[midPoint] Expected behavior when a ConnId UID lookup returns no result and the midPoint GUI shows HTTP 404

[Али Саад]

Hello,

We are investigating the behavior of midPoint when a resource object
requested by UID no longer exists on the target system.

Environment:
- midPoint version/build: <version>
- Connector bundle and version: <connector/version>
- ConnId framework version: <version>
- Exact GUI page/action: <page or action>
- Resource object class: <object class>

Our connector implements SearchOp with the following behavior:

1. An equality filter on __UID__ is translated into a native UidFilter.
2. executeQuery() performs a targeted request to the external system.
3. If the external system returns the object, the connector invokes
   ResultsHandler.handle(...).
4. If the object does not exist, the connector does not invoke the handler
   and executeQuery() returns normally.
5. UnknownUidException is not thrown for this search result.

This is our simplified implementation:

    if (filter != null && filter.isByUid()) {
        String uid = filter.getUid().getUidValue();
        AccountDto account = accountService.getAccountByLogin(uid);

        if (account != null) {
            handler.handle(AccountMapper.toConnectorObject(account));
        }

        return;
    }

Our understanding of the ConnId connector development guide is that
returning
zero results, i.e. not invoking ResultsHandler.handle(...), is the expected
behavior when the requested resource object does not exist.

However, when we open the object in the midPoint GUI, midPoint displays a
full-page error:

    404
    Couldn't get object.
    Not Found

In some reproductions, our logs also indicate that the target-system API
call
is not reached at all.

Could you please clarify the following?

1. Is a full-page HTTP 404 the expected GUI behavior when a targeted ConnId
   UID lookup returns zero results?

2. Does this 404 necessarily mean that executeQuery() returned no object, or
   can it also mean that the repository shadow or another midPoint object
was
   not found before the connector was invoked?

3. If a repository shadow exists but the corresponding resource object has
   been removed externally, should midPoint run discovery and either
mark/delete
   the shadow or recreate the resource object?

4. Under which conditions can a GUI get operation be served from the
repository
   or shadow cache without invoking the connector?

5. Is our interpretation correct that returning null from
   AbstractFilterTranslator.createEqualsExpression(...) means “fetch all and
   apply framework-side filtering”, and should not prevent executeQuery()
from
   being called?

We can provide:
- the screenshot of the 404 page;
- sanitized ConnId API and SPI TRACE logs;
- connector logs around createFilterTranslator(), executeQuery(), the target
  API invocation, and ResultsHandler.handle();
- sanitized shadow XML before and after the operation;
- the relevant resource consistency and caching configuration.

Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260826/55b98ae3/attachment.htm>