Date: May 12, 2026 | Time: 1.15 – 1.40

Inalogy: Beyond Attribute Mapping: Shadow Associations for Relational Identity Inbound

Inbound synchronization typically maps attributes one-to-one from source to target. But when source data is relational — one user belonging to multiple organizations, each with its own role, grade, and validity – flat attribute mappings fall short. This session led by Peter Javorka from Inalogy shows how midPoint’s shadow associations handle the inbound synchronization of relational identity data. Instead of flattening multi-valued memberships into user attributes, each organizational relationship is synchronized as a separate association carrying its own metadata. A teacher at one school who is also an employee at another comes in as two distinct associations on the same user. These associations then drive what happens next: which accounts get provisioned, which licenses get assigned, and what access each institution grants – all resolved per association, not per user. The pattern removes the need for post-processing scripts that try to reconstruct relationships that were lost during import. We walk through the implementation end-to-end: how source systems feed data through intermediate database tables, how ScriptedSQL connectors expose it as associations, and how midPoint’s inbound mappings turn those associations into organizational assignments with full extension metadata.