/repository-database-support/[] page for the details.

Only a direct connection from midPoint to the database engine is supported.
Database and/or SQL proxies, database load balancers or any other devices (e.g. firewalls) that alter the communication are not supported.

Following database engines are supported:

* PostgreSQL 17, 16, 15, 14

PostgreSQL 17 is recommended.

=== Supported Browsers

* Firefox
* Safari
* Chrome
* Edge
* Opera

Any recent version of the browsers is supported.
That means any stable stock version of the browser released in the last two years.
We formally support only stock, non-customized versions of the browsers without any extensions or other add-ons.
According to the experience most extensions should work fine with midPoint.
However, it is not possible to test midPoint with all of them and support all of them.
Therefore, if you chose to use extensions or customize the browser in any non-standard way you are doing that on your own risk.
We reserve the right not to support customized web browsers.

== Important Bundled Components

.Important bundled components
[%autowidth]
|===
| Component | Version | Description

| Tomcat
| 10.1.48
| Web container

| ConnId
| 1.6.0.0
| ConnId Connector Framework

| xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.LdapConnector/[LDAP connector bundle]
| 3.9.2
| LDAP and Active Directory

| xref:/connectors/connectors/com.evolveum.polygon.connector.csv.CsvConnector/[CSV connector]
| 2.9
| Connector for CSV files

| xref:/connectors/connectors/org.identityconnectors.databasetable.DatabaseTableConnector/[DatabaseTable connector]
| 1.5.3.0
| Connector for simple database tables

|===

++++
{% include release-download.html %}
++++

== Upgrade

MidPoint is a software designed with easy upgradeability in mind.
We do our best to maintain strong backward compatibility of midPoint data model, configuration and system behavior.
However, midPoint is also very flexible and comprehensive software system with a very rich data model.
It is not humanly possible to test all the potential upgrade paths and scenarios.
Also, some changes in midPoint behavior are inevitable to maintain midPoint development pace.
Therefore, there may be some manual actions and configuration changes that need to be done during upgrades,
mostly related to xref:/midpoint/versioning/feature-lifecycle/[feature lifecycle].

This section provides overall overview of the changes and upgrade procedures.
Although we try to our best, it is not possible to foresee all possible uses of midPoint.
Therefore, the information provided in this section are for information purposes only without any guarantees of completeness.
In case of any doubts about upgrade or behavior changes please use services associated with xref:/support/subscription-sponsoring/[midPoint subscription programs].

Please refer to the xrefv:/midpoint/reference/support-4.9/upgrade/upgrade-guide/[] for general instructions and description of the upgrade process.
The guide describes the steps applicable for upgrades of all midPoint releases.
Following sections provide details regarding release {release-version}.

=== Upgrade from MidPoint 4.10.x

MidPoint {release-version} data model is completely backwards compatible with midPoint 4.10.

Please follow our xrefv:/midpoint/reference/support-4.10/upgrade/upgrade-guide/[Upgrade guide] carefully.

Note that:

* There are no database schema changes.
* There are minor changes in the initial objects, system configuration localization keys.

=== Upgrade From MidPoint 4.9

MidPoint {release-version} data model is backwards compatible with previous midPoint version.
Please follow our xrefv:/midpoint/reference/support-4.9/upgrade/upgrade-guide/[Upgrade guide] carefully.

[IMPORTANT]
Be sure to be on the latest maintenance version for 4.9, otherwise you will not be warned about all the necessary schema changes and other possible incompatibilities.

Note that:

 * There are database schema changes (see xrefv:/midpoint/reference/support-4.9/upgrade/database-schema-upgrade/[Database schema upgrade]).

 * Version numbers of some bundled connectors have changed.
 Connector references from the resource definitions that are using the bundled connectors need to be updated.

 * See also the _Actions required_ information below.

=== Upgrade From Other MidPoint Versions

Upgrade from midPoint versions other than 4.9.x to midPoint {release-version} is not supported directly.
Please upgrade to 4.9.5 first.

=== Deprecation, Feature Removal And Major Incompatible Changes Since 4.9

NOTE: This section is relevant to the majority of midPoint deployments.
It refers to the most significant functionality removals and changes in this version.

The support for databases other than PostgreSQL was dropped.

=== Changes In Initial Objects Since 4.9

NOTE: This section is relevant to the majority of midPoint deployments.

MidPoint has a built-in set of "initial objects" that it will automatically create in the database if they are not present.
This includes vital objects for the system to be configured (e.g., the role `Superuser` and the user `administrator`).
These objects may change in some midPoint releases.
However, midPoint is conservative and avoids overwriting customized configuration objects.
Therefore, midPoint does not overwrite existing objects when they are already in the database.
This may result in upgrade problems if the existing object contains configuration that is no longer supported in a new version.

The following list contains a description of changes to the initial objects in this midPoint release.
The complete new set of initial objects is in the `config/initial-objects` directory in both the source and binary distributions.

_Actions required:_ Please review the changes and apply them appropriately to your configuration. Ninja can help with updating existing initial objects during upgrade procedure using `initial-objects` command.
For more information see xrefv:/midpoint/reference/support-4.9/deployment/ninja/use-case/upgrade-with-ninja/#initial-objects[here].

* 000-system-configuration.xml: improved `safe` expression profile, added `permissive` and `prohobitive` profiles, renamed `script-safe` to `script-limited` permission profile, added possibility for configuration of volatility of attribute in resource wizard, added task execution constraints to advanced options tab, updated default paging options, made operation execution recording a regular feature, extended with compliance dashboard, improving `help` attribute values.
* 010-value-policy.xml: improved localization for name attributes, removed max password length constraint, added `ignoreWhenGenerating` value policy feature.
* 020-archetype-system-user.xml: fixed the color of the icon.
* 021-archetype-system-role.xml: fixed the color of the icon.
* 023-archetype-manual-provisioning-case.xml: added the color for the icon.
* 024-archetype-operation-request.xml: added the color for the icon.
* 025-archetype-approval-case.xml: added the color for the icon.
* 028-archetype-application-role.xml: fixed the plural label.
* 029-archetype-application.xml: fixed the displaying of the application classifications and governance panels.
* 040-role-enduser.xml: extended assignment panels configuration.
* 041-role-approver.xml: added manualProvisioningContext item to read authorization of the CaseType object in order to correctly display case details page; fixed authorizations.
* 042-role-reviewer.xml: extended certification campaign read authorization.
* 062-archetype-classification.xml: extended with documentation attribute.
* 063-archetype-clearance.xml: extended with documentation attribute.
* 090-report-audit.xml: queries are updated to use MidPoint Query language.
* 100-report-reconciliation.xml: queries are updated to use MidPoint Query language.
* 110-report-user-list.xml: queries are updated to use MidPoint Query language.
* 140-report-certification-campaigns.xml: queries are updated to use MidPoint Query language.
* 150-archetype-location.xml: a new one.
* 150-archetype-organization.xml: a new one.
* 150-archetype-organizational-unit.xml: a new one.
* 150-archetype-project.xml: a new one.
* 150-archetype-team.xml: a new one.
* 150-report-certification-cases.xml: fixed campaign name column value, queries are updated to use MidPoint Query language.
* 160-report-certification-work-items.xml: queries are updated to use MidPoint Query language.
* 200-lookup-languages.xml: extended with new languages.
* 210-lookup-locales.xml: extended with new locales.
* 200-report-indirect-assignments.xml: queries are updated to use MidPoint Query language.
* 250-mark-no-classification.xml: a new one.
* 250-mark-privileged-access.xml: a new one.
* 250-mark-unowned.xml: a new one.
* 253-object-collection-application-active.xml: a new one.
* 300-classification-privileged-access.xml: extended with documentation, assignment and inducement.
* 300-policy-require-classification.xml: a new one.
* 300-policy-require-owner.xml: a new one.
* 350-object-collection-application-suspicious.xml: a new one.
* 350-object-collection-application-unowned.xml: a new one.
* 350-object-collection-application-without-classification.xml: a new one.
* 350-object-collection-privileged-users.xml: a new one.
* 350-object-collection-role-active.xml: a new one.
* 350-object-collection-role-all.xml: a new one.
* 350-object-collection-role-unowned.xml: a new one.
* 350-object-collection-user-active.xml: a new one.
* 353-users-with-sod-violations.xml: added documentation attribute, added configuration of the default view.
* 354-roles-privileged.xml: added documentation attribute, added configuration of the default view.
* 357-suspicious-roles.xml: added documentation attribute, added configuration of the default view.
* 358-suspicious-users.xml: added documentation attribute, added configuration of the default view.
* 390-org-projects.xml: a new one.
* 390-org-teams.xml: a new one.
* 390-org-world.xml: a new one.
* 536-archetype-task-certification-start-campaign.xml: task activity panel was fixed to display the data from the certificationStartCampaign container.
* 538-archetype-task-certification-reiterate-campaign.xml: task activity panel was fixed to display the data from the certificationReiterateCampaign container.
* 811-exclusion-violation.xml: extended with documentation attribute.
* 830-suspicious.xml: extended with documentation attribute.
* 899-dashboard-compliance.xml: a new one.
* 910-task-recompute-all-users.xml: a new one.

Please review link:https://github.com/Evolveum/midpoint/commits/master/gui/admin-gui/src/main/resources/initial-objects[source code history] for detailed list of changes.

TIP: Copies of initial object files are located in `config/initial-objects` directory of midPoint distribution packages. These files can be used as a reference during upgrades.
On-line version can be found in https://github.com/Evolveum/midpoint/tree/v{release-version}/config/initial-objects[midPoint source code].

=== Schema Changes Since 4.9

NOTE: This section is relevant to the majority of midPoint deployments.
It describes what data items were marked as deprecated, or removed altogether from the schema.
You should at least scan through it - or use the `ninja` tool to check the deprecations for you.

.Items being deprecated
[%autowidth]
|===
| Type | Item or value | Note
| `AccessCertificationConfigurationType`
| `availableResponse`
| Configure actions in the cert. items collection view instead.

| `ItemRefinedDefinitionType`
| `emphasized`
| Use `displayHint` instead.

| `ResourceObjectTypeDefinitionType`
| `association`
| Use association types (in schemaHandling) instead.

| `ResourceObjectTypeDefinitionType`
| `protected`
| Use "marking" instead.

| `ShadowType`
| `association`
| Legacy associations of this shadow. Not used anymore.

| `SynchronizationActionsType`
| `unlink`
| Use `<synchronize/>` action instead.
|===

The `synchronize/membership` container was added to the object operation policy object, present in xrefv:/midpoint/reference/support-4.9/concepts/mark/[object marks] (like the `Protected` one).
It controls the handling of the membership of entitlements possessing given object mark.

_Actions required:_

* Inspect your configuration for deprecated items, and replace them by their suggested equivalents.
Make sure you don't use any removed items.
You can use `ninja` tool for this.

* Be sure to apply the changes to initial objects 800-804 (object marks), as well as to your custom object marks to handle the membership in the expected way.

[#_behavior_changes_since_4_9]
=== Behavior Changes Since 4.9

* The contract for `ModificationsSupplier` in dynamic object modifications (repo API) was changed.
+
The original approach was that the caller, i.e., repository, cloned the existing object before handling it to the callback (modifications supplier).
Now, the implementor of the callback is responsible for not modifying the provided object in any way.

* Projections with denied access no longer cause "preview changes" operation to fail.
+
If a user has no authorization to see particular projection (shadow), the "preview changes" operation used to finish with "Access denied" fatal error even if there were parts of the result visible to the user.
This is now changed (fixed): only the relevant projections are hidden now.
All the remaining data are displayed to the user.
See also bug:MID-10397[].

* Expression profile changes:

** Script expression evaluator was removed from `safe` expression profile, as it is not considered to be safe.

** Two new expression profiles were added: `permissive` (allowing all expressions) and `prohibitive` (allowing no expressions).

** Permission profile `script-safe` was renamed to `script-limited`, as the existing mechanism for script permission checks is not considered to provide complete safety and security.
This profile is not considered to provide strict security, therefore the name was changed to avoid mis-interpretation.
Corresponding description was added to the profile.

** See xref:/midpoint/reference/expressions/expressions/security/[Expression Security] page for a description of recommended use of expression profiles.

++++
{% include release-issues.html %}
++++
