What it does here
midPoint is the governance engine — the brain of the lab. It reads the authoritative HR feed, decides what each person should have, and makes the directory match. Joiner, mover, leaver, access requests, approvals, segregation of duties and reconciliation all happen here.
How it is deployed
Container midpoint with its own PostgreSQL repository. Behind Caddy it runs with -Dserver.forward-headers-strategy=NATIVE so it knows TLS is terminated upstream. Its objects — resources, roles, the user template and the tasks — were imported over the REST API; see Installation §4.4.
Settings in the web console
Sign in at midpoint.iamlab.genbay.co as administrator. The left menu is your map of the whole identity lifecycle.
Resources — the systems midPoint talks to
Resources › All resources holds exactly two, and the pair tells the whole story:
| Resource | Role | Direction |
|---|---|---|
| Golonex HRIS (CSV feed) | authoritative source of identities | midPoint reads it |
| Golonex Directory (OpenLDAP) | the provisioning target | midPoint writes it |
Open either and use Test connection — the first thing to check if the lab misbehaves. Under Schema handling you can see the mappings: which HR column becomes which identity attribute, and which identity attribute becomes which LDAP attribute.
Users — the governed identities
Users › All users. Open one and the tabs matter:
- Basic — name, e-mail, department, and the activation status that drives everything.
- Projections — the actual accounts this identity owns on connected systems (the LDAP entry).
- Assignments — the roles the person holds. This is what should be; projections are what is.
Roles — what access looks like
Roles › All roles contains the Golonex role model:
| Role | Behaviour |
|---|---|
| Employee | birthright — auto-assigned to every HR-sourced identity, grants the directory account and app-users |
| Finance AP Clerk / Approver | requestable, department-scoped, and mutually exclusive |
| HR Staff / IT Admin | requestable, department-scoped, require line-manager approval |
| Access Approver | its members are the approvers in the request workflow |
Open Finance AP Clerk and look at its Inducements (what it grants) and its Policy rules — the exclusion rule against AP Approver is the segregation-of-duties control, written once and enforced on every request.
Server tasks — the automation
Server tasks › All tasks. Two tasks drive the lab, and you run them by hand so you can watch cause and effect:
| Task | What it does | When you run it |
|---|---|---|
| HR feed import | reads the CSV and applies joiners, movers and leavers | after every HRIS change |
| Directory reconciliation | compares the directory against governed identities | to surface orphan accounts |
Use Run now, then open the task and read its Operation result — that is where you see what actually happened, and any error.
Cases — approvals in flight
Cases (also surfaced as work items) is where a requested role waits for a decision. Each case shows what was requested, for whom, and who may approve it. Approving here is what releases the entitlement to be provisioned.
Try this
- Request Finance AP Approver for someone who already holds AP Clerk — midPoint refuses it and names the policy. That refusal is the single most exam-relevant moment in the lab.
- Run reconciliation and look for
mallory.mills: an account with no owning identity.