Blog

Most enterprises have at least one system that does not have a pre-built midPoint connector. REST APIs are the most common integration target for custom connector development. This guide explains how midPoint connectors work and what to consider when building one for a REST API.

Understanding the ConnId Framework

midPoint does not communicate with target systems directly. Instead, it uses the ConnId connector framework (originally developed as part of the Sun Identity Manager project, later adopted by the open-source community). ConnId provides a standardized Java API that all connectors implement.

This means every connector, whether it targets Active Directory, a database, or a REST API, follows the same interface contract: Create, Read, Update, Delete, and Search operations on accounts and groups.

When Do You Need a Custom Connector?

You need a custom connector when:

• Your target system exposes a REST API but has no pre-built ConnId connector
• The existing generic REST connector does not support your API’s authentication or pagination model
• You need complex transformation logic between midPoint schema and the API’s data model
• Your system uses a proprietary protocol that the generic connectors cannot handle

Common examples: custom HR systems, homegrown CRM platforms, SaaS applications without SCIM support, legacy billing systems with REST facades.

Connector Architecture for REST APIs

A REST API connector typically consists of:

• Configuration class: Defines connection parameters (base URL, authentication credentials, timeout values)
• Connection management: Handles HTTP client setup, OAuth token refresh, or API key injection
• Schema discovery: Maps the API’s data model to ConnId’s account and group object classes
• CRUD operations: Implements Create (POST), Read (GET), Update (PUT/PATCH), and Delete (DELETE) against the API endpoints
• Search/filter translation: Converts ConnId filter queries into API query parameters or OData filters
• Pagination handling: Manages cursor-based, offset-based, or link-based pagination for large result sets

Authentication Patterns

REST APIs use various authentication methods. Your connector must handle:

• API key: Static key passed as header or query parameter
• Basic auth: Username/password encoded in the Authorization header
• OAuth 2.0 client credentials: Token acquisition and automatic refresh before expiry
• OAuth 2.0 authorization code: For APIs requiring user-delegated access (less common for backend integration)
• Certificate-based (mTLS): Mutual TLS for high-security environments

Error Handling and Resilience

Production connectors must handle real-world API behavior:

• Rate limiting: Respect HTTP 429 responses with exponential backoff
• Transient failures: Retry on 5xx errors and network timeouts
• Partial failures: Handle batch operations where some items succeed and others fail
• Schema changes: Gracefully handle unexpected fields or missing required fields
• Logging: Comprehensive logging at appropriate levels for debugging without exposing sensitive data

Testing Your Connector

Before deploying to production:

• Unit test each operation against mock API responses
• Integration test against a sandbox/staging instance of the target system
• Load test with realistic identity volumes to verify pagination and performance
• Test error scenarios: API downtime, expired credentials, rate limiting
• Validate schema mapping with midPoint’s resource definition

Deployment and Maintenance

Once built, the connector JAR is deployed to midPoint’s connector directory. Version the connector alongside your midPoint configuration in Git. Plan for ongoing maintenance:

• API version upgrades may require connector updates
• New attributes or operations may need schema extensions
• Authentication method changes (e.g., API key to OAuth) require connector reconfiguration

Let Us Build It For You

WeKnowIdentity has built custom midPoint connectors for REST APIs, SOAP services, databases, CSV feeds, and proprietary platforms. Every connector is built to ConnId standards, fully tested, and documented. Contact us to discuss your integration requirements.

Related Resources

• Custom Connector Development services
• midPoint consulting and implementation
• See our connector work in action

The General Data Protection Regulation (GDPR) requires organizations to demonstrate that personal data access is controlled, justified, and auditable. Evolveum midPoint provides the identity governance tools to automate GDPR compliance at scale.

Why Identity Governance Matters for GDPR

GDPR Articles 5, 25, and 32 require organizations to implement appropriate technical measures to protect personal data. In practice, this means knowing exactly who has access to what personal data, why they have it, and being able to prove it to regulators on demand.

Manual access reviews using spreadsheets fail at scale. They are slow, error-prone, and impossible to audit reliably. An IGA platform like midPoint automates the entire process.

Access Certification Campaigns

midPoint’s access certification feature allows you to run automated review campaigns where managers and data owners periodically verify that each user’s access is still appropriate.

Key capabilities:

• Scheduled campaigns: Run quarterly, semi-annual, or event-triggered reviews
• Role-based reviews: Managers certify access for their direct reports
• Application-based reviews: Data owners certify who has access to their systems
• Escalation: Unreviewed items escalate automatically after a deadline
• Remediation: Rejected access is automatically revoked via midPoint provisioning

Segregation of Duties (SoD)

GDPR requires that access controls prevent unauthorized combinations of privileges. midPoint’s SoD engine defines exclusion policies that prevent toxic role combinations:

• A user who can create payments cannot also approve payments
• A user with HR data access cannot also have payroll system admin rights
• System administrators cannot assign themselves elevated privileges

Violations are detected in real time and can trigger automatic remediation or approval workflows.

Audit Trail and Reporting

midPoint maintains a comprehensive audit log of every identity event:

• Who was granted or revoked access, by whom, and when
• Every role assignment, modification, and deletion
• All certification campaign decisions with reviewer identity and timestamp
• Policy violation detections and remediation actions

These logs are exportable and can feed into SIEM systems for centralized compliance monitoring.

Right to Access and Right to Erasure

When a data subject exercises their GDPR rights, midPoint helps you respond:

• Right to access (Article 15): midPoint can generate a report of all systems and roles assigned to a specific identity
• Right to erasure (Article 17): midPoint’s de-provisioning workflows can systematically remove a user’s accounts across all connected systems

Data Minimization Through Role Engineering

GDPR’s data minimization principle (Article 5) requires that users only have access to the data they need. midPoint’s role mining and role engineering capabilities help you:

• Analyze existing access patterns to identify over-provisioned users
• Design lean role structures based on actual job functions
• Automatically assign and revoke roles based on HR data (joiner/mover/leaver)

Get GDPR-Ready with midPoint

WeKnowIdentity configures midPoint’s governance engine to meet GDPR requirements from day one. We handle access certification setup, SoD policy design, audit configuration, and integration with your HR and compliance systems. Contact us for a free compliance assessment.

Related Resources

• Identity Governance and Compliance services
• midPoint consulting and implementation
• Enterprise deployment case studies

Deploying Evolveum midPoint on Kubernetes brings scalability, reproducibility, and infrastructure-as-code practices to your identity management platform. This guide covers the key considerations for a production-grade midPoint Kubernetes deployment.

Why Kubernetes for midPoint?

Traditional midPoint deployments on bare-metal or VMs work well, but Kubernetes offers distinct advantages for organizations that need:

• Horizontal scaling for large identity populations
• Reproducible environments across dev, staging, and production
• Automated failover and self-healing
• GitOps-driven configuration management
• Consistent deployment across cloud providers (AWS EKS, Azure AKS, GCP GKE)

Architecture Overview

A production midPoint Kubernetes deployment typically consists of:

• midPoint application pods: The core midPoint instances, typically 2-3 replicas for high availability
• PostgreSQL database: midPoint’s repository, deployed as a StatefulSet or using a managed database service (RDS, Cloud SQL)
• Persistent storage: For midPoint home directory, keystores, and configuration files
• Ingress controller: NGINX or Traefik for HTTPS termination and routing
• ConfigMaps and Secrets: For environment-specific configuration without rebuilding images

Helm Charts for midPoint

Helm charts simplify midPoint deployment by packaging all Kubernetes resources into a single, versioned, configurable unit. A well-structured midPoint Helm chart includes:

• Deployment/StatefulSet for midPoint pods
• Service and Ingress definitions
• ConfigMap for midPoint configuration XML
• Secret for database credentials and keystores
• PersistentVolumeClaim for midPoint home
• Health check probes (liveness and readiness)

Values files allow you to customize the deployment per environment without modifying the chart itself.

GitOps Configuration Management

GitOps takes Kubernetes deployment to the next level by treating your entire midPoint configuration as code stored in Git:

• ArgoCD or Flux watches your Git repository for changes
• Any midPoint configuration change (roles, policies, resource definitions) is committed to Git
• The GitOps tool automatically applies changes to the cluster
• Full audit trail of every configuration change with Git history
• Easy rollback by reverting a Git commit

This approach is especially valuable for regulated environments where you need to demonstrate who changed what and when.

Production Hardening Checklist

Before going live, ensure:

• Database backups are automated and tested
• TLS certificates are configured for all endpoints
• Resource limits (CPU, memory) are set on all pods
• Pod disruption budgets prevent all replicas from going down simultaneously
• Monitoring and alerting (Prometheus/Grafana) are configured
• Log aggregation (ELK or Loki) captures midPoint audit logs
• Network policies restrict pod-to-pod communication
• Secrets are managed via external secrets operator or vault

Common Pitfalls

• Shared midPoint home directory: When running multiple replicas, the home directory must be on shared storage (NFS, EFS) or each pod needs its own PVC
• Database connection pooling: Configure connection pool sizes carefully to avoid exhaustion under load
• Startup time: midPoint takes time to initialize. Set generous initialDelaySeconds on liveness probes to prevent restart loops
• Session affinity: If using the midPoint GUI across replicas, configure session affinity on the service or use sticky sessions

Need Help with Your Kubernetes Deployment?

WeKnowIdentity specializes in Kubernetes-native midPoint deployments. We have delivered production environments on EKS, AKS, and bare-metal Kubernetes clusters for enterprise clients. Contact us for architecture guidance.

Related Resources

• Our midPoint consulting services
• Enterprise deployment case studies
• All WeKnowIdentity services

Choosing an Identity Governance and Administration (IGA) platform is one of the most consequential decisions your IT organization will make. midPoint and SailPoint are two leading options, but they serve different needs and budgets.

This comparison breaks down the key differences to help you decide which platform is right for your enterprise.

Licensing Model

SailPoint IdentityIQ uses a traditional per-user licensing model. As your identity count grows, so does your annual license fee. For enterprises managing 50,000+ identities, this can mean six-figure annual costs before implementation even begins.

Evolveum midPoint is open source under the Apache License. There are no per-user fees. You pay only for implementation, customization, and optional support subscriptions. For large enterprises, this difference in total cost of ownership can be substantial over a 5-year period.

Deployment Flexibility

SailPoint IdentityIQ is primarily deployed on-premises or in IaaS environments. SailPoint also offers IdentityNow (SaaS), but it is a different product with different capabilities.

midPoint supports bare-metal, Docker, and Kubernetes-native deployment. It works equally well on-premises, in private clouds, or on AWS, Azure, and GCP. With Helm charts and GitOps-based configuration, midPoint deployments are fully reproducible and infrastructure-as-code friendly.

Connector Ecosystem

SailPoint has a larger library of pre-built connectors, which is an advantage for organizations with many standard target systems.

midPoint uses the open ConnId connector framework, which supports Active Directory, LDAP, REST APIs, SOAP services, SCIM, databases (SQL/NoSQL), CSV feeds, and more. For non-standard systems, custom connectors can be built to the ConnId specification. The trade-off: midPoint may require more initial connector development, but you own and control every connector.

Identity Governance Features

Both platforms offer comprehensive governance: role-based access control (RBAC), access certification campaigns, segregation of duties (SoD), and audit reporting.

midPoint adds native support for attribute-based access control (ABAC), policy-driven automation, and advanced organizational structure modeling. SailPoint excels in AI-driven access recommendations and risk scoring with its AI Services add-on.

Community and Support

SailPoint has a large partner ecosystem and dedicated enterprise support tiers.

midPoint has an active open-source community, professional support subscriptions from Evolveum, and a growing network of certified implementation partners (including WeKnowIdentity). Full access to source code means no black boxes.

When to Choose midPoint

• You want to avoid per-user licensing fees
• You need Kubernetes-native deployment with GitOps
• You value full source code access and no vendor lock-in
• You have complex organizational structures requiring flexible modeling
• You are migrating from a legacy platform (SAP IDM, MIM) and want a modern alternative

When to Choose SailPoint

• You need the largest possible pre-built connector library
• AI-driven access recommendations are a priority
• Your organization prefers commercial vendor support over open-source community
• You want a SaaS option (IdentityNow)

Need Help Deciding?

WeKnowIdentity has hands-on experience with both platforms. We can assess your current IAM landscape and recommend the right approach. Contact us for a free initial consultation.

Related Resources

• Our midPoint consulting and implementation services
• View all WeKnowIdentity IAM services
• Enterprise midPoint case studies

Related: For a comprehensive side-by-side analysis of open source and commercial IGA platforms, read our full guide: midPoint vs Commercial IGA: Which Approach Fits Your Enterprise?