[midPoint] disable "DeleteAll" options in production

[Om Bhallamudi]

Hi,

I have the following authorization in place to prevent dangerous admin actions:

<!-- Dangerous: Factory reset -->
<authorization>
<name>system-configAbout-gui-deny</name>
<decision>deny</decision>
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#configAbout</action>
</authorization>

<!-- Dangerous: Clock change -->
<!-- Dangerous: Kicking out logged-in users
This could arguably be used for "good", but will let admins also terminate sessions of other admins!!
-->
<authorization>
<name>system-configInternals-gui-deny</name>
<decision>deny</decision>
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#configInternals</action>
</authorization>
<!-- Dangerous: Prevent account takeover -->
<!-- Can't explicitly deny execution phase because user self-service password reset will need it -->
<authorization>
<name>shadow-credentials-password-value-modify-deny</name>
<decision>deny</decision>
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
<phase>request</phase>
<object>
<type>ShadowType</type>
</object>
<item>credentials/password/value</item>
<!-- filter service accounts --> </authorization>

<authorization>
<name>user-credentials-password-value-modify-deny</name>
<decision>deny</decision>
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
<object>
<type>UserType</type>
<!-- employee archetypes -->
<archetypeRef oid="..." />
...
</object>
<item>credentials/password/value</item>
<!-- filter service accounts --> </authorization>

This authorization sits in a role deny-dangerous-admin-func​ that is included with all admin roles, including our superuser role. Note that this also prevents all password changes for anyone who holds an admin role, and the user has to de-escalate privileges before they can set any passwords via self-service.

Om Bhallamudi
Proton AG

On Thursday, 2 July 2026 at 08:19, Fabian Noll-Dukiewicz via midPoint <midpoint at lists.evolveum.com> wrote:

> Hi Steven,
>
> this is quite simple. You can create an administrator role as copy of the default super user user role with the „authorization-3#all“ action. To avoid deletion, you add a second authorization block with the „authorization-model-3#delete“ action and decision „deny“. The following screenshot shows my role configuration:
> [image.png]
>
> Kind regards,
> Fabian
>
> --
>
> Fabian Noll-Dukiewicz
>
> Spezialist Identity & Access Management | Geschäftsführer
>
> Tel.: +49 152 244 63 211
>
> Email: fabian.noll-dukiewicz at veryfy.gmbh
>
> Web: https://veryfy.gmbh
>
> Von: midPoint <midpoint-bounces at lists.evolveum.com> im Auftrag von Ashwill, Steven L via midPoint <midpoint at lists.evolveum.com>
> Datum: Mittwoch, 1. Juli 2026 um 16:13
> An: midpoint at lists.evolveum.com <midpoint at lists.evolveum.com>
> Cc: Ashwill, Steven L <sashwill at uillinois.edu>
> Betreff: [midPoint] disable "DeleteAll" options in production
> Is there a way to remove the option or the permissions that allow a super user to "Delete All Objects" or "Delete all Shadows" from the repository menu and other screen where that may exist. There is no reason that I can think of where we would want to do this in production and unfortunately it has happen by accident twice in the last 2 years.
>
> STEVEN L ASHWILL
> Software Engineer Coordinator
> Administrative Information Technology Services
> University of Illinois at Urbana-Champaign
> 50 Gerty Drive | M/C 673
> Champaign, IL 61820
> 217.265.6337 | sashwill at uillinois.edu
> www.aits.uillinois.edu
>
> Under the Illinois Freedom of Information Act any written communication to or from university employees regarding university business is a public record and may be subject to public disclosure.
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://lists.evolveum.com/mailman/listinfo/midpoint
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260717/5d9fb0c0/attachment-0001.htm>