diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractAssignmentPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractAssignmentPopupTabPanel.java
index 8ced93f30fe..7b83d88c626 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractAssignmentPopupTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractAssignmentPopupTabPanel.java
@@ -50,7 +50,7 @@ public abstract class AbstractAssignmentPopupTabPanel<O extends ObjectType> exte
     private static final String DOT_CLASS = AbstractAssignmentPopupTabPanel.class.getName();
 
     public AbstractAssignmentPopupTabPanel(String id, ObjectTypes type){
-        super(id, type);
+        super(id);
     }
 
     protected abstract Map<String, AssignmentType> getSelectedAssignmentsMap();
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.html
index 8fde94158ed..202acb9547f 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.html
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.html
@@ -15,6 +15,7 @@
   -->
 
 <wicket:panel xmlns:wicket="http://wicket.apache.org">
-    <div wicket:id="objectListPanel" />
     <wicket:child />
+    <div wicket:id="objectListPanel" />
+    <div wicket:id="parametersPanel" />
 </wicket:panel>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.java
index 9920236427f..57f8b818ee1 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AbstractPopupTabPanel.java
@@ -15,6 +15,7 @@
  */
 package com.evolveum.midpoint.gui.api.component;
 
+import com.evolveum.midpoint.gui.api.model.LoadableModel;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
 import com.evolveum.midpoint.web.component.util.SelectableBean;
@@ -22,6 +23,8 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
 import org.apache.wicket.Component;
 import org.apache.wicket.ajax.AjaxRequestTarget;
+import org.apache.wicket.markup.html.WebMarkupContainer;
+import org.apache.wicket.markup.html.panel.Fragment;
 import org.apache.wicket.model.IModel;
 import org.apache.wicket.model.Model;
 
@@ -35,24 +38,30 @@ public abstract class AbstractPopupTabPanel<O extends ObjectType> extends BasePa
     private static final long serialVersionUID = 1L;
 
     private static final String ID_OBJECT_LIST_PANEL = "objectListPanel";
+    private static final String ID_PARAMETERS_PANEL = "parametersPanel";
+    protected static final String ID_PARAMETERS_PANEL_FRAGMENT = "parametersPanelFragment";
 
-    protected ObjectTypes type;
     protected List<O> preSelectedObjects = new ArrayList<>();
 
-    public AbstractPopupTabPanel(String id, ObjectTypes type){
+    public AbstractPopupTabPanel(String id){
         super(id);
-        this.type = type;
     }
 
     @Override
     protected void onInitialize(){
         super.onInitialize();
+        setOutputMarkupId(true);
         add(initObjectListPanel());
-        initParametersPanel();
+
+        Fragment parametersPanelFragment = new Fragment(ID_PARAMETERS_PANEL, ID_PARAMETERS_PANEL_FRAGMENT, this);
+        parametersPanelFragment.setOutputMarkupId(true);
+
+        initParametersPanel(parametersPanelFragment);
+        add(parametersPanelFragment);
     }
 
-    private Component initObjectListPanel(){
-        PopupObjectListPanel<O> listPanel = new PopupObjectListPanel<O>(ID_OBJECT_LIST_PANEL, (Class)type.getClassDefinition(),
+    protected Component initObjectListPanel(){
+        PopupObjectListPanel<O> listPanel = new PopupObjectListPanel<O>(ID_OBJECT_LIST_PANEL, (Class)getObjectType().getClassDefinition(),
                 null, true, getPageBase(), getPreselectedObjects()) {
 
             private static final long serialVersionUID = 1L;
@@ -87,7 +96,7 @@ public boolean isVisible(){
         return listPanel;
     }
 
-    protected abstract void initParametersPanel();
+    protected abstract void initParametersPanel(Fragment parametersPanel);
 
     protected List<O> getPreselectedObjects(){
         return preSelectedObjects;
@@ -119,7 +128,5 @@ protected boolean isObjectListPanelVisible(){
         return true;
     }
 
-    public ObjectTypes getType() {
-        return type;
-    }
+    protected abstract ObjectTypes getObjectType();
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AssignmentPopup.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AssignmentPopup.java
index 89e86c79307..c839a29faef 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AssignmentPopup.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/AssignmentPopup.java
@@ -29,6 +29,8 @@
 import org.apache.wicket.markup.html.WebMarkupContainer;
 import org.apache.wicket.markup.html.form.Form;
 import org.apache.wicket.model.StringResourceModel;
+import org.apache.wicket.protocol.http.ClientProperties;
+import org.apache.wicket.protocol.http.WebSession;
 
 import java.util.*;
 
@@ -123,6 +125,11 @@ public WebMarkupContainer createPanel(String panelId) {
                             protected void onSelectionPerformed(AjaxRequestTarget target){
                                 tabLabelPanelUpdate(target);
                             }
+
+                            @Override
+                            protected ObjectTypes getObjectType(){
+                                return ObjectTypes.ROLE;
+                            }
                         };
                     }
 
@@ -147,6 +154,11 @@ protected void onSelectionPerformed(AjaxRequestTarget target){
                                 tabLabelPanelUpdate(target);
                             }
 
+                            @Override
+                            protected ObjectTypes getObjectType(){
+                                return ObjectTypes.ORG;
+                            }
+
                             @Override
                             protected List<OrgType> getPreselectedObjects(){
                                 return selectedOrgsList;
@@ -199,6 +211,11 @@ public WebMarkupContainer createPanel(String panelId) {
                         return new FocusTypeAssignmentPopupTabPanel(panelId, ObjectTypes.SERVICE){
                             private static final long serialVersionUID = 1L;
 
+                            @Override
+                            protected ObjectTypes getObjectType(){
+                                return ObjectTypes.SERVICE;
+                            }
+
                             @Override
                             protected void onSelectionPerformed(AjaxRequestTarget target){
                                 tabLabelPanelUpdate(target);
@@ -260,11 +277,21 @@ protected void addPerformed(AjaxRequestTarget target, List newAssignmentsList) {
     }
 
     public int getWidth(){
-        return 900;
+        return 80;
     }
 
     public int getHeight(){
-        return 1200;
+        return 80;
+    }
+
+    @Override
+    public String getWidthUnit(){
+        return "%";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "%";
     }
 
     public StringResourceModel getTitle(){
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ChooseMemberForOrgPopup.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ChooseMemberForOrgPopup.java
new file mode 100644
index 00000000000..235a0865441
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ChooseMemberForOrgPopup.java
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2010-2018 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.evolveum.midpoint.gui.api.component;
+
+import com.evolveum.midpoint.gui.api.component.tabs.CountablePanelTab;
+import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
+
+/**
+ * Created by honchar
+ */
+
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
+import org.apache.wicket.ajax.AjaxRequestTarget;
+import org.apache.wicket.extensions.markup.html.tabs.ITab;
+import org.apache.wicket.markup.html.WebMarkupContainer;
+
+import java.util.ArrayList;
+import java.util.List;
+
+public abstract class ChooseMemberForOrgPopup<O extends ObjectType> extends ChooseMemberPopup<O, OrgType> {
+    private static final long serialVersionUID = 1L;
+
+    public ChooseMemberForOrgPopup(String id, List<RelationTypes> availableRelationList){
+        super(id, availableRelationList);
+    }
+
+    @Override
+    protected List<ITab> createAssignmentTabs() {
+        List<ITab> tabs = super.createAssignmentTabs();
+        tabs.add(new CountablePanelTab(getPageBase().createStringResource("chooseMemberForOrgPopup.otherTypesLabel"), null) {
+
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            public WebMarkupContainer createPanel(String panelId) {
+                return new MultiTypesMemberPopupTabPanel(panelId, availableRelationList){
+                    private static final long serialVersionUID = 1L;
+
+                    @Override
+                    protected void onSelectionPerformed(AjaxRequestTarget target){
+                        tabLabelPanelUpdate(target);
+                    }
+
+                    @Override
+                    protected OrgType getAbstractRoleTypeObject(){
+                        return ChooseMemberForOrgPopup.this.getAssignmentTargetRefObject();
+                    }
+                };
+            }
+
+            @Override
+            public String getCount() {
+                return Integer.toString(getTabPanelSelectedCount(getPanel()));
+            }
+        });
+        return tabs;
+    }
+
+}
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ChooseMemberPopup.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ChooseMemberPopup.java
index be1424783c1..fd9cd89b9ec 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ChooseMemberPopup.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ChooseMemberPopup.java
@@ -21,6 +21,7 @@
 import com.evolveum.midpoint.prism.query.InOidFilter;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.task.api.Task;
 import com.evolveum.midpoint.task.api.TaskCategory;
@@ -30,7 +31,6 @@
 import com.evolveum.midpoint.util.logging.TraceManager;
 import com.evolveum.midpoint.web.component.AjaxButton;
 import com.evolveum.midpoint.web.component.TabbedPanel;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.dialog.Popupable;
 import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
@@ -60,7 +60,7 @@ public abstract class ChooseMemberPopup<O extends ObjectType, T extends Abstract
     private static final String ID_FORM = "form";
 
     private List<OrgType> selectedOrgsList = new ArrayList<>();
-    private List<RelationTypes> availableRelationList;
+    protected List<RelationTypes> availableRelationList;
 
     public ChooseMemberPopup(String id, List<RelationTypes> availableRelationList){
         super(id);
@@ -107,7 +107,7 @@ public void onClick(AjaxRequestTarget target) {
                     }
 
                     MemberPopupTabPanel memberPanel = (MemberPopupTabPanel) tabPanel;
-                    executeMemberOperation(memberPanel.getType().getTypeQName(), createInOidQuery(memberPanel.getSelectedObjectsList()),
+                    executeMemberOperation(memberPanel.getObjectType().getTypeQName(), createInOidQuery(memberPanel.getSelectedObjectsList()),
                            memberPanel.prepareDelta(), target);
                 });
                 ChooseMemberPopup.this.getPageBase().hideMainPopup(target);
@@ -123,13 +123,45 @@ protected List<ITab> createAssignmentTabs() {
         VisibleEnableBehaviour authorization = new VisibleEnableBehaviour(){
         };
 
+        tabs.add(new CountablePanelTab(getPageBase().createStringResource("ObjectTypes.USER"), authorization) {
+
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            public WebMarkupContainer createPanel(String panelId) {
+                return new MemberPopupTabPanel(panelId, availableRelationList){
+                    private static final long serialVersionUID = 1L;
+
+                    @Override
+                    protected void onSelectionPerformed(AjaxRequestTarget target){
+                        tabLabelPanelUpdate(target);
+                    }
+
+                    @Override
+                    protected ObjectTypes getObjectType(){
+                        return ObjectTypes.USER;
+                    }
+
+                    @Override
+                    protected T getAbstractRoleTypeObject(){
+                        return ChooseMemberPopup.this.getAssignmentTargetRefObject();
+                    }
+                };
+            }
+
+            @Override
+            public String getCount() {
+                return Integer.toString(getTabPanelSelectedCount(getPanel()));
+            }
+        });
+
         tabs.add(new CountablePanelTab(getPageBase().createStringResource("ObjectTypes.ROLE"), authorization) {
 
             private static final long serialVersionUID = 1L;
 
             @Override
             public WebMarkupContainer createPanel(String panelId) {
-                return new MemberPopupTabPanel(panelId, ObjectTypes.ROLE, availableRelationList){
+                return new MemberPopupTabPanel(panelId, availableRelationList){
                     private static final long serialVersionUID = 1L;
 
                     @Override
@@ -137,6 +169,11 @@ protected void onSelectionPerformed(AjaxRequestTarget target){
                         tabLabelPanelUpdate(target);
                     }
 
+                    @Override
+                    protected ObjectTypes getObjectType(){
+                        return ObjectTypes.ROLE;
+                    }
+
                     @Override
                     protected T getAbstractRoleTypeObject(){
                         return ChooseMemberPopup.this.getAssignmentTargetRefObject();
@@ -157,7 +194,7 @@ public String getCount() {
 
                     @Override
                     public WebMarkupContainer createPanel(String panelId) {
-                        return new MemberPopupTabPanel(panelId, ObjectTypes.ORG, availableRelationList){
+                        return new MemberPopupTabPanel(panelId, availableRelationList){
                             private static final long serialVersionUID = 1L;
 
                             @Override
@@ -165,6 +202,11 @@ protected void onSelectionPerformed(AjaxRequestTarget target){
                                 tabLabelPanelUpdate(target);
                             }
 
+                            @Override
+                            protected ObjectTypes getObjectType(){
+                                return ObjectTypes.ORG;
+                            }
+
                             @Override
                             protected T getAbstractRoleTypeObject(){
                                 return ChooseMemberPopup.this.getAssignmentTargetRefObject();
@@ -224,7 +266,7 @@ public String getCount() {
 
                     @Override
                     public WebMarkupContainer createPanel(String panelId) {
-                        return new MemberPopupTabPanel(panelId, ObjectTypes.SERVICE, availableRelationList){
+                        return new MemberPopupTabPanel(panelId, availableRelationList){
                             private static final long serialVersionUID = 1L;
 
                             @Override
@@ -232,6 +274,11 @@ protected T getAbstractRoleTypeObject(){
                                 return ChooseMemberPopup.this.getAssignmentTargetRefObject();
                             }
 
+                            @Override
+                            protected ObjectTypes getObjectType(){
+                                return ObjectTypes.SERVICE;
+                            }
+
                             @Override
                             protected void onSelectionPerformed(AjaxRequestTarget target){
                                 tabLabelPanelUpdate(target);
@@ -249,14 +296,14 @@ public String getCount() {
         return tabs;
     }
 
-    private int getTabPanelSelectedCount(WebMarkupContainer panel){
+    protected int getTabPanelSelectedCount(WebMarkupContainer panel){
         if (panel != null && panel instanceof MemberPopupTabPanel){
             return ((MemberPopupTabPanel) panel).getSelectedObjectsList().size();
         }
         return 0;
     }
 
-    private void tabLabelPanelUpdate(AjaxRequestTarget target){
+    protected void tabLabelPanelUpdate(AjaxRequestTarget target){
         target.add(getTabbedPanel());
     }
 
@@ -294,11 +341,21 @@ protected void executeMemberOperation(QName type, ObjectQuery memberQuery,
     protected abstract T getAssignmentTargetRefObject();
 
     public int getWidth(){
-        return 900;
+        return 80;
     }
 
     public int getHeight(){
-        return 1200;
+        return 80;
+    }
+
+    @Override
+    public String getWidthUnit(){
+        return "%";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "%";
     }
 
     public StringResourceModel getTitle(){
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.html
index f1cc32f438f..25fd8f0bab8 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.html
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.html
@@ -17,23 +17,29 @@
 <!DOCTYPE html>
 <html xmlns:wicket="http://wicket.apache.org">
 <wicket:extend>
-    <wicket:child />
-    <div class="form-inline">
-        <div class="row">
-            <div class="col-md-4">
-                <label><wicket:message key="AssignmentPanel.newAssignmentParameters" /></label>
-            </div>
-        </div>
-        <div wicket:id="relationContainer" class="row">
-            <div class="form-group col-md-12">
-                <div class="col-md-1" >
-                    <div><wicket:message key="AssignmentEditorPanel.relation"/></div>
+    <wicket:child/>
+    <wicket:fragment wicket:id="parametersPanelFragment">
+        <div class="form-inline">
+            <div class="row">
+                <div class="col-md-4">
+                    <label>
+                        <wicket:message key="AssignmentPanel.newAssignmentParameters"/>
+                    </label>
                 </div>
-                <div class="col-md-3" >
-                    <span wicket:id="relation"/>
+            </div>
+            <div wicket:id="relationContainer" class="row">
+                <div class="form-group col-md-12">
+                    <div class="col-md-1">
+                        <div>
+                            <wicket:message key="AssignmentEditorPanel.relation"/>
+                        </div>
+                    </div>
+                    <div class="col-md-3">
+                        <span wicket:id="relation"/>
+                    </div>
                 </div>
             </div>
         </div>
-    </div>
+    </wicket:fragment>
 </wicket:extend>
 </html>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.java
index fc68ad43c51..236603bf5c2 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/FocusTypeAssignmentPopupTabPanel.java
@@ -21,6 +21,7 @@
 import com.evolveum.midpoint.prism.query.ObjectFilter;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
@@ -28,7 +29,6 @@
 import com.evolveum.midpoint.util.logging.LoggingUtils;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.input.DropDownChoicePanel;
 import com.evolveum.midpoint.web.page.admin.configuration.component.EmptyOnChangeAjaxFormUpdatingBehavior;
 import com.evolveum.midpoint.web.security.SecurityUtils;
@@ -36,6 +36,7 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
 import org.apache.commons.collections.map.HashedMap;
 import org.apache.wicket.markup.html.WebMarkupContainer;
+import org.apache.wicket.markup.html.panel.Fragment;
 import org.apache.wicket.model.Model;
 
 import javax.xml.namespace.QName;
@@ -60,10 +61,10 @@ public FocusTypeAssignmentPopupTabPanel(String id, ObjectTypes type){
     }
 
     @Override
-    protected void initParametersPanel(){
+    protected void initParametersPanel(Fragment parametersPanel){
         WebMarkupContainer relationContainer = new WebMarkupContainer(ID_RELATION_CONTAINER);
         relationContainer.setOutputMarkupId(true);
-        add(relationContainer);
+        parametersPanel.add(relationContainer);
 
         DropDownChoicePanel<RelationTypes> relationSelector = WebComponentUtil.createEnumPanel(RelationTypes.class, ID_RELATION,
                 WebComponentUtil.createReadonlyModelFromEnum(RelationTypes.class), Model.of(RelationTypes.MEMBER),
@@ -125,4 +126,9 @@ protected ObjectQuery addFilterToContentQuery(ObjectQuery query){
         query.addFilter(filter);
         return query;
     }
+
+    @Override
+    protected ObjectTypes getObjectType(){
+        return ObjectTypes.FOCUS_TYPE;
+    }
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.html
index f1cc32f438f..25fd8f0bab8 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.html
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.html
@@ -17,23 +17,29 @@
 <!DOCTYPE html>
 <html xmlns:wicket="http://wicket.apache.org">
 <wicket:extend>
-    <wicket:child />
-    <div class="form-inline">
-        <div class="row">
-            <div class="col-md-4">
-                <label><wicket:message key="AssignmentPanel.newAssignmentParameters" /></label>
-            </div>
-        </div>
-        <div wicket:id="relationContainer" class="row">
-            <div class="form-group col-md-12">
-                <div class="col-md-1" >
-                    <div><wicket:message key="AssignmentEditorPanel.relation"/></div>
+    <wicket:child/>
+    <wicket:fragment wicket:id="parametersPanelFragment">
+        <div class="form-inline">
+            <div class="row">
+                <div class="col-md-4">
+                    <label>
+                        <wicket:message key="AssignmentPanel.newAssignmentParameters"/>
+                    </label>
                 </div>
-                <div class="col-md-3" >
-                    <span wicket:id="relation"/>
+            </div>
+            <div wicket:id="relationContainer" class="row">
+                <div class="form-group col-md-12">
+                    <div class="col-md-1">
+                        <div>
+                            <wicket:message key="AssignmentEditorPanel.relation"/>
+                        </div>
+                    </div>
+                    <div class="col-md-3">
+                        <span wicket:id="relation"/>
+                    </div>
                 </div>
             </div>
         </div>
-    </div>
+    </wicket:fragment>
 </wicket:extend>
 </html>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.java
index 4d561ac22dc..642aa06a13a 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MemberPopupTabPanel.java
@@ -19,20 +19,20 @@
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.prism.delta.ObjectDelta;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.logging.LoggingUtils;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.input.DropDownChoicePanel;
 import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
-import com.evolveum.midpoint.web.component.wizard.resource.component.schemahandling.modal.LimitationsEditorDialog;
 import com.evolveum.midpoint.web.page.admin.configuration.component.EmptyOnChangeAjaxFormUpdatingBehavior;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.wicket.markup.html.WebMarkupContainer;
+import org.apache.wicket.markup.html.panel.Fragment;
 import org.apache.wicket.model.Model;
 
 import javax.xml.namespace.QName;
@@ -51,11 +51,11 @@ public abstract class MemberPopupTabPanel<O extends ObjectType> extends Abstract
     private static final String ID_RELATION = "relation";
 
     private PageBase pageBase;
-    private List<RelationTypes> availableRelationList = new ArrayList<>();
+    private List<RelationTypes> supportedRelationList = new ArrayList<>();
 
-    public MemberPopupTabPanel(String id, ObjectTypes type, List<RelationTypes> availableRelationList){
-        super(id, type);
-        this.availableRelationList = availableRelationList;
+    public MemberPopupTabPanel(String id, List<RelationTypes> supportedRelationList){
+        super(id);
+        this.supportedRelationList = supportedRelationList;
     }
 
     @Override
@@ -65,7 +65,7 @@ protected void onInitialize(){
     }
 
     @Override
-    protected void initParametersPanel(){
+    protected void initParametersPanel(Fragment parametersPanel){
         WebMarkupContainer relationContainer = new WebMarkupContainer(ID_RELATION_CONTAINER);
         relationContainer.setOutputMarkupId(true);
         relationContainer.add(new VisibleEnableBehaviour(){
@@ -73,18 +73,18 @@ protected void initParametersPanel(){
 
             @Override
             public boolean isVisible(){
-                return CollectionUtils.isNotEmpty(availableRelationList);
+                return CollectionUtils.isNotEmpty(supportedRelationList);
             }
 
             @Override
             public boolean isEnabled(){
-                return CollectionUtils.isNotEmpty(availableRelationList) && availableRelationList.size() > 1;
+                return CollectionUtils.isNotEmpty(supportedRelationList) && supportedRelationList.size() > 1;
             }
         });
-        add(relationContainer);
+        parametersPanel.add(relationContainer);
 
         DropDownChoicePanel<RelationTypes> relationSelector =  new DropDownChoicePanel<RelationTypes> (ID_RELATION,
-                Model.of(getDefaultRelationValue()), Model.ofList(availableRelationList),
+                Model.of(getDefaultRelationValue()), Model.ofList(supportedRelationList),
                 WebComponentUtil.getEnumChoiceRenderer(MemberPopupTabPanel.this), false);
         relationSelector.getBaseFormComponent().add(new EmptyOnChangeAjaxFormUpdatingBehavior());
         relationSelector.setOutputMarkupId(true);
@@ -93,13 +93,13 @@ public boolean isEnabled(){
     }
 
     private RelationTypes getDefaultRelationValue(){
-        return CollectionUtils.isNotEmpty(availableRelationList) ? availableRelationList.get(0) : RelationTypes.MEMBER;
+        return CollectionUtils.isNotEmpty(supportedRelationList) ? supportedRelationList.get(0) : RelationTypes.MEMBER;
     }
 
     protected ObjectDelta prepareDelta(){
         ObjectDelta delta = null;
         try {
-            Class classType = WebComponentUtil.qnameToClass(pageBase.getPrismContext(), type.getTypeQName());
+            Class classType = WebComponentUtil.qnameToClass(pageBase.getPrismContext(), getObjectType().getTypeQName());
             delta =  ObjectDelta.createEmptyModifyDelta(classType, "fakeOid", pageBase.getPrismContext());
             AssignmentType newAssignment = new AssignmentType();
             ObjectReferenceType ref = ObjectTypeUtil.createObjectRef(getAbstractRoleTypeObject());
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MultiTypesMemberPopupTabPanel.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MultiTypesMemberPopupTabPanel.html
new file mode 100644
index 00000000000..52d55c3e983
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MultiTypesMemberPopupTabPanel.html
@@ -0,0 +1,29 @@
+<!--
+  ~ Copyright (c) 2010-2018 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!DOCTYPE html>
+<html xmlns:wicket="http://wicket.apache.org">
+<wicket:extend>
+    <div class="form-inline">
+        <div wicket:id="typeSelectPanel" class="form-group" style="padding: 5px 0px 5px 0px">
+            <label>
+                <wicket:message key="roleMemberPanel.type"/>
+            </label>
+            <select class="form-control input-sm" wicket:id="type"/>
+        </div>
+    </div>
+</wicket:extend>
+</html>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MultiTypesMemberPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MultiTypesMemberPopupTabPanel.java
new file mode 100644
index 00000000000..165fc8da5c4
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/MultiTypesMemberPopupTabPanel.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2010-2018 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.evolveum.midpoint.gui.api.component;
+
+import com.evolveum.midpoint.gui.api.model.LoadableModel;
+import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
+import org.apache.wicket.ajax.AjaxRequestTarget;
+import org.apache.wicket.ajax.form.OnChangeAjaxBehavior;
+import org.apache.wicket.markup.html.WebMarkupContainer;
+import org.apache.wicket.markup.html.form.DropDownChoice;
+import org.apache.wicket.markup.html.form.EnumChoiceRenderer;
+import org.apache.wicket.model.IModel;
+import org.apache.wicket.model.Model;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * Created by honchar.
+ */
+public abstract class MultiTypesMemberPopupTabPanel<O extends ObjectType> extends MemberPopupTabPanel<O> {
+    private static final long serialVersionUID = 1L;
+
+    private static final String ID_TYPE_SELECT_PANEL = "typeSelectPanel";
+    private static final String ID_TYPE = "type";
+
+    private ObjectTypes defaultObjectType = ObjectTypes.OBJECT_COLLECTION;
+
+    public MultiTypesMemberPopupTabPanel(String id, List<RelationTypes> supportedRelationsList){
+        super(id, supportedRelationsList);
+    }
+
+    @Override
+    protected void onInitialize(){
+        super.onInitialize();
+        WebMarkupContainer typePanel = new WebMarkupContainer(ID_TYPE_SELECT_PANEL);
+        typePanel.setOutputMarkupId(true);
+        add(typePanel);
+
+        DropDownChoice<ObjectTypes> typeSelect = new DropDownChoice<>(ID_TYPE, new LoadableModel<ObjectTypes>() {
+            @Override
+            protected ObjectTypes load() {
+                return defaultObjectType;
+            }
+        },
+                getSupportedTypesList(), new EnumChoiceRenderer<>(this));
+        typeSelect.add(new OnChangeAjaxBehavior() {
+
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            protected void onUpdate(AjaxRequestTarget target) {
+                defaultObjectType = typeSelect.getModelObject();
+                MultiTypesMemberPopupTabPanel.this.addOrReplace(initObjectListPanel());
+                target.add(MultiTypesMemberPopupTabPanel.this);
+            }
+        });
+        typePanel.add(typeSelect);
+
+        add(typePanel);
+    }
+
+    protected List<ObjectTypes> getSupportedTypesList(){
+        List<ObjectTypes> supportedTypes = new ArrayList<>(Arrays.asList(ObjectTypes.values()));
+        supportedTypes.remove(ObjectTypes.USER);
+        supportedTypes.remove(ObjectTypes.ROLE);
+        supportedTypes.remove(ObjectTypes.SERVICE);
+        supportedTypes.remove(ObjectTypes.ORG);
+        supportedTypes.remove(ObjectTypes.FOCUS_TYPE);
+        supportedTypes.remove(ObjectTypes.ABSTRACT_ROLE);
+        supportedTypes.remove(ObjectTypes.NODE);
+        supportedTypes.remove(ObjectTypes.SHADOW);
+
+        return supportedTypes;
+    }
+
+    @Override
+    protected ObjectTypes getObjectType(){
+        return defaultObjectType;
+    }
+}
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectBrowserPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectBrowserPanel.java
index 9fc88daa53a..643890f635f 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectBrowserPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectBrowserPanel.java
@@ -224,6 +224,16 @@ public int getHeight() {
 		return 700;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return parentPage.createStringResource("ObjectBrowserPanel.chooseObject");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgChooseMemberPopup.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgChooseMemberPopup.java
deleted file mode 100644
index 4568a60f0aa..00000000000
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgChooseMemberPopup.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (c) 2010-2018 Evolveum
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.evolveum.midpoint.gui.api.component;
-
-/**
- * Created by honchar
- */
-
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
-import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
-import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
-import org.apache.wicket.extensions.markup.html.tabs.ITab;
-
-import java.util.ArrayList;
-import java.util.List;
-
-public abstract class OrgChooseMemberPopup<O extends ObjectType> extends ChooseMemberPopup<O, OrgType> {
-    private static final long serialVersionUID = 1L;
-
-    public OrgChooseMemberPopup(String id, List<RelationTypes> availableRelationList){
-        super(id, availableRelationList);
-    }
-
-    @Override
-    protected List<ITab> createAssignmentTabs() {
-        List<ITab> tabs = super.createAssignmentTabs();
-//        tabs.
-        return tabs;
-    }
-
-}
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeAssignmentPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeAssignmentPopupTabPanel.java
index ad5decb0cf9..31c73db50c5 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeAssignmentPopupTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeAssignmentPopupTabPanel.java
@@ -82,6 +82,11 @@ protected boolean isAssignButtonVisible(){
 
     }
 
+    @Override
+    protected ObjectTypes getObjectType(){
+        return ObjectTypes.ORG;
+    }
+
     @Override
     protected boolean isObjectListPanelVisible(){
         return false;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeMemberPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeMemberPopupTabPanel.java
index be0398d26a4..44f59ae5d59 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeMemberPopupTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/OrgTreeMemberPopupTabPanel.java
@@ -16,7 +16,7 @@
 package com.evolveum.midpoint.gui.api.component;
 
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.web.component.util.SelectableBean;
 import com.evolveum.midpoint.web.page.admin.orgs.OrgTreeAssignablePanel;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
@@ -37,7 +37,7 @@ public abstract class OrgTreeMemberPopupTabPanel extends MemberPopupTabPanel<Org
     private static final String ID_ORG_TREE_VIEW_PANEL = "orgTreeViewPanel";
 
     public OrgTreeMemberPopupTabPanel(String id, List<RelationTypes> availableRelationList){
-        super(id, ObjectTypes.ORG, availableRelationList);
+        super(id, availableRelationList);
     }
 
     @Override
@@ -89,11 +89,10 @@ protected List getSelectedObjectsList(){
         return getPreselectedObjects();
     }
 
-//    @Override
-//    protected List<AssignmentType> getSelectedAssignmentsMap(){
-//        isOrgTreeView = true;
-//        return super.getSelectedAssignmentsMap();
-//    }
+    @Override
+    protected ObjectTypes getObjectType(){
+        return ObjectTypes.ORG;
+    }
 
     protected void onOrgTreeCheckBoxSelectionPerformed(AjaxRequestTarget target){}
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.html
index 023b38a5f13..06c44cbc2f9 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.html
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.html
@@ -17,30 +17,38 @@
 <!DOCTYPE html>
 <html xmlns:wicket="http://wicket.apache.org">
 <wicket:extend>
-    <div class="form-inline search-form">
-        <div class="row">
-            <div class="col-md-4">
-                <label><wicket:message key="AssignmentPanel.newAssignmentParameters" /></label>
-            </div>
-        </div>
-        <div class="row">
-            <div wicket:id="kindContainer"  class="form-group col-md-5">
-                <div class="col-md-3" >
-                    <div><wicket:message key="TypedAssignablePanel.Kind"/></div>
-                </div>
-                <div class="col-md-6" >
-                    <span wicket:id="kind"/>
+    <wicket:fragment wicket:id="parametersPanelFragment">
+        <div class="form-inline search-form">
+            <div class="row">
+                <div class="col-md-4">
+                    <label>
+                        <wicket:message key="AssignmentPanel.newAssignmentParameters"/>
+                    </label>
                 </div>
             </div>
-            <div wicket:id="intentContainer"  class="form-group col-md-5">
-                <div class="col-md-3" >
-                    <div><wicket:message key="TypedAssignablePanel.Intent"/></div>
+            <div class="row">
+                <div wicket:id="kindContainer" class="form-group col-md-5">
+                    <div class="col-md-3">
+                        <div>
+                            <wicket:message key="TypedAssignablePanel.Kind"/>
+                        </div>
+                    </div>
+                    <div class="col-md-6">
+                        <span wicket:id="kind"/>
+                    </div>
                 </div>
-                <div class="col-md-6" >
-                    <span wicket:id="intent"/>
+                <div wicket:id="intentContainer" class="form-group col-md-5">
+                    <div class="col-md-3">
+                        <div>
+                            <wicket:message key="TypedAssignablePanel.Intent"/>
+                        </div>
+                    </div>
+                    <div class="col-md-6">
+                        <span wicket:id="intent"/>
+                    </div>
                 </div>
             </div>
         </div>
-    </div>
+    </wicket:fragment>
 </wicket:extend>
 </html>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.java
index 552508ac872..93072fa82a9 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ResourceTypeAssignmentPopupTabPanel.java
@@ -20,12 +20,12 @@
 import com.evolveum.midpoint.gui.api.model.LoadableModel;
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.input.DropDownChoicePanel;
 import com.evolveum.midpoint.web.component.util.SelectableBean;
 import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
@@ -37,6 +37,7 @@
 import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.ajax.form.AjaxFormComponentUpdatingBehavior;
 import org.apache.wicket.markup.html.WebMarkupContainer;
+import org.apache.wicket.markup.html.panel.Fragment;
 import org.apache.wicket.model.IModel;
 import org.apache.wicket.model.Model;
 
@@ -67,12 +68,12 @@ public ResourceTypeAssignmentPopupTabPanel(String id){
     }
 
     @Override
-    protected void initParametersPanel(){
+    protected void initParametersPanel(Fragment parametersPanel){
         initModels();
 
         WebMarkupContainer kindContainer = new WebMarkupContainer(ID_KIND_CONTAINER);
         kindContainer.setOutputMarkupId(true);
-        add(kindContainer);
+        parametersPanel.add(kindContainer);
 
         DropDownChoicePanel<ShadowKindType> kindSelector = WebComponentUtil.createEnumPanel(ShadowKindType.class, ID_KIND,
                 WebComponentUtil.createReadonlyModelFromEnum(ShadowKindType.class), Model.of(),
@@ -100,7 +101,7 @@ public boolean isEnabled(){
 
         WebMarkupContainer intentContainer = new WebMarkupContainer(ID_INTENT_CONTAINER);
         intentContainer.setOutputMarkupId(true);
-        add(intentContainer);
+        parametersPanel.add(intentContainer);
 
         DropDownChoicePanel<String> intentSelector = new DropDownChoicePanel<String>(ID_INTENT,
                 Model.of(), intentValues, true);
@@ -183,6 +184,11 @@ private DropDownChoicePanel<ShadowKindType> getKindDropDown(){
         return (DropDownChoicePanel<ShadowKindType>)get(ID_KIND_CONTAINER).get(ID_KIND);
     }
 
+    @Override
+    protected ObjectTypes getObjectType(){
+        return ObjectTypes.RESOURCE;
+    }
+
     @Override
     protected void onSelectionPerformed(AjaxRequestTarget target){
         target.add(getObjectListPanel());
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/TypedAssignablePanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/TypedAssignablePanel.java
index 331108d96d2..367d98f31dd 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/TypedAssignablePanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/TypedAssignablePanel.java
@@ -27,6 +27,7 @@
 import com.evolveum.midpoint.prism.query.ObjectFilter;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.task.api.Task;
@@ -55,7 +56,6 @@
 import com.evolveum.midpoint.gui.api.page.PageBase;
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.web.component.AjaxButton;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.dialog.Popupable;
 import com.evolveum.midpoint.web.component.input.DropDownChoicePanel;
 import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
@@ -503,6 +503,16 @@ public int getHeight() {
 		return 500;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return PageBase.createStringResourceStatic(TypedAssignablePanel.this, "TypedAssignablePanel.selectObjects");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/result/OperationResultPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/result/OperationResultPanel.java
index 4cb171232f8..63d58a85292 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/result/OperationResultPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/result/OperationResultPanel.java
@@ -732,6 +732,16 @@ public int getHeight() {
 		return 500;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return new StringResourceModel("OperationResultPanel.result");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/FocusTabVisibleBehavior.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/FocusTabVisibleBehavior.java
index c130237a91a..e3b31f7f916 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/FocusTabVisibleBehavior.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/FocusTabVisibleBehavior.java
@@ -46,10 +46,14 @@ public class FocusTabVisibleBehavior<T extends ObjectType> extends VisibleEnable
 
     private IModel<PrismObject<T>> objectModel;
     private String uiAuthorizationUrl;
+    private boolean visibleOnHistoryPage = false;
+    private boolean isHistoryPage = false;
 
-    public FocusTabVisibleBehavior(IModel<PrismObject<T>> objectModel, String uiAuthorizationUrl) {
+    public FocusTabVisibleBehavior(IModel<PrismObject<T>> objectModel, String uiAuthorizationUrl, boolean visibleOnHistoryPage, boolean isHistoryPage) {
         this.objectModel = objectModel;
         this.uiAuthorizationUrl = uiAuthorizationUrl;
+        this.visibleOnHistoryPage = visibleOnHistoryPage;
+        this.isHistoryPage = isHistoryPage;
     }
 
     private ModelInteractionService getModelInteractionService() {
@@ -83,13 +87,13 @@ public boolean isVisible() {
         // find all object form definitions for specified type, if there is none we'll show all default tabs
         List<ObjectFormType> forms = findObjectForm(config, type);
         if (forms.isEmpty()) {
-            return true;
+            return !isHistoryPage || visibleOnHistoryPage;
         }
 
         // we'll try to find includeDefault, if there is includeDefault=true, we can return true (all tabs visible)
         for (ObjectFormType form : forms) {
             if (BooleanUtils.isTrue(form.isIncludeDefaultForms())) {
-                return true;
+                return !isHistoryPage || visibleOnHistoryPage;
             }
         }
 
@@ -100,7 +104,7 @@ public boolean isVisible() {
             }
 
             if (ObjectUtils.equals(uiAuthorizationUrl, spec.getPanelUri())) {
-                return true;
+                return !isHistoryPage || visibleOnHistoryPage;
             }
         }
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AbstractRoleAssignmentPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AbstractRoleAssignmentPanel.java
index c020a07f014..fba1cc3489a 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AbstractRoleAssignmentPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AbstractRoleAssignmentPanel.java
@@ -26,6 +26,7 @@
 import com.evolveum.midpoint.gui.api.component.AssignmentPopup;
 import com.evolveum.midpoint.prism.PrismContainerValue;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.web.component.prism.*;
 import com.evolveum.midpoint.web.page.admin.PageAdminFocus;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentActivationPopupablePanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentActivationPopupablePanel.java
index 1b9273e09de..50caabfb269 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentActivationPopupablePanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentActivationPopupablePanel.java
@@ -159,6 +159,16 @@ public int getHeight(){
         return 300;
     }
 
+    @Override
+    public String getWidthUnit(){
+        return "px";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "px";
+    }
+
     @Override
     public StringResourceModel getTitle(){
         return createStringResource("AssignmentActivationPopupPanel.title");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentDto.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentDto.java
index 82d588f1f82..bd68c9e6854 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentDto.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentDto.java
@@ -23,6 +23,7 @@
 import org.apache.commons.lang.Validate;
 
 import com.evolveum.midpoint.prism.delta.ItemDelta;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.web.component.util.Selectable;
 import com.evolveum.midpoint.web.page.admin.users.dto.UserDtoStatus;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorDto.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorDto.java
index 84346b1fce7..8043868d375 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorDto.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorDto.java
@@ -28,6 +28,7 @@
 import com.evolveum.midpoint.prism.*;
 import com.evolveum.midpoint.prism.path.ItemPath;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
 import com.evolveum.midpoint.web.page.admin.users.component.AssignmentInfoDto;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorPanel.java
index 4f4391db9fa..19a4b63e025 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentEditorPanel.java
@@ -34,6 +34,7 @@
 import com.evolveum.midpoint.prism.query.builder.QueryBuilder;
 import com.evolveum.midpoint.schema.GetOperationOptions;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.security.enforcer.api.ItemSecurityConstraints;
 import com.evolveum.midpoint.task.api.Task;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentsUtil.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentsUtil.java
index 3fde4f0850d..4bfc447a8f9 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentsUtil.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/AssignmentsUtil.java
@@ -6,6 +6,7 @@
 import javax.xml.datatype.XMLGregorianCalendar;
 import javax.xml.namespace.QName;
 
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.util.QNameUtil;
 import com.evolveum.midpoint.web.component.prism.ContainerValueWrapper;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/RelationTypes.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/RelationTypes.java
deleted file mode 100755
index 9ee2d6c0498..00000000000
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/RelationTypes.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright (c) 2010-2017 Evolveum
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.evolveum.midpoint.web.component.assignment;
-
-import com.evolveum.midpoint.schema.constants.SchemaConstants;
-import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
-import com.evolveum.midpoint.util.QNameUtil;
-
-import javax.xml.namespace.QName;
-
-/**
- * Created by honchar.
- */
-public enum RelationTypes {
-
-	MEMBER(SchemaConstants.ORG_DEFAULT, ""),
-    MANAGER(SchemaConstants.ORG_MANAGER, "Manager"),
-    OWNER(SchemaConstants.ORG_OWNER, "Owner"),
-    APPROVER(SchemaConstants.ORG_APPROVER, "Approver");
-
-
-    private QName relation;
-    private String headerLabel;
-
-    RelationTypes(QName relation, String headerLabel) {
-        this.relation = relation;
-        this.headerLabel = headerLabel;
-    }
-
-    public QName getRelation() {
-        return relation;
-    }
-
-    public String getHeaderLabel() {
-        return headerLabel;
-    }
-
-    public static RelationTypes getRelationType(QName relation) {
-        if (ObjectTypeUtil.isDefaultRelation(relation)) {
-            return RelationTypes.MEMBER;
-        }
-        for (RelationTypes relationTypes : RelationTypes.values()) {
-            if (QNameUtil.match(relation, relationTypes.getRelation())) {
-                return relationTypes;
-            }
-        }
-        return RelationTypes.MEMBER;
-    }
-}
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/RoleCatalogItemButton.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/RoleCatalogItemButton.java
index bf6978a6b74..f426537b8b1 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/RoleCatalogItemButton.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/assignment/RoleCatalogItemButton.java
@@ -21,6 +21,7 @@
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.gui.api.util.WebModelServiceUtils;
 import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.task.api.Task;
 import com.evolveum.midpoint.util.logging.Trace;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ChooseFocusTypeDialogPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ChooseFocusTypeDialogPanel.java
index 3da1f596c87..2c9d163a4c0 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ChooseFocusTypeDialogPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ChooseFocusTypeDialogPanel.java
@@ -62,6 +62,16 @@ public int getHeight() {
 		return 100;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return new StringResourceModel("ChooseFocusTypeDialogPanel.chooseType");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ConfirmationPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ConfirmationPanel.java
index 414546bd591..331de522a4f 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ConfirmationPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/ConfirmationPanel.java
@@ -137,6 +137,16 @@ public int getHeight() {
 		return 150;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return new StringResourceModel("AssignmentTablePanel.modal.title.confirmDeletion");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/DeleteAllPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/DeleteAllPanel.java
index b02b2a05ef6..e4f3e970829 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/DeleteAllPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/DeleteAllPanel.java
@@ -350,6 +350,16 @@ public int getHeight() {
         return 350;
     }
 
+    @Override
+    public String getWidthUnit(){
+        return "px";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "px";
+    }
+
     @Override
     public StringResourceModel getTitle() {
         return createStringResource("pageDebugList.dialog.title.deleteAll");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/HelpInfoPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/HelpInfoPanel.java
index e2fca8fc7b0..e39693cd0b0 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/HelpInfoPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/HelpInfoPanel.java
@@ -63,7 +63,17 @@ public int getHeight() {
 		return 600;
 	}
 
-	@Override
+    @Override
+    public String getWidthUnit(){
+        return "px";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "px";
+    }
+
+    @Override
 	public StringResourceModel getTitle() {
 		return new StringResourceModel("ChangePasswordPanel.helpPopupTitle");
 	}
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/MainPopupDialog.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/MainPopupDialog.java
index 98149fdcf57..af138456638 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/MainPopupDialog.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/MainPopupDialog.java
@@ -18,10 +18,13 @@
 
 import org.apache.wicket.Component;
 import org.apache.wicket.ajax.AjaxRequestTarget;
+import org.apache.wicket.core.request.handler.IPartialPageRequestHandler;
 import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
+import org.apache.wicket.markup.ComponentTag;
 import org.apache.wicket.markup.html.WebMarkupContainer;
 import org.apache.wicket.markup.html.basic.Label;
 import org.apache.wicket.model.Model;
+import org.apache.wicket.util.string.AppendingStringBuffer;
 
 /**
  * @author Viliam Repan (lazyman)
@@ -91,6 +94,8 @@ public void setBody(Popupable popupable){
     	setTitle(popupable.getTitle());
     	setInitialHeight(popupable.getHeight());
     	setInitialWidth(popupable.getWidth());
+    	setHeightUnit(popupable.getHeightUnit());
+    	setWidthUnit(popupable.getWidthUnit());
     	WebMarkupContainer content = (WebMarkupContainer) get(getContentId());
     	popupable.getComponent().setOutputMarkupId(true);
     	content.addOrReplace(popupable.getComponent());
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/Popupable.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/Popupable.java
index a1e3b532ccc..a7625afaadc 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/Popupable.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/dialog/Popupable.java
@@ -22,6 +22,8 @@ public interface Popupable {
 
 	public int getWidth();
 	public int getHeight();
+	public String getWidthUnit();
+	public String getHeightUnit();
 	public StringResourceModel getTitle();
 	public Component getComponent();
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/AbstractRoleMainPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/AbstractRoleMainPanel.java
index b7cc955de85..664ac2ab1b6 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/AbstractRoleMainPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/AbstractRoleMainPanel.java
@@ -18,6 +18,8 @@
 import com.evolveum.midpoint.gui.api.ComponentConstants;
 import com.evolveum.midpoint.gui.api.page.PageBase;
 import com.evolveum.midpoint.gui.api.util.FocusTabVisibleBehavior;
+import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
+import com.evolveum.midpoint.model.api.ModelAuthorizationAction;
 import com.evolveum.midpoint.prism.PrismObject;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
 import com.evolveum.midpoint.prism.query.builder.QueryBuilder;
@@ -189,7 +191,7 @@ private Class getPreviousPage(PageAdminObjectDetails<R> parentPage){
 	protected List<ITab> createTabs(final PageAdminObjectDetails<R> parentPage) {
 		List<ITab> tabs = super.createTabs(parentPage);
 
-		FocusTabVisibleBehavior authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_POLICY_RULES_URL);
+		FocusTabVisibleBehavior<R> authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_POLICY_RULES_URL, false, isFocusHistoryPage());
 		tabs.add(
 				new CountablePanelTab(parentPage.createStringResource("pageAdminFocus.policyRules"), authorization) {
 
@@ -206,7 +208,7 @@ public String getCount() {
 					}
 				});
 
-		authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_APPLICABLE_POLICIES_URL);
+		authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_APPLICABLE_POLICIES_URL, false, isFocusHistoryPage());
 		tabs.add(
 				new PanelTab(parentPage.createStringResource("pageAdminFocus.applicablePolicies"), authorization) {
 
@@ -218,8 +220,8 @@ public WebMarkupContainer createPanel(String panelId) {
 					}
 				});
 
-		authorization = new FocusTabVisibleBehavior(unwrapModel(),
-				ComponentConstants.UI_FOCUS_TAB_INDUCEMENTS_URL);
+		authorization = new FocusTabVisibleBehavior<>(unwrapModel(),
+				ComponentConstants.UI_FOCUS_TAB_INDUCEMENTS_URL, false, isFocusHistoryPage());
 		tabs.add(new CountablePanelTab(parentPage.createStringResource("FocusType.inducement"), authorization) {
 
 			private static final long serialVersionUID = 1L;
@@ -235,8 +237,8 @@ public String getCount(){
 			}
 
 		});
-		authorization = new FocusTabVisibleBehavior(unwrapModel(),
-				ComponentConstants.UI_ROLE_TAB_INDUCED_ENTITLEMENTS_URL);
+		authorization = new FocusTabVisibleBehavior<>(unwrapModel(),
+				ComponentConstants.UI_ROLE_TAB_INDUCED_ENTITLEMENTS_URL, false, isFocusHistoryPage());
 		tabs.add(new CountablePanelTab(parentPage.createStringResource("AbstractRoleMainPanel.inducedEntitlements"), authorization) {
 
 			private static final long serialVersionUID = 1L;
@@ -253,8 +255,22 @@ public String getCount(){
 
 		});
 
-		authorization = new FocusTabVisibleBehavior(unwrapModel(),
-				ComponentConstants.UI_FOCUS_TAB_MEMBERS_URL);
+		if (WebComponentUtil.isAuthorized(ModelAuthorizationAction.AUDIT_READ.getUrl()) && getObjectWrapper().getStatus() != ContainerStatus.ADDING){
+			authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_OBJECT_HISTORY_URL, false, isFocusHistoryPage());
+			tabs.add(
+					new PanelTab(parentPage.createStringResource("pageAdminFocus.objectHistory"), authorization) {
+
+						private static final long serialVersionUID = 1L;
+
+						@Override
+						public WebMarkupContainer createPanel(String panelId) {
+							return createObjectHistoryTabPanel(panelId, parentPage);
+						}
+					});
+		}
+
+		authorization = new FocusTabVisibleBehavior<>(unwrapModel(),
+				ComponentConstants.UI_FOCUS_TAB_MEMBERS_URL, false, isFocusHistoryPage());
 		tabs.add(new PanelTab(parentPage.createStringResource("pageRole.members"), authorization) {
 
 			private static final long serialVersionUID = 1L;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/FocusMainPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/FocusMainPanel.java
index d705a0c762e..fc9922f495e 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/FocusMainPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/FocusMainPanel.java
@@ -21,7 +21,9 @@
 import com.evolveum.midpoint.gui.api.model.LoadableModel;
 import com.evolveum.midpoint.gui.api.page.PageBase;
 import com.evolveum.midpoint.gui.api.util.FocusTabVisibleBehavior;
+import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.gui.api.util.WebModelServiceUtils;
+import com.evolveum.midpoint.model.api.ModelAuthorizationAction;
 import com.evolveum.midpoint.prism.PrismObject;
 import com.evolveum.midpoint.prism.path.ItemPath;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
@@ -35,20 +37,19 @@
 import com.evolveum.midpoint.web.component.assignment.AssignmentsUtil;
 import com.evolveum.midpoint.web.component.assignment.GenericAbstractRoleAssignmentPanel;
 import com.evolveum.midpoint.web.component.form.Form;
-import com.evolveum.midpoint.web.component.prism.ContainerValueWrapper;
-import com.evolveum.midpoint.web.component.prism.ContainerWrapper;
-import com.evolveum.midpoint.web.component.prism.ObjectWrapper;
-import com.evolveum.midpoint.web.component.prism.ValueStatus;
+import com.evolveum.midpoint.web.component.prism.*;
 import com.evolveum.midpoint.web.model.ContainerWrapperFromObjectWrapperModel;
 import com.evolveum.midpoint.web.page.admin.PageAdminFocus;
 import com.evolveum.midpoint.web.page.admin.PageAdminObjectDetails;
 import com.evolveum.midpoint.web.page.admin.server.dto.TaskDtoProvider;
 import com.evolveum.midpoint.web.page.admin.server.dto.TaskDtoProviderOptions;
+import com.evolveum.midpoint.web.page.admin.users.PageUserHistory;
 import com.evolveum.midpoint.web.page.admin.users.dto.FocusSubwrapperDto;
 import com.evolveum.midpoint.web.util.OnePageParameterEncoder;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang.Validate;
+import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.extensions.markup.html.tabs.ITab;
 import org.apache.wicket.markup.html.WebMarkupContainer;
 import org.apache.wicket.model.AbstractReadOnlyModel;
@@ -224,7 +225,14 @@ protected AssignmentPanel createPanel(String panelId, ContainerWrapperFromObject
 	}
 
 	protected WebMarkupContainer createObjectHistoryTabPanel(String panelId, PageAdminObjectDetails<F> parentPage) {
-		return new ObjectHistoryTabPanel<>(panelId, getMainForm(), getObjectModel(), parentPage);
+		return new ObjectHistoryTabPanel<F>(panelId, getMainForm(), getObjectModel(), parentPage){
+			protected void currentStateButtonClicked(AjaxRequestTarget target, PrismObject<F> object, String date){
+				viewObjectHistoricalDataPerformed(target, object, date);
+			}
+		};
+	}
+
+	protected void viewObjectHistoricalDataPerformed(AjaxRequestTarget target, PrismObject<F> object, String date){
 	}
 
 	protected IModel<PrismObject<F>> unwrapModel() {
@@ -241,8 +249,8 @@ protected void addSpecificTabs(final PageAdminObjectDetails<F> parentPage, List<
     }
 
     protected void addDefaultTabs(final PageAdminObjectDetails<F> parentPage, List<ITab> tabs) {
-		FocusTabVisibleBehavior authorization = new FocusTabVisibleBehavior(unwrapModel(),
-				ComponentConstants.UI_FOCUS_TAB_BASIC_URL);
+		FocusTabVisibleBehavior<F> authorization = new FocusTabVisibleBehavior<F>(unwrapModel(),
+				ComponentConstants.UI_FOCUS_TAB_BASIC_URL, true, isFocusHistoryPage());
 
 		tabs.add(
 				new PanelTab(parentPage.createStringResource("pageAdminFocus.basic"), authorization){
@@ -255,7 +263,7 @@ public WebMarkupContainer createPanel(String panelId) {
 					}
 				});
 
-		authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_PROJECTIONS_URL);
+		authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_PROJECTIONS_URL, false, isFocusHistoryPage());
 		tabs.add(
                 new CountablePanelTab(parentPage.createStringResource("pageAdminFocus.projections"), authorization){
 
@@ -272,7 +280,7 @@ public String getCount() {
 					}
 				});
 
-		authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_ASSIGNMENTS_URL);
+		authorization = new FocusTabVisibleBehavior<F>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_ASSIGNMENTS_URL, true, isFocusHistoryPage());
 		tabs.add(
 				new CountablePanelTab(parentPage.createStringResource("pageAdminFocus.assignments"), authorization) {
 
@@ -289,7 +297,7 @@ public String getCount() {
 					}
 				});
 		
-		authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_ASSIGNMENTS_URL);
+		authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_ASSIGNMENTS_URL, false, isFocusHistoryPage());
 		
 		if (WebModelServiceUtils.isEnableExperimentalFeature(parentPage)) {
 			tabs.add(new CountablePanelTab(parentPage.createStringResource("pageAdminFocus.dataProtection"), authorization) {
@@ -327,9 +335,22 @@ public String getCount() {
 				}
 			});
 		}
-		
 
-		authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_TASKS_URL);
+		if (WebComponentUtil.isAuthorized(ModelAuthorizationAction.AUDIT_READ.getUrl()) && getObjectWrapper().getStatus() != ContainerStatus.ADDING){
+			authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_OBJECT_HISTORY_URL, false, isFocusHistoryPage());
+			tabs.add(
+					new PanelTab(parentPage.createStringResource("pageAdminFocus.objectHistory"), authorization) {
+
+						private static final long serialVersionUID = 1L;
+
+						@Override
+						public WebMarkupContainer createPanel(String panelId) {
+							return createObjectHistoryTabPanel(panelId, parentPage);
+						}
+					});
+		}
+
+		authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_TASKS_URL, false, isFocusHistoryPage());
 		tabs.add(
 				new CountablePanelTab(parentPage.createStringResource("pageAdminFocus.tasks"), authorization) {
 
@@ -348,6 +369,10 @@ public String getCount() {
 
 	}
 
+	protected boolean isFocusHistoryPage(){
+		return false;
+	}
+
 	@Override
     protected boolean areSavePreviewButtonsEnabled(){
         return isAssignmentsModelChanged();
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/ObjectHistoryTabPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/ObjectHistoryTabPanel.java
index 6c88fe0b0d5..87e7d6b6ed9 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/ObjectHistoryTabPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/ObjectHistoryTabPanel.java
@@ -60,7 +60,7 @@
 /**
  * Created by honchar.
  */
-public class ObjectHistoryTabPanel<F extends FocusType> extends AbstractObjectTabPanel<F> {
+public abstract class ObjectHistoryTabPanel<F extends FocusType> extends AbstractObjectTabPanel<F> {
 
     private static final long serialVersionUID = 1L;
 
@@ -107,10 +107,9 @@ protected AjaxIconButton createButton(int index, String componentId, IModel<Audi
                                                 createStringResource("ObjectHistoryTabPanel.viewHistoricalObjectDataTitle"),
                                                 new Model<>("btn btn-sm " + DoubleButtonColumn.BUTTON_COLOR_CLASS.INFO),
                                                 target ->
-                                                        currentStateButtonClicked(target, focusWrapperModel.getObject().getOid(),
-                                                                model.getObject().getEventIdentifier(),
-                                                                WebComponentUtil.getLocalizedDate(model.getObject().getTimestamp(), DateLabelComponent.SHORT_NOTIME_STYLE),
-                                                                page.getCompileTimeClass()));
+                                                        currentStateButtonClicked(target, getReconstructedObject(focusWrapperModel.getObject().getOid(),
+                                                                model.getObject().getEventIdentifier(), page.getCompileTimeClass()),
+                                                                WebComponentUtil.getLocalizedDate(model.getObject().getTimestamp(), DateLabelComponent.SHORT_NOTIME_STYLE)));
                                         break;
                                     case 1:
                                         btn = buildDefaultButton(componentId, new Model<>(GuiStyleConstants.CLASS_FILE_TEXT),
@@ -173,11 +172,7 @@ private AuditSearchDto createAuditSearchDto(F focus) {
         return searchDto;
     }
 
-    private void currentStateButtonClicked(AjaxRequestTarget target, String oid, String eventIdentifier,
-                                           String date, Class type) {
-        //TODO cases for PageRoleHistory, PageOrgHistory if needed...
-        getPageBase().navigateToNext(new PageUserHistory((PrismObject<UserType>) getReconstructedObject(oid, eventIdentifier, type), date));
-    }
+    protected abstract void currentStateButtonClicked(AjaxRequestTarget target, PrismObject<F> object, String date);
 
     private PrismObject<F> getReconstructedObject(String oid, String eventIdentifier,
                                                   Class type) {
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/RoleMainPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/RoleMainPanel.java
index 2a046b04bfe..e6e6e81ba24 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/RoleMainPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/objectdetails/RoleMainPanel.java
@@ -26,7 +26,7 @@
 import com.evolveum.midpoint.gui.api.component.tabs.PanelTab;
 import com.evolveum.midpoint.gui.api.model.LoadableModel;
 import com.evolveum.midpoint.gui.api.util.FocusTabVisibleBehavior;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.web.component.prism.ContainerStatus;
 import com.evolveum.midpoint.web.component.prism.ObjectWrapper;
 import com.evolveum.midpoint.web.page.admin.PageAdminFocus;
@@ -55,8 +55,8 @@ public RoleMainPanel(String id, LoadableModel<ObjectWrapper<RoleType>> objectMod
 	protected List<ITab> createTabs(final PageAdminObjectDetails<RoleType> parentPage) {
 		List<ITab> tabs = super.createTabs(parentPage);
 
-		FocusTabVisibleBehavior authorization = new FocusTabVisibleBehavior(unwrapModel(),
-				ComponentConstants.UI_FOCUS_TAB_GOVERNANCE_URL);
+		FocusTabVisibleBehavior<RoleType> authorization = new FocusTabVisibleBehavior<>(unwrapModel(),
+				ComponentConstants.UI_FOCUS_TAB_GOVERNANCE_URL, false, isFocusHistoryPage());
 
 		tabs.add(new PanelTab(parentPage.createStringResource("pageRole.governance"), authorization) {
 
@@ -73,28 +73,6 @@ public boolean isVisible() {
 			}
 		});
 
-		authorization = new FocusTabVisibleBehavior(unwrapModel(),
-				ComponentConstants.UI_FOCUS_TAB_POLICY_CONSTRAINTS_URL);
-
-	
-		authorization = new FocusTabVisibleBehavior(unwrapModel(),
-				ComponentConstants.UI_FOCUS_TAB_MEMBERS_URL);
-
-//		tabs.add(new PanelTab(parentPage.createStringResource("pageRole.members"), authorization) {
-//
-//			private static final long serialVersionUID = 1L;
-//
-//			@Override
-//			public WebMarkupContainer createPanel(String panelId) {
-//				return new RoleMemberPanel(panelId, new Model<RoleType>(getObject().asObjectable()), getDetailsPage());
-//			}
-//
-//			@Override
-//			public boolean isVisible() {
-//				return getObjectWrapper().getStatus() != ContainerStatus.ADDING;
-//			}
-//		});
-
 		return tabs;
 	}
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/prism/ObjectWrapperFactory.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/prism/ObjectWrapperFactory.java
index 9b737d08b6f..2e3c9f7c803 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/prism/ObjectWrapperFactory.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/prism/ObjectWrapperFactory.java
@@ -99,11 +99,32 @@ public OperationResult getResult() {
 
     public <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displayName,
             String description, PrismObject<O> object, ContainerStatus status, Task task) {
-        return createObjectWrapper(displayName, description, object, status, AuthorizationPhaseType.REQUEST, task);
+        return createObjectWrapper(displayName, description, object, status, AuthorizationPhaseType.REQUEST, false, task);
+    }
+
+	/**
+	 *
+	 * @param displayName
+	 * @param description
+	 * @param object
+	 * @param status
+	 * @param entirelyReadonly  every child item wrapper will be set to this value
+	 * @param task
+	 * @param <O>
+	 * @return
+	 */
+    public <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displayName,
+            String description, PrismObject<O> object, ContainerStatus status, boolean entirelyReadonly, Task task) {
+        return createObjectWrapper(displayName, description, object, status, AuthorizationPhaseType.REQUEST, entirelyReadonly, task);
     }
 
     public <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displayName, String description,
 			PrismObject<O> object, ContainerStatus status, AuthorizationPhaseType authorizationPhase, Task task) {
+		return createObjectWrapper(displayName, description, object, status, authorizationPhase, false, task);
+	}
+
+    public <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displayName, String description,
+			PrismObject<O> object, ContainerStatus status, AuthorizationPhaseType authorizationPhase, boolean entirelyReadonly, Task task) {
         if (authorizationPhase == null) {
             authorizationPhase = AuthorizationPhaseType.REQUEST;
         }
@@ -133,7 +154,7 @@ public <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displa
                 
             }
             return createObjectWrapper(displayName, description, object, objectDefinitionForEditing,
-                    objectClassDefinitionForEditing, status, task, result);
+                    objectClassDefinitionForEditing, status, entirelyReadonly, task, result);
         } catch (SchemaException | ConfigurationException | ObjectNotFoundException | ExpressionEvaluationException | CommunicationException | SecurityViolationException ex) {
             throw new SystemException(ex);
         }
@@ -143,12 +164,12 @@ public <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displa
 			String description, PrismObject<O> object, PrismObjectDefinition<O> objectDefinitionForEditing,
 			RefinedObjectClassDefinition objectClassDefinitionForEditing, ContainerStatus status, Task task) throws SchemaException {
         return createObjectWrapper(displayName, description, object, objectDefinitionForEditing,
-                objectClassDefinitionForEditing, status, task, null);
+                objectClassDefinitionForEditing, status, false, task, null);
     }
 
     private <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displayName,
 			String description, PrismObject<O> object, PrismObjectDefinition<O> objectDefinitionForEditing,
-			RefinedObjectClassDefinition objectClassDefinitionForEditing, ContainerStatus status,
+			RefinedObjectClassDefinition objectClassDefinitionForEditing, ContainerStatus status, boolean entirelyReadonly,
 			Task task, OperationResult result) throws SchemaException {
 
         if (result == null) {
@@ -163,6 +184,9 @@ private <O extends ObjectType> ObjectWrapper<O> createObjectWrapper(String displ
 		List<ContainerWrapper<? extends Containerable>> containerWrappers = createContainerWrappers(objectWrapper, object,
 				objectDefinitionForEditing, status, task, this.result);
 		objectWrapper.setContainers(containerWrappers);
+		if (entirelyReadonly) {
+			setObjectWrapperValuesReadOnlyState(objectWrapper, entirelyReadonly);
+		}
 
         this.result.computeStatusIfUnknown();
 
@@ -304,4 +328,26 @@ private boolean isShadow(PrismObject object) {
                 || (object.getDefinition() != null && object.getDefinition().getName()
                 .equals(ShadowType.COMPLEX_TYPE));
     }
+
+	private <O extends ObjectType> void setObjectWrapperValuesReadOnlyState(ObjectWrapper<O> objectWrapper, boolean entirelyReadonly) {
+		for (ContainerWrapper<? extends Containerable> container : objectWrapper.getContainers()) {
+			setContainerValuesReadOnlyState(container, entirelyReadonly);
+		}
+	}
+
+	private void setContainerValuesReadOnlyState(ContainerWrapper<? extends Containerable> container, boolean entirelyReadonly) {
+		container.setReadonly(entirelyReadonly);
+
+		container.getValues().forEach(v -> {
+			v.getItems().forEach(item -> {
+				if (item instanceof ContainerWrapper) {
+					setContainerValuesReadOnlyState((ContainerWrapper) item, entirelyReadonly);
+				} else if (item instanceof PropertyOrReferenceWrapper) {
+					((PropertyOrReferenceWrapper) item).setReadonly(entirelyReadonly);
+				}
+			});
+			((ContainerValueWrapper) v).setReadonly(entirelyReadonly);
+
+		});
+	}
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminAbstractRole.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminAbstractRole.java
index abed4281394..09876014df3 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminAbstractRole.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminAbstractRole.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) 2015 Evolveum
+ * Copyright (c) 2018 Evolveum
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminFocus.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminFocus.java
index 5777261ae8d..46eb66b2772 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminFocus.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminFocus.java
@@ -967,4 +967,7 @@ protected void performAdditionalValidation(PrismObject<F> object,
 
 	}
 
+	protected boolean isFocusHistoryPage(){
+		return false;
+	}
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminObjectDetails.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminObjectDetails.java
index 19acf39b19e..0f1155c8bab 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminObjectDetails.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/PageAdminObjectDetails.java
@@ -22,6 +22,7 @@
 import javax.xml.namespace.QName;
 
 import com.evolveum.midpoint.schema.util.AdminGuiConfigTypeUtil;
+import com.evolveum.midpoint.web.component.prism.*;
 import com.evolveum.midpoint.web.component.progress.ProgressPanel;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
 import org.apache.commons.lang.StringUtils;
@@ -55,9 +56,6 @@
 import com.evolveum.midpoint.util.logging.TraceManager;
 import com.evolveum.midpoint.web.component.FocusSummaryPanel;
 import com.evolveum.midpoint.web.component.objectdetails.AbstractObjectMainPanel;
-import com.evolveum.midpoint.web.component.prism.ContainerStatus;
-import com.evolveum.midpoint.web.component.prism.ObjectWrapper;
-import com.evolveum.midpoint.web.component.prism.ObjectWrapperFactory;
 import com.evolveum.midpoint.web.component.progress.ProgressReportingAwarePage;
 import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
 import com.evolveum.midpoint.web.page.admin.users.dto.FocusSubwrapperDto;
@@ -347,7 +345,7 @@ protected ObjectWrapper<O> loadObjectWrapper(PrismObject<O> objectToEdit, boolea
 		ObjectWrapper<O> wrapper;
 		ObjectWrapperFactory owf = new ObjectWrapperFactory(this);
 		try {
-			wrapper = owf.createObjectWrapper("pageAdminFocus.focusDetails", null, object, status, task);
+			wrapper = owf.createObjectWrapper("pageAdminFocus.focusDetails", null, object, status, isReadonly, task);
 		} catch (Exception ex) {
 			result.recordFatalError("Couldn't get user.", ex);
 			LoggingUtils.logUnexpectedException(LOGGER, "Couldn't load user", ex);
@@ -732,4 +730,5 @@ public boolean isForcedPreview(){
 		GuiObjectDetailsPageType objectDetails = AdminGuiConfigTypeUtil.findObjectConfiguration(getCompileTimeClass(), getAdminGuiConfiguration());
 		return objectDetails != null && DetailsPageSaveMethodType.FORCED_PREVIEW.equals(objectDetails.getSaveMethod());
 	}
+
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/ObjectPolicyPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/ObjectPolicyPanel.java
index d46f6f2d8dc..7c2435019f5 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/ObjectPolicyPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/ObjectPolicyPanel.java
@@ -469,6 +469,16 @@ public int getHeight() {
 		return 400;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+	
 	@Override
 	public StringResourceModel getTitle() {
 		return createStringResource("ObjectPolicyDialog.label");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/RichHyperlinkConfigPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/RichHyperlinkConfigPanel.java
index 8225c737fa8..cf8ae8eef30 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/RichHyperlinkConfigPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/component/RichHyperlinkConfigPanel.java
@@ -169,7 +169,17 @@ public int getHeight() {
 		return 900;
 	}
 
-	@Override
+    @Override
+    public String getWidthUnit(){
+        return "px";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "px";
+    }
+
+    @Override
 	public StringResourceModel getTitle() {
 		return null;
 	}
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/orgs/OrgTreeAssignablePanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/orgs/OrgTreeAssignablePanel.java
index 5fa6185032e..cc027d1e6ab 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/orgs/OrgTreeAssignablePanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/orgs/OrgTreeAssignablePanel.java
@@ -168,6 +168,16 @@ public int getHeight() {
 		return 500;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return new StringResourceModel("OrgTreeAssignablePanel.selectOrg");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/ParameterPropertiesPopupPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/ParameterPropertiesPopupPanel.java
index b10533382b7..f913c3676b8 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/ParameterPropertiesPopupPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/ParameterPropertiesPopupPanel.java
@@ -90,6 +90,16 @@ public int getHeight() {
 		return 450;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return createStringResource("JasperReportParameterProperties.title");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/RunReportPopupPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/RunReportPopupPanel.java
index faf7062f4a0..b9d4180bd3e 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/RunReportPopupPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/reports/component/RunReportPopupPanel.java
@@ -577,7 +577,17 @@ public int getHeight() {
 		return 560;
 	}
 
-	@Override
+    @Override
+    public String getWidthUnit(){
+        return "px";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "px";
+    }
+
+    @Override
 	public StringResourceModel getTitle() {
 		return createStringResource("RunReportPopupPanel.title");
 	}
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java
index 3c94824495b..72dbd00e036 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java
@@ -248,6 +248,16 @@ public int getHeight() {
 		return 500;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return pageBase.createStringResource("ResourceTasksPanel.definedTasks");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/component/TestConnectionResultPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/component/TestConnectionResultPanel.java
index e0ed7603112..2f351647f64 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/component/TestConnectionResultPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/component/TestConnectionResultPanel.java
@@ -113,6 +113,16 @@ public int getHeight() {
         return 400;
     }
 
+    @Override
+    public String getWidthUnit(){
+        return "px";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "px";
+    }
+
     @Override
     public StringResourceModel getTitle() {
         return new StringResourceModel("TestConnectionResultPanel.testConnection.result");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRole.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRole.java
index bcf2da91a63..5f0f1730ba9 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRole.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRole.java
@@ -27,8 +27,12 @@
 import com.evolveum.midpoint.web.component.progress.ProgressReportingAwarePage;
 import com.evolveum.midpoint.web.page.admin.PageAdminAbstractRole;
 import com.evolveum.midpoint.web.page.admin.roles.component.RoleSummaryPanel;
+import com.evolveum.midpoint.web.page.admin.users.PageUser;
+import com.evolveum.midpoint.web.page.admin.users.PageUserHistory;
 import com.evolveum.midpoint.web.util.OnePageParameterEncoder;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.request.mapper.parameter.PageParameters;
 
 /**
@@ -91,6 +95,13 @@ protected FocusSummaryPanel<RoleType> createSummaryPanel() {
 
 	@Override
 	protected AbstractObjectMainPanel<RoleType> createMainPanel(String id) {
-		return new RoleMainPanel(id, getObjectModel(), getProjectionModel(), this);
+		return new RoleMainPanel(id, getObjectModel(), getProjectionModel(), this){
+			private static final long serialVersionUID = 1L;
+
+			@Override
+			protected void viewObjectHistoricalDataPerformed(AjaxRequestTarget target, PrismObject<RoleType> object, String date){
+				PageRole.this.navigateToNext(new PageRoleHistory(object, date));
+			}
+		};
 	}
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRoleHistory.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRoleHistory.html
new file mode 100644
index 00000000000..bd28d32b24d
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRoleHistory.html
@@ -0,0 +1,23 @@
+<!--
+  ~ Copyright (c) 2010-2018 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<!DOCTYPE html>
+<html xmlns:wicket="http://wicket.apache.org">
+<body>
+<wicket:extend>
+    <wicket:child />
+</wicket:extend>
+</body>
+</html>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRoleHistory.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRoleHistory.java
new file mode 100644
index 00000000000..614ed049d52
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/PageRoleHistory.java
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2010-2018 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.evolveum.midpoint.web.page.admin.roles;
+
+import com.evolveum.midpoint.gui.api.model.LoadableModel;
+import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
+import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.security.api.AuthorizationConstants;
+import com.evolveum.midpoint.util.logging.Trace;
+import com.evolveum.midpoint.util.logging.TraceManager;
+import com.evolveum.midpoint.web.application.AuthorizationAction;
+import com.evolveum.midpoint.web.application.PageDescriptor;
+import com.evolveum.midpoint.web.component.FocusSummaryPanel;
+import com.evolveum.midpoint.web.component.prism.ObjectWrapper;
+import com.evolveum.midpoint.web.page.admin.users.PageUserHistory;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+import org.apache.wicket.model.IModel;
+
+/**
+ * Created by honchar
+ */
+@PageDescriptor(url = "/admin/roleHistory", action = {
+        @AuthorizationAction(actionUri = PageAdminRoles.AUTH_ROLE_ALL,
+                label = PageAdminRoles.AUTH_ROLE_ALL_LABEL,
+                description = PageAdminRoles.AUTH_ROLE_ALL_DESCRIPTION),
+        @AuthorizationAction(actionUri = AuthorizationConstants.AUTZ_UI_ROLE_HISTORY_URL,
+                label = "PageRoleHistory.auth.roleHistory.label",
+                description = "PageRoleHistory.auth.roleHistory.description")})
+public class PageRoleHistory extends PageRole {
+    private static final long serialVersionUID = 1L;
+
+    private static final String DOT_CLASS = PageUserHistory.class.getName() + ".";
+    private static final Trace LOGGER = TraceManager.getTrace(PageUserHistory.class);
+    private String date = "";
+
+    public PageRoleHistory(final PrismObject<RoleType> role, String date) {
+        super(role);
+        this.date = date;
+    }
+
+    @Override
+    protected ObjectWrapper<RoleType> loadObjectWrapper(PrismObject<RoleType> role, boolean isReadonly) {
+        return super.loadObjectWrapper(role, true);
+    }
+
+    @Override
+    protected void setSummaryPanelVisibility(FocusSummaryPanel summaryPanel) {
+        summaryPanel.setVisible(true);
+    }
+
+    @Override
+    protected IModel<String> createPageTitleModel() {
+        return new LoadableModel<String>() {
+            @Override
+            protected String load() {
+                String name = null;
+                if (getObjectWrapper() != null && getObjectWrapper().getObject() != null) {
+                    name = WebComponentUtil.getName(getObjectWrapper().getObject());
+                }
+                return createStringResource("PageUserHistory.title", name, date).getObject();
+            }
+        };
+    }
+
+    @Override
+    protected boolean isFocusHistoryPage(){
+        return true;
+    }
+}
+
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleGovernanceMemberPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleGovernanceMemberPanel.java
index 94c166cce53..101658b752b 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleGovernanceMemberPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleGovernanceMemberPanel.java
@@ -27,11 +27,11 @@
 
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.security.api.AuthorizationConstants;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.menu.cog.InlineMenuItem;
 import com.evolveum.midpoint.web.page.admin.configuration.component.HeaderMenuAction;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleMemberPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleMemberPanel.java
index 9d9e33adec8..ee10790eb64 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleMemberPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/RoleMemberPanel.java
@@ -29,6 +29,7 @@
 import com.evolveum.midpoint.prism.query.builder.QueryBuilder;
 import com.evolveum.midpoint.prism.query.builder.S_AtomicFilterExit;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
 import com.evolveum.midpoint.security.api.AuthorizationConstants;
@@ -38,7 +39,6 @@
 import com.evolveum.midpoint.util.logging.LoggingUtils;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.data.column.IsolatedCheckBoxPanel;
 import com.evolveum.midpoint.web.component.input.QNameChoiceRenderer;
 import com.evolveum.midpoint.web.component.menu.cog.InlineMenuItem;
@@ -312,15 +312,6 @@ protected AttributeAppender getInputStyleClass(){
 
 	}
 
-	@Override
-	protected void addMembersPerformed(QName type, List<QName> relation, List selected, AjaxRequestTarget target) {
-		Task operationalTask = getPageBase().createSimpleTask(getTaskName("Add", null));
-		ObjectDelta delta = prepareDelta(type, relation, MemberOperation.ADD, operationalTask.getResult());
-		executeMemberOperation(operationalTask, type, createQueryForAdd(selected), delta,
-				TaskCategory.EXECUTE_CHANGES, target);
-
-	}
-
 	private ObjectDelta prepareDelta(QName type, List<QName> relations, MemberOperation operation, OperationResult result) {
 		Class classType = WebComponentUtil.qnameToClass(getPrismContext(), type);
 		ObjectDelta delta = null;
@@ -433,11 +424,6 @@ protected ObjectQuery createDirectMemberQuery(List<QName> relations) {
 		}
 	}
 
-	@Override
-	protected List<QName> getNewMemberSupportedTypes(){
-		return WebComponentUtil.createFocusTypeList();
-	}
-
 	@Override
 	protected List<RelationTypes> getAvailableRelationList(){
 		return Arrays.asList(RelationTypes.MEMBER);
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/component/MultiplicityPolicyPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/component/MultiplicityPolicyPanel.java
index 33c32cf44f1..d4f24b2e98e 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/component/MultiplicityPolicyPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/roles/component/MultiplicityPolicyPanel.java
@@ -213,6 +213,16 @@ public int getHeight() {
 		return 400;
 	}
 
+	@Override
+	public String getWidthUnit(){
+		return "px";
+	}
+
+	@Override
+	public String getHeightUnit(){
+		return "px";
+	}
+
 	@Override
 	public StringResourceModel getTitle() {
 		return new StringResourceModel("MultiplicityPolicyDialog.label");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageService.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageService.java
index 0d8f06ede3b..6e4ba43ddea 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageService.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageService.java
@@ -24,11 +24,15 @@
 import com.evolveum.midpoint.web.component.objectdetails.AbstractRoleMainPanel;
 import com.evolveum.midpoint.web.component.progress.ProgressReportingAwarePage;
 import com.evolveum.midpoint.web.page.admin.PageAdminAbstractRole;
+import com.evolveum.midpoint.web.page.admin.roles.PageRole;
+import com.evolveum.midpoint.web.page.admin.roles.PageRoleHistory;
 import com.evolveum.midpoint.web.page.admin.users.component.AbstractRoleMemberPanel;
 import com.evolveum.midpoint.web.page.admin.users.component.ServiceMemberPanel;
 import com.evolveum.midpoint.web.page.admin.users.component.ServiceSummaryPanel;
 import com.evolveum.midpoint.web.util.OnePageParameterEncoder;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ServiceType;
+import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.model.Model;
 import org.apache.wicket.request.mapper.parameter.PageParameters;
 
@@ -90,6 +94,12 @@ protected AbstractObjectMainPanel<ServiceType> createMainPanel(String id) {
 			public AbstractRoleMemberPanel<ServiceType> createMemberPanel(String panelId) {
 				return new ServiceMemberPanel(panelId, Model.of(getObject().asObjectable()));
 			}
+
+			@Override
+			protected void viewObjectHistoricalDataPerformed(AjaxRequestTarget target, PrismObject<ServiceType> object, String date){
+				PageService.this.navigateToNext(new PageServiceHistory(object, date));
+			}
+
 		};
 	}
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageServiceHistory.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageServiceHistory.html
new file mode 100644
index 00000000000..bd28d32b24d
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageServiceHistory.html
@@ -0,0 +1,23 @@
+<!--
+  ~ Copyright (c) 2010-2018 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<!DOCTYPE html>
+<html xmlns:wicket="http://wicket.apache.org">
+<body>
+<wicket:extend>
+    <wicket:child />
+</wicket:extend>
+</body>
+</html>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageServiceHistory.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageServiceHistory.java
new file mode 100644
index 00000000000..ed6991c4e20
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/services/PageServiceHistory.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2010-2018 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.evolveum.midpoint.web.page.admin.services;
+
+import com.evolveum.midpoint.gui.api.model.LoadableModel;
+import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
+import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.util.logging.Trace;
+import com.evolveum.midpoint.util.logging.TraceManager;
+import com.evolveum.midpoint.web.component.FocusSummaryPanel;
+import com.evolveum.midpoint.web.component.prism.ObjectWrapper;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ServiceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+import org.apache.wicket.model.IModel;
+
+import javax.xml.ws.Service;
+
+/**
+ * Created by honchar
+ */
+public class PageServiceHistory extends PageService {
+    private static final long serialVersionUID = 1L;
+
+    private static final String DOT_CLASS = PageServiceHistory.class.getName() + ".";
+    private static final Trace LOGGER = TraceManager.getTrace(PageServiceHistory.class);
+    private String date = "";
+
+    public PageServiceHistory(final PrismObject<ServiceType> service, String date) {
+        super(service);
+        this.date = date;
+    }
+
+    @Override
+    protected ObjectWrapper<ServiceType> loadObjectWrapper(PrismObject<ServiceType> user, boolean isReadonly) {
+        return super.loadObjectWrapper(user, true);
+    }
+
+    @Override
+    protected void setSummaryPanelVisibility(FocusSummaryPanel summaryPanel) {
+        summaryPanel.setVisible(true);
+    }
+
+    @Override
+    protected IModel<String> createPageTitleModel() {
+        return new LoadableModel<String>() {
+            @Override
+            protected String load() {
+                String name = null;
+                if (getObjectWrapper() != null && getObjectWrapper().getObject() != null) {
+                    name = WebComponentUtil.getName(getObjectWrapper().getObject());
+                }
+                return createStringResource("PageUserHistory.title", name, date).getObject();
+            }
+        };
+    }
+
+    @Override
+    protected boolean isFocusHistoryPage(){
+        return true;
+    }
+}
+
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnit.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnit.java
index ca201d3a862..e06c669d131 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnit.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnit.java
@@ -15,6 +15,8 @@
  */
 package com.evolveum.midpoint.web.page.admin.users;
 
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.model.Model;
 import org.apache.wicket.request.mapper.parameter.PageParameters;
 
@@ -95,6 +97,11 @@ protected AbstractObjectMainPanel<OrgType> createMainPanel(String id) {
 			public AbstractRoleMemberPanel<OrgType> createMemberPanel(String panelId) {
 				return new OrgMemberPanel(panelId, Model.of(getObject().asObjectable()));
 			}
+
+			@Override
+			protected void viewObjectHistoricalDataPerformed(AjaxRequestTarget target, PrismObject<OrgType> object, String date){
+				PageOrgUnit.this.navigateToNext(new PageOrgUnitHistory(object, date));
+			}
 		};
 	}
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnitHistory.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnitHistory.html
new file mode 100644
index 00000000000..bd28d32b24d
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnitHistory.html
@@ -0,0 +1,23 @@
+<!--
+  ~ Copyright (c) 2010-2018 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<!DOCTYPE html>
+<html xmlns:wicket="http://wicket.apache.org">
+<body>
+<wicket:extend>
+    <wicket:child />
+</wicket:extend>
+</body>
+</html>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnitHistory.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnitHistory.java
new file mode 100644
index 00000000000..51cd20943c5
--- /dev/null
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageOrgUnitHistory.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2010-2018 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.evolveum.midpoint.web.page.admin.users;
+
+import com.evolveum.midpoint.gui.api.ComponentConstants;
+import com.evolveum.midpoint.gui.api.component.tabs.CountablePanelTab;
+import com.evolveum.midpoint.gui.api.component.tabs.PanelTab;
+import com.evolveum.midpoint.gui.api.model.LoadableModel;
+import com.evolveum.midpoint.gui.api.util.FocusTabVisibleBehavior;
+import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
+import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.security.api.AuthorizationConstants;
+import com.evolveum.midpoint.util.logging.Trace;
+import com.evolveum.midpoint.util.logging.TraceManager;
+import com.evolveum.midpoint.web.application.AuthorizationAction;
+import com.evolveum.midpoint.web.application.PageDescriptor;
+import com.evolveum.midpoint.web.component.FocusSummaryPanel;
+import com.evolveum.midpoint.web.component.assignment.AssignmentEditorDto;
+import com.evolveum.midpoint.web.component.assignment.AssignmentTablePanel;
+import com.evolveum.midpoint.web.component.assignment.DelegationEditorPanel;
+import com.evolveum.midpoint.web.component.menu.cog.InlineMenuItem;
+import com.evolveum.midpoint.web.component.objectdetails.AbstractObjectMainPanel;
+import com.evolveum.midpoint.web.component.objectdetails.FocusMainPanel;
+import com.evolveum.midpoint.web.component.prism.ContainerValueWrapper;
+import com.evolveum.midpoint.web.component.prism.ContainerWrapper;
+import com.evolveum.midpoint.web.component.prism.ObjectWrapper;
+import com.evolveum.midpoint.web.component.prism.PropertyOrReferenceWrapper;
+import com.evolveum.midpoint.web.page.admin.PageAdminFocus;
+import com.evolveum.midpoint.web.page.admin.PageAdminObjectDetails;
+import com.evolveum.midpoint.web.page.admin.users.component.UserSummaryPanel;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+import org.apache.wicket.ajax.AjaxRequestTarget;
+import org.apache.wicket.extensions.markup.html.tabs.ITab;
+import org.apache.wicket.markup.html.WebMarkupContainer;
+import org.apache.wicket.markup.html.list.ListItem;
+import org.apache.wicket.model.IModel;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Created by honchar.
+ */
+@PageDescriptor(url = "/admin/orgUnitHistory", action = {
+        @AuthorizationAction(actionUri = PageAdminUsers.AUTH_ORG_ALL,
+                label = PageAdminUsers.AUTH_ORG_ALL_LABEL,
+                description = PageAdminUsers.AUTH_ORG_ALL_DESCRIPTION),
+        @AuthorizationAction(actionUri = AuthorizationConstants.AUTZ_UI_ORG_UNIT_HISTORY_URL,
+                label = "PageOrgUnitHistory.auth.orgUnitHistory.label",
+                description = "PageOrgUnitHistory.auth.orgUnitHistory.description")})
+public class PageOrgUnitHistory extends PageOrgUnit {
+    private static final long serialVersionUID = 1L;
+
+    private static final String DOT_CLASS = PageOrgUnitHistory.class.getName() + ".";
+    private static final Trace LOGGER = TraceManager.getTrace(PageOrgUnitHistory.class);
+    private String date = "";
+
+    public PageOrgUnitHistory(final PrismObject<OrgType> org, String date) {
+        super(org);
+        this.date = date;
+    }
+
+    @Override
+    protected ObjectWrapper<OrgType> loadObjectWrapper(PrismObject<OrgType> org, boolean isReadonly) {
+        return super.loadObjectWrapper(org, true);
+    }
+
+    @Override
+    protected void setSummaryPanelVisibility(FocusSummaryPanel summaryPanel) {
+        summaryPanel.setVisible(true);
+    }
+
+    @Override
+    protected IModel<String> createPageTitleModel() {
+        return new LoadableModel<String>() {
+            @Override
+            protected String load() {
+                String name = null;
+                if (getObjectWrapper() != null && getObjectWrapper().getObject() != null) {
+                    name = WebComponentUtil.getName(getObjectWrapper().getObject());
+                }
+                return createStringResource("PageUserHistory.title", name, date).getObject();
+            }
+        };
+    }
+
+    @Override
+    protected boolean isFocusHistoryPage(){
+        return true;
+    }
+}
\ No newline at end of file
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUser.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUser.java
index e1cf89124cc..175a10fec23 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUser.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUser.java
@@ -86,6 +86,7 @@
                 label = "PageUser.auth.user.label",
                 description = "PageUser.auth.user.description")})
 public class PageUser extends PageAdminFocus<UserType> {
+    private static final long serialVersionUID = 1L;
 
     private static final String DOT_CLASS = PageUser.class.getName() + ".";
     private static final String OPERATION_LOAD_DELEGATED_BY_ME_ASSIGNMENTS = DOT_CLASS + "loadDelegatedByMeAssignments";
@@ -121,6 +122,8 @@ protected void initializeModel(final PrismObject<UserType> objectToEdit, boolean
         super.initializeModel(objectToEdit, isNewObject, isReadonly);
 
         delegationsModel = new LoadableModel<List<AssignmentEditorDto>>(false) {
+            private static final long serialVersionUID = 1L;
+
             @Override
             protected List<AssignmentEditorDto> load() {
                 if (StringUtils.isNotEmpty(getObjectWrapper().getOid())) {
@@ -131,6 +134,8 @@ protected List<AssignmentEditorDto> load() {
             }
         };
         privilegesListModel = new LoadableModel<List<AssignmentInfoDto>>(false) {
+            private static final long serialVersionUID = 1L;
+
             @Override
             protected List<AssignmentInfoDto> load() {
                 return getUserPrivilegesList();
@@ -181,10 +186,12 @@ public Class getCompileTimeClass() {
 	@Override
 	protected AbstractObjectMainPanel<UserType> createMainPanel(String id) {
         return new FocusMainPanel<UserType>(id, getObjectModel(), getProjectionModel(), this) {
+            private static final long serialVersionUID = 1L;
+
             @Override
             protected void addSpecificTabs(final PageAdminObjectDetails<UserType> parentPage, List<ITab> tabs) {
-                FocusTabVisibleBehavior authorization;
-                authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_PERSONAS_URL);
+                FocusTabVisibleBehavior<UserType> authorization;
+                authorization = new FocusTabVisibleBehavior<>(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_PERSONAS_URL, false, isFocusHistoryPage());
                 tabs.add(
                         new PanelTab(parentPage.createStringResource("pageAdminFocus.personas"), authorization){
 
@@ -197,22 +204,8 @@ public WebMarkupContainer createPanel(String panelId) {
 
                         });
 
-                if (WebComponentUtil.isAuthorized(ModelAuthorizationAction.AUDIT_READ.getUrl()) && getObjectWrapper().getStatus() != ContainerStatus.ADDING){
-                    authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_OBJECT_HISTORY_URL);
-                    tabs.add(
-                            new PanelTab(parentPage.createStringResource("pageAdminFocus.objectHistory"), authorization) {
-
-                                private static final long serialVersionUID = 1L;
-
-                                @Override
-                                public WebMarkupContainer createPanel(String panelId) {
-                                    return createObjectHistoryTabPanel(panelId, parentPage);
-                                }
-                            });
-                }
-
-                authorization = new FocusTabVisibleBehavior(unwrapModel(),
-                        ComponentConstants.UI_FOCUS_TAB_DELEGATIONS_URL);
+                authorization = new FocusTabVisibleBehavior<>(unwrapModel(),
+                        ComponentConstants.UI_FOCUS_TAB_DELEGATIONS_URL, false, isFocusHistoryPage());
                 tabs.add(new CountablePanelTab(parentPage.createStringResource("FocusType.delegations"), authorization)
                 {
                     private static final long serialVersionUID = 1L;
@@ -231,8 +224,8 @@ public String getCount() {
                     }
                 });
 
-                authorization = new FocusTabVisibleBehavior(unwrapModel(),
-                        ComponentConstants.UI_FOCUS_TAB_DELEGATED_TO_ME_URL);
+                authorization = new FocusTabVisibleBehavior<UserType>(unwrapModel(),
+                        ComponentConstants.UI_FOCUS_TAB_DELEGATED_TO_ME_URL, true, isFocusHistoryPage());
                 tabs.add(new CountablePanelTab(parentPage.createStringResource("FocusType.delegatedToMe"), authorization)
                 {
                     private static final long serialVersionUID = 1L;
@@ -310,6 +303,16 @@ protected boolean areSavePreviewButtonsEnabled(){
                 return super.areSavePreviewButtonsEnabled() ||
                         (userDelegationsTabPanel != null ? userDelegationsTabPanel.isDelegationsModelChanged() : false);
             }
+
+            @Override
+            protected boolean isFocusHistoryPage(){
+                return PageUser.this.isFocusHistoryPage();
+            }
+
+            @Override
+            protected void viewObjectHistoricalDataPerformed(AjaxRequestTarget target, PrismObject<UserType> object, String date){
+                PageUser.this.navigateToNext(new PageUserHistory(object, date));
+            }
         };
     }
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.html
index 80788368cd7..bd28d32b24d 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.html
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.html
@@ -1,5 +1,5 @@
 <!--
-  ~ Copyright (c) 2010-2017 Evolveum
+  ~ Copyright (c) 2010-2018 Evolveum
   ~
   ~ Licensed under the Apache License, Version 2.0 (the "License");
   ~ you may not use this file except in compliance with the License.
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.java
index 2d992466fc7..8abf020c9e5 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/PageUserHistory.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2017 Evolveum
+ * Copyright (c) 2010-2018 Evolveum
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
 import com.evolveum.midpoint.gui.api.ComponentConstants;
 import com.evolveum.midpoint.gui.api.component.tabs.CountablePanelTab;
 import com.evolveum.midpoint.gui.api.component.tabs.PanelTab;
+import com.evolveum.midpoint.gui.api.model.LoadableModel;
 import com.evolveum.midpoint.gui.api.util.FocusTabVisibleBehavior;
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.prism.PrismObject;
@@ -58,42 +59,21 @@
         @AuthorizationAction(actionUri = AuthorizationConstants.AUTZ_UI_USER_HISTORY_URL,
                 label = "PageUser.auth.userHistory.label",
                 description = "PageUser.auth.userHistory.description")})
-public class PageUserHistory extends PageAdminFocus<UserType> {
+public class PageUserHistory extends PageUser {
+    private static final long serialVersionUID = 1L;
 
     private static final String DOT_CLASS = PageUserHistory.class.getName() + ".";
     private static final Trace LOGGER = TraceManager.getTrace(PageUserHistory.class);
     private String date = "";
 
     public PageUserHistory(final PrismObject<UserType> user, String date) {
+        super(user);
         this.date = date;
-        initialize(user);
     }
 
     @Override
     protected ObjectWrapper<UserType> loadObjectWrapper(PrismObject<UserType> user, boolean isReadonly) {
-        ObjectWrapper<UserType> objectWrapper = super.loadObjectWrapper(user, true);
-
-        for (ContainerWrapper container : objectWrapper.getContainers()) {
-            setContainerValuesReadOnlyState(container);
-        }
-
-        return objectWrapper;
-    }
-
-    private void setContainerValuesReadOnlyState(ContainerWrapper container) {
-        container.setReadonly(true);
-
-        container.getValues().forEach(v -> {
-            ((ContainerValueWrapper) v).getItems().forEach(item -> {
-                if (item instanceof ContainerWrapper) {
-                    setContainerValuesReadOnlyState((ContainerWrapper) item);
-                } else if (item instanceof PropertyOrReferenceWrapper) {
-                    ((PropertyOrReferenceWrapper) item).setReadonly(true);
-                }
-            });
-            ((ContainerValueWrapper) v).setReadonly(true);
-
-        });
+        return super.loadObjectWrapper(user, true);
     }
 
     @Override
@@ -101,162 +81,22 @@ protected void setSummaryPanelVisibility(FocusSummaryPanel summaryPanel) {
         summaryPanel.setVisible(true);
     }
 
-    @Override
-    protected FocusSummaryPanel<UserType> createSummaryPanel() {
-        return new UserSummaryPanel(ID_SUMMARY_PANEL, getObjectModel(), this);
-    }
-
-    protected void cancelPerformed(AjaxRequestTarget target) {
-        redirectBack();
-    }
-
-
     @Override
     protected IModel<String> createPageTitleModel() {
-        return new IModel<String>() {
+        return new LoadableModel<String>() {
             @Override
-            public String getObject() {
+            protected String load() {
                 String name = null;
                 if (getObjectWrapper() != null && getObjectWrapper().getObject() != null) {
                     name = WebComponentUtil.getName(getObjectWrapper().getObject());
                 }
                 return createStringResource("PageUserHistory.title", name, date).getObject();
             }
-
-            @Override
-            public void setObject(String s) {
-
-            }
-
-            @Override
-            public void detach() {
-
-            }
         };
     }
 
     @Override
-    protected UserType createNewObject() {
-        return new UserType();
-    }
-
-    @Override
-    protected Class getRestartResponsePage() {
-        return PageUsers.class;
-    }
-
-    @Override
-    public Class getCompileTimeClass() {
-        return UserType.class;
-    }
-
-    @Override
-    protected AbstractObjectMainPanel<UserType> createMainPanel(String id) {
-        return new FocusMainPanel<UserType>(id, getObjectModel(), getProjectionModel(), this) {
-            @Override
-            protected List<ITab> createTabs(final PageAdminObjectDetails<UserType> parentPage) {
-                List<ITab> tabs = new ArrayList<>();
-                FocusTabVisibleBehavior authorization = new FocusTabVisibleBehavior(unwrapModel(),
-                        ComponentConstants.UI_FOCUS_TAB_BASIC_URL);
-
-                tabs.add(
-                        new PanelTab(parentPage.createStringResource("pageAdminFocus.basic"), authorization) {
-
-                            private static final long serialVersionUID = 1L;
-
-                            @Override
-                            public WebMarkupContainer createPanel(String panelId) {
-                                return createFocusDetailsTabPanel(panelId, parentPage);
-                            }
-                        });
-
-                //hidden, will be displayed in future version
-//                authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_PROJECTIONS_URL);
-//                tabs.add(
-//                        new CountablePanelTab(parentPage.createStringResource("pageAdminFocus.projections"), authorization) {
-//
-//                            private static final long serialVersionUID = 1L;
-//
-//                            @Override
-//                            public WebMarkupContainer createPanel(String panelId) {
-//                                return createFocusProjectionsTabPanel(panelId, parentPage);
-//                            }
-//
-//                            @Override
-//                            public String getCount() {
-//                                return Integer.toString(getProjectionModel().getObject() == null ?
-//                                        0 : getProjectionModel().getObject().size());
-//                            }
-//                        });
-
-                authorization = new FocusTabVisibleBehavior(unwrapModel(), ComponentConstants.UI_FOCUS_TAB_ASSIGNMENTS_URL);
-                tabs.add(
-                        new CountablePanelTab(parentPage.createStringResource("pageAdminFocus.assignments"), authorization) {
-
-                            private static final long serialVersionUID = 1L;
-
-                            @Override
-                            public WebMarkupContainer createPanel(String panelId) {
-                                return createFocusAssignmentsTabPanel(panelId, parentPage);
-                            }
-
-                            @Override
-                            public String getCount() {
-                                return Integer.toString(countAssignments());
-                            }
-                        });
-                authorization = new FocusTabVisibleBehavior(unwrapModel(),
-                        ComponentConstants.UI_FOCUS_TAB_DELEGATED_TO_ME_URL);
-                tabs.add(new CountablePanelTab(parentPage.createStringResource("FocusType.delegatedToMe"), authorization)
-                {
-                    private static final long serialVersionUID = 1L;
-
-                    @Override
-                    public WebMarkupContainer createPanel(String panelId) {
-                        return new AssignmentTablePanel<UserType>(panelId, 
-                                getDelegatedToMeModel()) {
-                            private static final long serialVersionUID = 1L;
-
-                            @Override
-                            public void populateAssignmentDetailsPanel(ListItem<AssignmentEditorDto> item) {
-                                DelegationEditorPanel editor = new DelegationEditorPanel(ID_ROW, item.getModel(), true,
-                                        new ArrayList<>(), PageUserHistory.this);
-                                item.add(editor);
-                            }
-
-                            @Override
-                            public String getExcludeOid() {
-                                return getObject().getOid();
-                            }
-                            
-                            @Override
-                            		public IModel<String> getLabel() {
-                            			return parentPage.createStringResource("FocusType.delegatedToMe");
-                            		}
-
-                            @Override
-                            protected List<InlineMenuItem> createAssignmentMenu() {
-                                return new ArrayList<>();
-                            }
-
-                        };
-                    }
-
-                    @Override
-                    public String getCount() {
-                        return Integer.toString(getDelegatedToMeModel().getObject() == null ?
-                                0 : getDelegatedToMeModel().getObject().size());
-                    }
-                });
-
-                return tabs;
-
-            }
-
-            @Override
-            protected boolean getOptionsPanelVisibility() {
-                return false;
-            }
-        };
+    protected boolean isFocusHistoryPage(){
+        return true;
     }
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AbstractRoleMemberPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AbstractRoleMemberPanel.java
index f95a47a347a..bd4a6c1b253 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AbstractRoleMemberPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AbstractRoleMemberPanel.java
@@ -28,8 +28,9 @@
 import com.evolveum.midpoint.prism.query.builder.QueryBuilder;
 import com.evolveum.midpoint.schema.GetOperationOptions;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.security.api.AuthorizationConstants;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
+import com.evolveum.midpoint.task.api.TaskCategory;
 import com.evolveum.midpoint.web.component.search.Search;
 import com.evolveum.midpoint.web.component.search.SearchFactory;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
@@ -107,8 +108,6 @@ protected enum MemberOperation {
 	private LoadableModel<List<String>> managerRelationObjectsModel;
 	protected LoadableModel<List<String>> memberRelationObjectsModel;
 
-	private boolean areModelsInitialized = false;
-
 	public AbstractRoleMemberPanel(String id, TableId tableId, IModel<T> model) {
 		this(id, tableId, model, new ArrayList<>());
 	}
@@ -177,7 +176,7 @@ protected boolean isClickable(IModel<SelectableBean<ObjectType>> rowModel) {
 
 			@Override
 			protected void newObjectPerformed(AjaxRequestTarget target) {
-				AbstractRoleMemberPanel.this.createFocusMemberPerformed(null, target);
+				AbstractRoleMemberPanel.this.addMembers(target, getAvailableRelationList());
 			}
 
 			@Override
@@ -289,7 +288,7 @@ protected List<InlineMenuItem> assignNewMemberInlineMenuItems() {
 
 					@Override
 					public void onClick(AjaxRequestTarget target) {
-						addMembers(target);
+						addMembers(target, getAvailableRelationList());
 					}
 				}));
 		return newMemberMenuItems;
@@ -412,9 +411,9 @@ private void initObjectForAdd(ObjectReferenceType parentOrgRef, QName type, QNam
 		WebComponentUtil.dispatchToObjectDetailsPage(obj, true, this);
 	}
 
-	protected void addMembers(AjaxRequestTarget target) {
+	protected void addMembers(AjaxRequestTarget target, List<RelationTypes> availableRelationList) {
 
-		ChooseMemberPopup browser = new ChooseMemberPopup(getPageBase().getMainPopupBodyId(), getAvailableRelationList()) {
+		ChooseMemberPopup browser = new ChooseMemberPopup(getPageBase().getMainPopupBodyId(), availableRelationList) {
 			private static final long serialVersionUID = 1L;
 
 			@Override
@@ -429,31 +428,9 @@ protected T getAssignmentTargetRefObject(){
 	}
 
 	protected List<RelationTypes> getAvailableRelationList(){
-		return Arrays.asList(RelationTypes.values());
-	}
-
-	protected List<QName> getNewMemberSupportedTypes(){
-		List<QName> types = WebComponentUtil.createObjectTypeList();
-		types.remove(NodeType.COMPLEX_TYPE);
-		types.remove(ShadowType.COMPLEX_TYPE);
-		return types;
-	}
-
-	protected ObjectQuery createQueryForAdd(List selected) {
-		List<String> oids = new ArrayList<>();
-		for (Object selectable : selected) {
-			if (selectable instanceof ObjectType) {
-				oids.add(((ObjectType) selectable).getOid());
-			}
-
-		}
-
-		return ObjectQuery.createObjectQuery(InOidFilter.createInOid(oids));
+		return Arrays.asList(RelationTypes.MEMBER, RelationTypes.MANAGER, RelationTypes.APPROVER, RelationTypes.OWNER);
 	}
 
-	protected abstract void addMembersPerformed(QName type, List<QName> relation, List selected,
-			AjaxRequestTarget target);
-
 	protected abstract void removeMembersPerformed(QueryScope scope, List<QName> relation, AjaxRequestTarget target);
 
 	protected abstract void recomputeMembersPerformed(QueryScope scope, AjaxRequestTarget target);
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AssignmentsInfoDialog.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AssignmentsInfoDialog.java
index 5f81ee452ec..5fa8151e9a7 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AssignmentsInfoDialog.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/AssignmentsInfoDialog.java
@@ -205,6 +205,16 @@ public int getHeight() {
         return 500;
     }
 
+    @Override
+    public String getWidthUnit(){
+        return "px";
+    }
+
+    @Override
+    public String getHeightUnit(){
+        return "px";
+    }
+
     @Override
     public StringResourceModel getTitle() {
         return new StringResourceModel("AssignmentPreviewDialog.label");
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/OrgMemberPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/OrgMemberPanel.java
index 666c66f91b2..f82ce137ac6 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/OrgMemberPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/users/component/OrgMemberPanel.java
@@ -25,12 +25,13 @@
 
 import javax.xml.namespace.QName;
 
+import com.evolveum.midpoint.gui.api.component.ChooseMemberForOrgPopup;
+import com.evolveum.midpoint.gui.api.component.ChooseMemberPopup;
 import com.evolveum.midpoint.gui.api.model.LoadableModel;
 import com.evolveum.midpoint.prism.PrismConstants;
 import com.evolveum.midpoint.prism.query.builder.QueryBuilder;
 import com.evolveum.midpoint.prism.query.builder.S_FilterEntryOrEmpty;
 import com.evolveum.midpoint.security.api.AuthorizationConstants;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.web.component.input.DropDownChoicePanel;
 import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
 import com.evolveum.midpoint.web.page.admin.configuration.component.EmptyOnChangeAjaxFormUpdatingBehavior;
@@ -63,6 +64,7 @@
 import com.evolveum.midpoint.schema.RetrieveOption;
 import com.evolveum.midpoint.schema.SelectorOptions;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.task.api.Task;
@@ -405,7 +407,7 @@ public void onClick(AjaxRequestTarget target) {
 
 						@Override
 						public void onClick(AjaxRequestTarget target) {
-							OrgMemberPanel.this.addMembers(target);
+							OrgMemberPanel.this.addMembers(target, Arrays.asList(RelationTypes.MANAGER));
 						}
 					}));
 		}
@@ -448,11 +450,6 @@ protected void refreshTable(AjaxRequestTarget target) {
 				.qnameToClass(getPageBase().getPrismContext(), type.getTypeQName(), ObjectType.class), target);
 	}
 
-	@Override
-	protected List<RelationTypes> getAvailableRelationList(){
-		return Arrays.asList(RelationTypes.MANAGER);
-	}
-
 	protected void refreshSearch() {
 		getMemberTable().resetSearchModel();
 	}
@@ -495,30 +492,6 @@ private ObjectDelta prepareDelta(MemberOperation operaton, QName type, List<QNam
 		return delta;
 	}
 
-	@Override
-	protected void addMembersPerformed(QName type, List<QName> relation, List selected, AjaxRequestTarget target) {
-		Task operationalTask = getPageBase().createSimpleTask(getTaskName("Add", null, false));
-		ObjectDelta delta = prepareDelta(MemberOperation.ADD, type, relation, operationalTask.getResult(),
-				target);
-		if (delta == null) {
-			return;
-		}
-		executeMemberOperation(operationalTask, type, createQueryForAdd(selected), delta,
-				TaskCategory.EXECUTE_CHANGES, target);
-
-	}
-
-	protected void addManagersPerformed(QName type, List selected, AjaxRequestTarget target) {
-		Task operationalTask = getPageBase().createSimpleTask(getTaskName("Add", null, true));
-		ObjectDelta delta = prepareDelta(MemberOperation.ADD, type, Arrays.asList(SchemaConstants.ORG_MANAGER),
-				operationalTask.getResult(), target);
-		if (delta == null) {
-			return;
-		}
-		executeMemberOperation(operationalTask, type, createQueryForAdd(selected), delta,
-				TaskCategory.EXECUTE_CHANGES, target);
-
-	}
 
 	protected void removeManagersPerformed(QueryScope scope, AjaxRequestTarget target) {
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAssignmentShoppingKart.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAssignmentShoppingKart.java
index 4603aa21fe5..5506ae15d47 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAssignmentShoppingKart.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAssignmentShoppingKart.java
@@ -20,6 +20,7 @@
 import com.evolveum.midpoint.model.api.RoleSelectionSpecification;
 import com.evolveum.midpoint.prism.PrismObject;
 import com.evolveum.midpoint.prism.query.*;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.schema.util.ObjectQueryUtil;
 import com.evolveum.midpoint.security.api.AuthorizationConstants;
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageSelfDashboard.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageSelfDashboard.java
index 40e865e2147..569c48ea2d8 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageSelfDashboard.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageSelfDashboard.java
@@ -25,7 +25,6 @@
 import com.evolveum.midpoint.prism.query.builder.S_FilterEntryOrEmpty;
 import com.evolveum.midpoint.schema.util.AdminGuiConfigTypeUtil;
 import com.evolveum.midpoint.web.application.Url;
-import com.evolveum.midpoint.web.component.assignment.RelationTypes;
 import com.evolveum.midpoint.wf.util.QueryUtils;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
 import org.apache.commons.lang.Validate;
@@ -52,6 +51,7 @@
 import com.evolveum.midpoint.prism.query.builder.QueryBuilder;
 import com.evolveum.midpoint.schema.GetOperationOptions;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.security.api.AuthorizationConstants;
 import com.evolveum.midpoint.security.api.MidPointPrincipal;
diff --git a/gui/admin-gui/src/main/resources/localization/Midpoint.properties b/gui/admin-gui/src/main/resources/localization/Midpoint.properties
index 5ba8b5b5c54..ddf8afdab5e 100755
--- a/gui/admin-gui/src/main/resources/localization/Midpoint.properties
+++ b/gui/admin-gui/src/main/resources/localization/Midpoint.properties
@@ -3333,6 +3333,7 @@ roleMemberPanel.menu.recompute=Recompute member
 roleMemberPanel.menu.recomputeAll=Recompute all
 roleMemberPanel.menu.removeAll=Remove all
 roleMemberPanel.relation=Relation
+chooseMemberForOrgPopup.otherTypesLabel=Others
 AssignmentPanel.newAssignmentParameters=Parameters
 SearchPanel.more=More...
 SearchPanel.add=Add
diff --git a/infra/common/src/main/java/com/evolveum/midpoint/common/SynchronizationUtils.java b/infra/common/src/main/java/com/evolveum/midpoint/common/SynchronizationUtils.java
index 98b6f5f712f..e7ea5dbaa0f 100644
--- a/infra/common/src/main/java/com/evolveum/midpoint/common/SynchronizationUtils.java
+++ b/infra/common/src/main/java/com/evolveum/midpoint/common/SynchronizationUtils.java
@@ -22,12 +22,11 @@
 import javax.xml.datatype.XMLGregorianCalendar;
 import javax.xml.namespace.QName;
 
-import com.evolveum.midpoint.common.refinery.RefinedResourceSchemaImpl;
-import com.evolveum.midpoint.util.QNameUtil;
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang.Validate;
 
 import com.evolveum.midpoint.common.refinery.RefinedResourceSchema;
+import com.evolveum.midpoint.common.refinery.RefinedResourceSchemaImpl;
 import com.evolveum.midpoint.prism.PrismObject;
 import com.evolveum.midpoint.prism.PrismPropertyValue;
 import com.evolveum.midpoint.prism.delta.PropertyDelta;
@@ -35,7 +34,11 @@
 import com.evolveum.midpoint.prism.xml.XmlTypeConverter;
 import com.evolveum.midpoint.schema.processor.ObjectClassComplexTypeDefinition;
 import com.evolveum.midpoint.schema.util.MiscSchemaUtil;
+import com.evolveum.midpoint.util.QNameUtil;
 import com.evolveum.midpoint.util.exception.SchemaException;
+import com.evolveum.midpoint.util.logging.Trace;
+import com.evolveum.midpoint.util.logging.TraceManager;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectSynchronizationDiscriminatorType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectSynchronizationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ResourceType;
@@ -46,6 +49,8 @@
 
 public class SynchronizationUtils {
 	
+	private static final Trace LOGGER = TraceManager.getTrace(SynchronizationUtils.class);
+	
 	public static boolean isPolicyApplicable(PrismObject<? extends ShadowType> currentShadow,
 			ObjectSynchronizationType synchronizationPolicy, PrismObject<ResourceType> resource)
 					throws SchemaException {
@@ -58,6 +63,20 @@ public static boolean isPolicyApplicable(PrismObject<? extends ShadowType> curre
 		return isPolicyApplicable(shadowObjectClass, currentShadowType.getKind(), currentShadowType.getIntent(), synchronizationPolicy, resource);
 		
 	}
+	
+	public static boolean isPolicyApplicable(ObjectSynchronizationDiscriminatorType synchronizationDiscriminator,
+			ObjectSynchronizationType synchronizationPolicy, PrismObject<ResourceType> resource)
+					throws SchemaException {
+		ShadowKindType kind = synchronizationDiscriminator.getKind();
+		String intent = synchronizationDiscriminator.getIntent();
+		if (kind == null && intent == null) {
+			throw new SchemaException(
+					"Illegal state, object synchronization discriminator type must have kind/intent specified. Current values are: kind="
+							+ kind + ", intent=" + intent);
+		}
+		return isPolicyApplicable(null, kind, intent, synchronizationPolicy, resource);
+		
+	}
 
 	public static boolean isPolicyApplicable(QName objectClass, ShadowKindType kind, String intent, ObjectSynchronizationType synchronizationPolicy, PrismObject<ResourceType> resource) throws SchemaException{
 		
@@ -89,22 +108,26 @@ public static boolean isPolicyApplicable(QName objectClass, ShadowKindType kind,
 			}
 		}
 		if (policyObjectClasses != null && !policyObjectClasses.isEmpty()) {
-			if (!QNameUtil.contains(policyObjectClasses, objectClass)) {
+			if (objectClass != null && !QNameUtil.contains(policyObjectClasses, objectClass)) {
 				return false;
 			}
 		}
 
 		// kind
 		ShadowKindType policyKind = synchronizationPolicy.getKind();
+		LOGGER.trace("Comparing kinds, policy kind: {}, current kind: {}", policyKind, kind);
 		if (policyKind != null && kind != null && !policyKind.equals(kind)) {
+			LOGGER.trace("Kinds don't match, skipping policy {}", synchronizationPolicy);
 			return false;
 		}
 
 		// intent
 		// TODO is the intent always present in shadow at this time? [med]
 		String policyIntent = synchronizationPolicy.getIntent();
+		LOGGER.trace("Comparing intents, policy intent: {}, current intent: {}", policyIntent, intent);
 		if (policyIntent != null && intent != null
 				&& !MiscSchemaUtil.equalsIntent(intent, policyIntent)) {
+			LOGGER.trace("Intents don't match, skipping policy {}", synchronizationPolicy);
 			return false;
 		}
 
diff --git a/infra/prism/src/main/java/com/evolveum/midpoint/prism/Item.java b/infra/prism/src/main/java/com/evolveum/midpoint/prism/Item.java
index d49c6c2a14e..b79b57bf996 100644
--- a/infra/prism/src/main/java/com/evolveum/midpoint/prism/Item.java
+++ b/infra/prism/src/main/java/com/evolveum/midpoint/prism/Item.java
@@ -252,9 +252,9 @@ public Map<String, Object> getUserData() {
 		}
 	}
 
-    public Object getUserData(String key) {
+    public <T> T getUserData(String key) {
 		// TODO make returned data immutable (?)
-		return getUserData().get(key);
+		return (T) getUserData().get(key);
 	}
 
     public void setUserData(String key, Object value) {
diff --git a/infra/schema/src/main/java/com/evolveum/midpoint/schema/constants/RelationTypes.java b/infra/schema/src/main/java/com/evolveum/midpoint/schema/constants/RelationTypes.java
new file mode 100755
index 00000000000..e01bce0ff08
--- /dev/null
+++ b/infra/schema/src/main/java/com/evolveum/midpoint/schema/constants/RelationTypes.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2010-2018 Evolveum
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.evolveum.midpoint.schema.constants;
+
+import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
+import com.evolveum.midpoint.util.QNameUtil;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.AreaCategoryType;
+
+import javax.xml.namespace.QName;
+
+/**
+ * Built-in (hardcoded) relations.
+ * 
+ * Created by honchar.
+ */
+public enum RelationTypes {
+
+	MEMBER(SchemaConstants.ORG_DEFAULT, "", AreaCategoryType.ADMINISTRATION, AreaCategoryType.ORGANIZATION),
+    MANAGER(SchemaConstants.ORG_MANAGER, "Manager", AreaCategoryType.ADMINISTRATION, AreaCategoryType.ORGANIZATION),
+    META(SchemaConstants.ORG_META, "Meta", AreaCategoryType.POLICY),
+    DEPUTY(SchemaConstants.ORG_DEPUTY, "Deputy" /* no values */),
+    APPROVER(SchemaConstants.ORG_APPROVER, "Approver", AreaCategoryType.ADMINISTRATION, AreaCategoryType.GOVERNANCE),
+    OWNER(SchemaConstants.ORG_OWNER, "Owner", AreaCategoryType.ADMINISTRATION, AreaCategoryType.GOVERNANCE),
+    CONSENT(SchemaConstants.ORG_CONSENT, "Consent", AreaCategoryType.DATA_PROTECTION),;
+
+
+    private final QName relation;
+    private final String headerLabel;
+    private final AreaCategoryType[] categories;
+
+    RelationTypes(QName relation, String headerLabel, AreaCategoryType... categories) {
+        this.relation = relation;
+        this.headerLabel = headerLabel;
+        this.categories = categories;
+    }
+
+    public QName getRelation() {
+        return relation;
+    }
+
+    public String getHeaderLabel() {
+        return headerLabel;
+    }
+    
+    public String getLabelKey() {
+    	return RelationTypes.class.getSimpleName() + "." + getHeaderLabel();
+    }
+    
+    public AreaCategoryType[] getCategories() {
+		return categories;
+	}
+
+	public static RelationTypes getRelationType(QName relation) {
+        if (ObjectTypeUtil.isDefaultRelation(relation)) {
+            return RelationTypes.MEMBER;
+        }
+        for (RelationTypes relationTypes : RelationTypes.values()) {
+            if (QNameUtil.match(relation, relationTypes.getRelation())) {
+                return relationTypes;
+            }
+        }
+        return RelationTypes.MEMBER;
+    }
+}
diff --git a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java
index 0c4cd3bfae4..45697e86dc0 100644
--- a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java
+++ b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java
@@ -709,6 +709,15 @@ public static boolean isManagerRelation(QName relation) {
 	public static boolean isDefaultRelation(QName relation) {
 		return relation == null || QNameUtil.match(relation, SchemaConstants.ORG_DEFAULT);
 	}
+	
+	public static RelationDefinitionType findRelationDefinition(List<RelationDefinitionType> relationDefinitions, QName qname) {
+		for (RelationDefinitionType relation: relationDefinitions) {
+			if (QNameUtil.match(qname, relation.getRef())) {
+				return relation;
+			}
+		}
+		return null;
+	}
 
 	// We want to make this configurable in the future MID-3581
 	public static boolean processRelationOnLogin(QName relation) {
diff --git a/infra/schema/src/main/resources/xml/ns/public/common/common-core-3.xsd b/infra/schema/src/main/resources/xml/ns/public/common/common-core-3.xsd
index 9637aeeeb19..dd769c9fa7b 100755
--- a/infra/schema/src/main/resources/xml/ns/public/common/common-core-3.xsd
+++ b/infra/schema/src/main/resources/xml/ns/public/common/common-core-3.xsd
@@ -9510,6 +9510,7 @@
             </xsd:documentation>
         </xsd:annotation>
         <xsd:sequence>
+        	<xsd:element name="objectSynchronizationSorter" type="tns:ObjectSynchronizationSorterType" minOccurs="0" maxOccurs="1"/>
         	<xsd:element name="objectSynchronization" type="tns:ObjectSynchronizationType" minOccurs="0" maxOccurs="unbounded"/>
 		</xsd:sequence>
 	</xsd:complexType>
@@ -9688,7 +9689,7 @@
         </xsd:sequence>
     </xsd:complexType>
     
-    <xsd:complexType name="ObjectSynchronizationDividerType">
+    <xsd:complexType name="ObjectSynchronizationSorterType">
         <xsd:annotation>
             <xsd:documentation>
                 Defines a synchronization properties (configuration) for a
@@ -9722,6 +9723,8 @@
 		</xsd:sequence>
 	</xsd:complexType>
 	
+	<xsd:element name="objectSynchronizationSorter" type="tns:ObjectSynchronizationSorterType"/>
+	
 	 <xsd:complexType name="ObjectSynchronizationDiscriminatorType">
         <xsd:annotation>
             <xsd:documentation>
@@ -9730,7 +9733,7 @@
                 (live sync, reconciliation, import, ...)
             </xsd:documentation>
             <xsd:appinfo>
-  				<a:container/>
+<!--   				<a:container/> --> <!-- it's not container beacuse of the owner property. -->
    				<a:since>3.9</a:since>
    			</xsd:appinfo>
         </xsd:annotation>
@@ -9768,13 +9771,12 @@
         			</xsd:appinfo>
         		</xsd:annotation>
         	</xsd:element>
-        	<xsd:element name="ownerRef" type="tns:ObjectReferenceType" minOccurs="0" maxOccurs="1">
+        	<xsd:element name="owner" type="tns:FocusType" minOccurs="0" maxOccurs="1">
         		<xsd:annotation>
         			<xsd:documentation>
         				The owner of the resource object if known.
         			</xsd:documentation>
         			<xsd:appinfo>
-        				<a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
         				<a:since>3.9</a:since>
         			</xsd:appinfo>
         		</xsd:annotation>
@@ -9792,6 +9794,8 @@
 		</xsd:sequence>
 	</xsd:complexType>
 	
+	<xsd:element name="objectSynchronizationDiscriminator" type="tns:ObjectSynchronizationDiscriminatorType"/>
+	
     <xsd:complexType name="ConditionalSearchFilterType">
         <xsd:annotation>
             <xsd:documentation>
@@ -15588,7 +15592,17 @@
 					</xsd:appinfo>
 				</xsd:annotation>
 			</xsd:element>
-        </xsd:sequence>
+	        <xsd:element name="relations" type="tns:RelationsDefinitionType" minOccurs="0">
+				<xsd:annotation>
+					<xsd:documentation>
+						Definition of (custom) relations. This is system-global definition.
+					</xsd:documentation>
+					<xsd:appinfo>
+						<a:since>3.9</a:since>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:element>
+		</xsd:sequence>
     </xsd:complexType>
     
     <xsd:complexType name="AssignmentConstraintsType">
@@ -15635,6 +15649,184 @@
 			<!-- TODO: prohibitSameOrg, prohibitSameTenant, parameter prohibitions -->
         </xsd:sequence>
     </xsd:complexType>
+    
+    <xsd:complexType name="RelationsDefinitionType">
+        <xsd:annotation>
+            <xsd:documentation>
+                Definition of (custom) relations.
+            </xsd:documentation>
+            <xsd:appinfo>
+            	<a:container>true</a:container>
+				<a:since>3.9</a:since>
+			</xsd:appinfo>
+        </xsd:annotation>
+        <xsd:sequence>
+        	<xsd:element name="relation" type="tns:RelationDefinitionType" minOccurs="0" maxOccurs="unbounded">
+			    <xsd:annotation>
+			        <xsd:documentation>
+			            Definition of a single (custom) relation.
+			        </xsd:documentation>
+			        <xsd:appinfo>
+						<a:since>3.9</a:since>
+					</xsd:appinfo>
+			    </xsd:annotation>
+			</xsd:element>
+			<xsd:element name="includeDefaultRelations" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="true">
+			    <xsd:annotation>
+			        <xsd:documentation>
+			            If set to true then default (hardcoded) relations will be included in addition to those
+			            relations that are defined above. If set to false then only those relations that are defined
+			            above will be used in the system.
+			            EXPERIMENTAL: only partially supported
+			        </xsd:documentation>
+			        <xsd:appinfo>
+						<a:since>3.9</a:since>
+						<a:experimental>true</a:experimental>
+					</xsd:appinfo>
+			    </xsd:annotation>
+			</xsd:element>
+        </xsd:sequence>
+    </xsd:complexType>
+    
+    <xsd:complexType name="RelationDefinitionType">
+        <xsd:annotation>
+            <xsd:documentation>
+                Definition of a single (custom) relation.
+            </xsd:documentation>
+            <xsd:appinfo>
+            	<a:container>true</a:container>
+				<a:since>3.9</a:since>
+			</xsd:appinfo>
+        </xsd:annotation>
+        <xsd:sequence>
+        	<xsd:element name="ref" type="xsd:QName" minOccurs="1" maxOccurs="1">
+			    <xsd:annotation>
+			        <xsd:documentation>
+			            Relations identifier (QName)
+			        </xsd:documentation>
+			        <xsd:appinfo>
+						<a:since>3.9</a:since>
+					</xsd:appinfo>
+			    </xsd:annotation>
+			</xsd:element>
+			<xsd:element name="description" type="xsd:string" minOccurs="0" maxOccurs="1">
+			    <xsd:annotation>
+			        <xsd:documentation>
+			            Free-form description of relation purpose. This field can be used as a comment.
+			        </xsd:documentation>
+			        <xsd:appinfo>
+						<a:since>3.9</a:since>
+					</xsd:appinfo>
+			    </xsd:annotation>
+			</xsd:element>
+			<xsd:element name="display" type="tns:DisplayType" minOccurs="0" maxOccurs="1">
+			    <xsd:annotation>
+			        <xsd:documentation>
+			            Display properties of the relation. It is used to display the relation in
+			            drop-down lists, buttons, etc..
+     					Only label is used now. E.g. the CSS properties are ignored.
+			        </xsd:documentation>
+			        <xsd:appinfo>
+						<a:since>3.9</a:since>
+					</xsd:appinfo>
+			    </xsd:annotation>
+			</xsd:element>
+			<xsd:element name="category" type="tns:AreaCategoryType" minOccurs="0" maxOccurs="unbounded">
+			    <xsd:annotation>
+			        <xsd:documentation>
+			            Specifies category or "area" for the relation. This may indicate that the relation
+			            is used for identity governance, organizational management and so on. The category
+			            is used to display the relations in appropriate parts of user interface.
+			        </xsd:documentation>
+			        <xsd:appinfo>
+						<a:since>3.9</a:since>
+					</xsd:appinfo>
+			    </xsd:annotation>
+			</xsd:element>
+			<!-- TODO: type: membership, delegation, general -->
+			<!-- TODO: isDefault -->
+			<!-- TODO: isManager, processOnLogin, processOnRecompute  -->
+        </xsd:sequence>
+    </xsd:complexType>
+    
+    <xsd:simpleType name="AreaCategoryType">
+		<xsd:annotation>
+			<xsd:documentation>
+				Specifies category or "area" of a particular concept. Such category can be used
+				to display the concepts in appropriate parts of user interface. For example the
+				category may be used to display only governance-related relations in the governance
+				UI spanels.
+			</xsd:documentation>
+			<xsd:appinfo>
+				<a:since>3.9</a:since>
+			</xsd:appinfo>
+		</xsd:annotation>
+		<xsd:restriction base="xsd:string">
+			<xsd:enumeration value="administration">
+				<xsd:annotation>
+					<xsd:documentation>
+						General identity administration (IDM). Functionality available to
+						a common identity administrator.
+					</xsd:documentation>
+					<xsd:appinfo>
+						<jaxb:typesafeEnumMember name="ADMINISTRATION"/>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:enumeration>
+			<xsd:enumeration value="organization">
+				<xsd:annotation>
+					<xsd:documentation>
+						Organizational management category: management of organizational trees,
+						organizational unit membership, unit managers, etc.
+					</xsd:documentation>
+					<xsd:appinfo>
+						<jaxb:typesafeEnumMember name="ORGANIZATION"/>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:enumeration>
+			<xsd:enumeration value="governance">
+				<xsd:annotation>
+					<xsd:documentation>
+						Identity governance: approvers, owners, governance policies, remediation.
+					</xsd:documentation>
+					<xsd:appinfo>
+						<jaxb:typesafeEnumMember name="GOVERNANCE"/>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:enumeration>
+			<xsd:enumeration value="policy">
+				<xsd:annotation>
+					<xsd:documentation>
+						General policy management: RBAC, provisioning policies, policy rules, etc.
+					</xsd:documentation>
+					<xsd:appinfo>
+						<jaxb:typesafeEnumMember name="POLICY"/>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:enumeration>
+			<xsd:enumeration value="selfService">
+				<xsd:annotation>
+					<xsd:documentation>
+						End-user self service: profile update, password change, role request, etc.
+					</xsd:documentation>
+					<xsd:appinfo>
+						<jaxb:typesafeEnumMember name="SELF_SERVICE"/>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:enumeration>
+			<xsd:enumeration value="dataProtection">
+				<xsd:annotation>
+					<xsd:documentation>
+						Data protection: management of consent, lawful bases, data regulation compliance, etc.
+					</xsd:documentation>
+					<xsd:appinfo>
+						<jaxb:typesafeEnumMember name="DATA_PROTECTION"/>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:enumeration>
+			<!-- TODO: system management? administration? compliance? -->
+		</xsd:restriction>
+	</xsd:simpleType>
         
     <xsd:complexType name="ObjectCollectionsUseType">
         <xsd:annotation>
@@ -19433,12 +19625,69 @@
     <xsd:complexType name="DisplayType">
         <xsd:sequence>
             <!-- basic properties -->
-            <xsd:element name="label" type="xsd:string" minOccurs="0" />
-            <xsd:element name="tooltip" type="xsd:string" minOccurs="0" />
-            <xsd:element name="help" type="xsd:string" minOccurs="0" />
+            <xsd:element name="label" type="xsd:string" minOccurs="0" >
+            	<xsd:annotation>
+            		<xsd:documentation>
+            			<p>
+	            			Label of the displayed item. The label will (almost)
+	            			always be displayed - unless the item is hidden or
+	            			minimized/iconized. The label is usually the very
+	            			minimum to meaningfully display the item.
+	            			Label should be very short (couple of words).
+            			</p>
+            			<p>
+            				Plain string or a localization key may be used in
+            				this field. The value of this field will be interpreted
+            				as a localizaton key and looked up in the localization
+            				tables. If no translation is found, then the literal
+            				value is displayed.
+            			</p>
+            		</xsd:documentation>
+            	</xsd:annotation>
+            </xsd:element>
+            <xsd:element name="tooltip" type="xsd:string" minOccurs="0">
+            	<xsd:annotation>
+            		<xsd:documentation>
+            			<p>
+	            			Tooltip of the displayed item. This is short text
+	            			that is usually displayed when the user howers mouse
+	            			cursor over the item. It may also be displayed next to
+	            			the selection in lists and so on.
+	            			Tooltip should still be quite short (one short sentence).
+            			</p>
+            			<p>
+            				Plain string or a localization key may be used in
+            				this field. The value of this field will be interpreted
+            				as a localizaton key and looked up in the localization
+            				tables. If no translation is found, then the literal
+            				value is displayed.
+            			</p>
+            		</xsd:documentation>
+            	</xsd:annotation>            
+            </xsd:element>
+            <xsd:element name="help" type="xsd:string" minOccurs="0">
+            	<xsd:annotation>
+            		<xsd:documentation>
+            			<p>
+	            			Help text for the displayed item. Help text is usually
+	            			displayed when the user clicks on help/information icon. 
+	            			This may be a longer text (several sentences).
+            			</p>
+            			<p>
+            				Plain string or a localization key may be used in
+            				this field. The value of this field will be interpreted
+            				as a localizaton key and looked up in the localization
+            				tables. If no translation is found, then the literal
+            				value is displayed.
+            			</p>
+            		</xsd:documentation>
+            	</xsd:annotation>            
+            </xsd:element>
             <!-- style properties -->
             <xsd:element name="cssStyle" type="xsd:string" minOccurs="0" />
             <xsd:element name="cssClass" type="xsd:string" minOccurs="0" />
+            <!-- TODO: icon -->
+            <!-- TODO: multilingual label, tooltip and help -->
         </xsd:sequence>
     </xsd:complexType>
 
diff --git a/model/model-api/src/main/java/com/evolveum/midpoint/model/api/ModelInteractionService.java b/model/model-api/src/main/java/com/evolveum/midpoint/model/api/ModelInteractionService.java
index 1bdcae73a2d..02a73fdb21d 100644
--- a/model/model-api/src/main/java/com/evolveum/midpoint/model/api/ModelInteractionService.java
+++ b/model/model-api/src/main/java/com/evolveum/midpoint/model/api/ModelInteractionService.java
@@ -338,12 +338,14 @@ LocalizableMessageType createLocalizableMessageType(LocalizableMessageTemplateTy
 			throws ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException,
 			ConfigurationException, SecurityViolationException;
 	
-	public ExecuteCredentialResetResponseType executeCredentialsReset(PrismObject<UserType> user, 
+	ExecuteCredentialResetResponseType executeCredentialsReset(PrismObject<UserType> user, 
 			ExecuteCredentialResetRequestType executeCredentialResetRequest, Task task, OperationResult result)
 			throws ObjectNotFoundException, SchemaException, CommunicationException, ConfigurationException,
 			SecurityViolationException, ExpressionEvaluationException, ObjectAlreadyExistsException, PolicyViolationException;
 	
-	public void clearCaches();
+	void clearCaches();
 	
 	void refreshPrincipal(String oid) throws ObjectNotFoundException, SchemaException;
+	
+	List<RelationDefinitionType> getRelationDefinitions(OperationResult parentResult) throws ObjectNotFoundException, SchemaException;
 }
diff --git a/model/model-api/src/main/java/com/evolveum/midpoint/model/api/expr/MidpointFunctions.java b/model/model-api/src/main/java/com/evolveum/midpoint/model/api/expr/MidpointFunctions.java
index df444f31eb2..303ff93cf12 100644
--- a/model/model-api/src/main/java/com/evolveum/midpoint/model/api/expr/MidpointFunctions.java
+++ b/model/model-api/src/main/java/com/evolveum/midpoint/model/api/expr/MidpointFunctions.java
@@ -499,6 +499,8 @@ <F extends FocusType> void recompute(Class<F> type, String oid)
 	 * object.
 	 * </p>
 	 * 
+	 * @deprecated use searchShadowOwner instead
+	 * 
 	 * @param accountOid
 	 *            OID of the account to look for an owner
 	 * @return owner of the account or null
@@ -516,8 +518,13 @@ <F extends FocusType> void recompute(Class<F> type, String oid)
 	 *             unknown error from underlying layers or other unexpected
 	 *             state
 	 */
+	@Deprecated
 	PrismObject<UserType> findShadowOwner(String accountOid) throws ObjectNotFoundException, SecurityViolationException, SchemaException, ConfigurationException, ExpressionEvaluationException, CommunicationException;
 
+	<F extends FocusType> PrismObject<F> searchShadowOwner(String accountOid)
+			throws ObjectNotFoundException, SecurityViolationException, SchemaException, ConfigurationException,
+			ExpressionEvaluationException, CommunicationException;
+	
 	/**
 	 * <p>
 	 * Search for objects.
diff --git a/model/model-common/src/main/java/com/evolveum/midpoint/model/common/SystemObjectCache.java b/model/model-common/src/main/java/com/evolveum/midpoint/model/common/SystemObjectCache.java
index 23b7e5aa479..12804599e79 100644
--- a/model/model-common/src/main/java/com/evolveum/midpoint/model/common/SystemObjectCache.java
+++ b/model/model-common/src/main/java/com/evolveum/midpoint/model/common/SystemObjectCache.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) 2016 Evolveum
+ * Copyright (c) 2016-2018 Evolveum
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,7 +15,10 @@
  */
 package com.evolveum.midpoint.model.common;
 
+import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
+import java.util.List;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -25,11 +28,17 @@
 import com.evolveum.midpoint.repo.api.RepositoryService;
 import com.evolveum.midpoint.schema.GetOperationOptions;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.result.OperationResult;
+import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
 import com.evolveum.midpoint.util.exception.ObjectNotFoundException;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.DisplayType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RelationDefinitionType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RelationsDefinitionType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleManagementConfigurationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.SystemConfigurationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.SystemObjectsType;
 
@@ -55,6 +64,8 @@
 public class SystemObjectCache {
 
 	private static final Trace LOGGER = TraceManager.getTrace(SystemObjectCache.class);
+	
+	private static final String USER_DATA_KEY_RELATIONS = SystemObjectCache.class.getName() + ".relations";
 
 	@Autowired
 	@Qualifier("cacheRepositoryService")
@@ -120,4 +131,59 @@ private void loadSystemConfiguration(OperationResult result) throws ObjectNotFou
 	public synchronized void invalidateCaches() {
 		systemConfiguration = null;
 	}
+	
+	public List<RelationDefinitionType> getRelationDefinitions(OperationResult parentResult) throws ObjectNotFoundException, SchemaException {
+		PrismObject<SystemConfigurationType> systemConfiguration = getSystemConfiguration(parentResult);
+		if (systemConfiguration == null) {
+			return createRelationDefinitions(null);
+		}
+		List<RelationDefinitionType> cachedRelations = systemConfiguration.getUserData(USER_DATA_KEY_RELATIONS);
+		if (cachedRelations != null) {
+			return cachedRelations;
+		}
+		RoleManagementConfigurationType roleManagement = systemConfiguration.asObjectable().getRoleManagement();
+		RelationsDefinitionType relationsDef = null;
+		if (roleManagement != null) {
+			relationsDef = roleManagement.getRelations();
+		}
+		cachedRelations = createRelationDefinitions(relationsDef);
+		systemConfiguration.setUserData(USER_DATA_KEY_RELATIONS, cachedRelations);
+		return cachedRelations;
+	}
+
+	private List<RelationDefinitionType> createRelationDefinitions(RelationsDefinitionType relationsDef) {
+		List<RelationDefinitionType> configuredRelations = null;
+		boolean includeDefaultRelations = true;
+		if (relationsDef != null) {
+			configuredRelations = relationsDef.getRelation();
+			if (relationsDef.isIncludeDefaultRelations() != null && !relationsDef.isIncludeDefaultRelations()) {
+				includeDefaultRelations = false;
+			}
+		}
+		List<RelationDefinitionType> relations = new ArrayList<>();
+		if (configuredRelations != null) {
+			for (RelationDefinitionType configuredRelation: configuredRelations) {
+				relations.add(configuredRelation.clone());
+			}
+		}
+		if (includeDefaultRelations) {
+			addDefaultRelations(relations);
+		}
+		return relations;
+	}
+
+	private void addDefaultRelations(List<RelationDefinitionType> relations) {
+		for (RelationTypes relationTypeEnum : RelationTypes.values()) {
+			if (ObjectTypeUtil.findRelationDefinition(relations, relationTypeEnum.getRelation()) != null) {
+				continue;
+			}
+			RelationDefinitionType relationDef = new RelationDefinitionType();
+			relationDef.setRef(relationTypeEnum.getRelation());
+			DisplayType display = new DisplayType();
+			display.setLabel(relationTypeEnum.getLabelKey());
+			relationDef.setDisplay(display);
+			relationDef.getCategory().addAll(Arrays.asList(relationTypeEnum.getCategories()));
+			relations.add(relationDef);
+		}
+	}
 }
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/controller/ModelInteractionServiceImpl.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/controller/ModelInteractionServiceImpl.java
index e797139b29c..678d5819661 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/controller/ModelInteractionServiceImpl.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/controller/ModelInteractionServiceImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2017 Evolveum
+ * Copyright (c) 2010-2018 Evolveum
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -127,6 +127,7 @@
 import com.evolveum.midpoint.schema.RetrieveOption;
 import com.evolveum.midpoint.schema.SearchResultList;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.RelationTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.schema.result.OperationResultStatus;
@@ -172,6 +173,7 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ActivationStatusType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ActivationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AdminGuiConfigurationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.AreaCategoryType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AuthenticationsPolicyType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType;
@@ -180,6 +182,7 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.CredentialsPolicyType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.CredentialsResetPolicyType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.DeploymentInformationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.DisplayType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.LayerType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.LensContextType;
@@ -194,7 +197,10 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.OtherPrivilegesLimitationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.PasswordType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.RegistrationsPolicyType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RelationDefinitionType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RelationsDefinitionType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ResourceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleManagementConfigurationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.SecurityPolicyType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowType;
@@ -247,7 +253,7 @@ public class ModelInteractionServiceImpl implements ModelInteractionService {
 
 	private static final String OPERATION_GENERATE_VALUE = ModelInteractionService.class.getName() +  ".generateValue";
 	private static final String OPERATION_VALIDATE_VALUE = ModelInteractionService.class.getName() +  ".validateValue";
-
+	
 	/* (non-Javadoc)
 	 * @see com.evolveum.midpoint.model.api.ModelInteractionService#previewChanges(com.evolveum.midpoint.prism.delta.ObjectDelta, com.evolveum.midpoint.schema.result.OperationResult)
 	 */
@@ -1720,6 +1726,10 @@ public void refreshPrincipal(String oid) throws ObjectNotFoundException, SchemaE
 		
 		
 	}
-	
+
+	@Override
+	public List<RelationDefinitionType> getRelationDefinitions(OperationResult parentResult) throws ObjectNotFoundException, SchemaException {
+		return systemObjectCache.getRelationDefinitions(parentResult);
+	}
 
 }
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/expr/MidpointFunctionsImpl.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/expr/MidpointFunctionsImpl.java
index 74f658d4336..ae30a51bc36 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/expr/MidpointFunctionsImpl.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/expr/MidpointFunctionsImpl.java
@@ -1041,6 +1041,13 @@ public PrismObject<UserType> findShadowOwner(String accountOid)
 			ExpressionEvaluationException, CommunicationException {
 		return modelService.findShadowOwner(accountOid, getCurrentTask(), getCurrentResult());
 	}
+	
+	@Override
+	public <F extends FocusType> PrismObject<F> searchShadowOwner(String accountOid)
+			throws ObjectNotFoundException, SecurityViolationException, SchemaException, ConfigurationException,
+			ExpressionEvaluationException, CommunicationException {
+		return (PrismObject<F>) modelService.searchShadowOwner(accountOid, null, getCurrentTask(), getCurrentResult());
+	}
 
 	@Override
 	public <T extends ObjectType> List<T> searchObjects(
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/integrity/ShadowIntegrityCheckResultHandler.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/integrity/ShadowIntegrityCheckResultHandler.java
index 2b43d2c2554..ebea14237c3 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/integrity/ShadowIntegrityCheckResultHandler.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/integrity/ShadowIntegrityCheckResultHandler.java
@@ -20,6 +20,7 @@
 import com.evolveum.midpoint.common.refinery.RefinedResourceSchema;
 import com.evolveum.midpoint.common.refinery.RefinedResourceSchemaImpl;
 import com.evolveum.midpoint.model.common.SystemObjectCache;
+import com.evolveum.midpoint.model.impl.sync.SynchronizationContext;
 import com.evolveum.midpoint.model.impl.sync.SynchronizationService;
 import com.evolveum.midpoint.model.impl.util.Utils;
 import com.evolveum.midpoint.prism.*;
@@ -517,7 +518,8 @@ private void doFixIntent(ShadowCheckResult checkResult, PrismObject<ShadowType>
 
         ObjectSynchronizationType synchronizationPolicy;
         try {
-            synchronizationPolicy = synchronizationService.determineSynchronizationPolicy(resource.asObjectable(), fullShadow, configuration, task, result);
+        	SynchronizationContext<? extends FocusType> syncCtx = synchronizationService.loadSynchronizationContext(fullShadow, fullShadow, resource, task.getChannel(), systemObjectCache.getSystemConfiguration(result), task, result);
+            synchronizationPolicy = syncCtx.getObjectSynchronization();            
         } catch (SchemaException | ObjectNotFoundException | ExpressionEvaluationException | RuntimeException | CommunicationException | ConfigurationException | SecurityViolationException e) {
             checkResult.recordError(ShadowStatistics.CANNOT_APPLY_FIX, new SystemException("Couldn't prepare fix for missing intent, because the synchronization policy couldn't be determined", e));
             return;
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationContext.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationContext.java
new file mode 100644
index 00000000000..3a7497155a3
--- /dev/null
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationContext.java
@@ -0,0 +1,141 @@
+package com.evolveum.midpoint.model.impl.sync;
+
+import javax.xml.namespace.QName;
+
+import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.prism.util.PrismMonitor;
+import com.evolveum.midpoint.schema.constants.ObjectTypes;
+import com.evolveum.midpoint.util.exception.ConfigurationException;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectSynchronizationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ResourceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.SynchronizationReactionType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.SynchronizationSituationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.SystemConfigurationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+
+public class SynchronizationContext<F extends FocusType> {
+
+	private PrismObject<ShadowType> applicableShadow;
+	private PrismObject<ShadowType> currentShadow;
+	private PrismObject<ResourceType> resource;
+	private PrismObject<SystemConfigurationType> systemConfiguration;
+	private String chanel;
+	
+	private ObjectSynchronizationType objectSynchronization;
+	private Class<F> focusClass;
+	private F currentOwner;
+	private F correlatedOwner;
+	private SynchronizationSituationType situation;
+	
+	private SynchronizationReactionType reaction;
+	
+	public SynchronizationContext(PrismObject<ShadowType> applicableShadow, PrismObject<ShadowType> currentShadow, PrismObject<ResourceType> resource, String chanel) {
+		this.applicableShadow = applicableShadow;
+		this.currentShadow = currentShadow;
+		this.resource = resource;
+		this.chanel = chanel;
+	}
+	
+	public PrismObject<ShadowType> getApplicableShadow() {
+		return applicableShadow;
+	}
+	public PrismObject<ShadowType> getCurrentShadow() {
+		return currentShadow;
+	}
+	public PrismObject<ResourceType> getResource() {
+		return resource;
+	}
+	public ObjectSynchronizationType getObjectSynchronization() {
+		return objectSynchronization;
+	}
+
+	public Class<F> getFocusClass() throws ConfigurationException {
+		
+		if (focusClass != null) {
+			return focusClass;
+		}
+		
+		if (objectSynchronization == null) {
+			throw new IllegalStateException("synchronizationPolicy is null");
+		}
+		
+		QName focusTypeQName = objectSynchronization.getFocusType();
+		if (focusTypeQName == null) {
+			this.focusClass = (Class<F>) UserType.class;
+			return focusClass;
+		}
+		ObjectTypes objectType = ObjectTypes.getObjectTypeFromTypeQName(focusTypeQName);
+		if (objectType == null) {
+			throw new ConfigurationException(
+					"Unknown focus type " + focusTypeQName + " in synchronization policy in " + resource);
+		}
+		this.focusClass = (Class<F>) objectType.getClassDefinition();
+		return focusClass;
+	}
+
+	public F getCurrentOwner() {
+		return currentOwner;
+	}
+
+	public F getCorrelatedOwner() {
+		return correlatedOwner;
+	}
+
+	public SynchronizationSituationType getSituation() {
+		return situation;
+	}
+
+	public void setObjectSynchronization(ObjectSynchronizationType objectSynchronization) {
+		this.objectSynchronization = objectSynchronization;
+	}
+
+	public void setFocusClass(Class<F> focusClass) {
+		this.focusClass = focusClass;
+	}
+
+	public void setCurrentOwner(F owner) {
+		this.currentOwner = owner;
+	}
+
+	public void setCorrelatedOwner(F correlatedFocus) {
+		this.correlatedOwner = correlatedFocus;
+	}
+
+	public void setSituation(SynchronizationSituationType situation) {
+		this.situation = situation;
+	}
+
+	public PrismObject<SystemConfigurationType> getSystemConfiguration() {
+		return systemConfiguration;
+	}
+	public String getChanel() {
+		return chanel;
+	}
+	public void setApplicableShadow(PrismObject<ShadowType> applicableShadow) {
+		this.applicableShadow = applicableShadow;
+	}
+	public void setCurrentShadow(PrismObject<ShadowType> currentShadow) {
+		this.currentShadow = currentShadow;
+	}
+	public void setResource(PrismObject<ResourceType> resource) {
+		this.resource = resource;
+	}
+	public void setSystemConfiguration(PrismObject<SystemConfigurationType> systemConfiguration) {
+		this.systemConfiguration = systemConfiguration;
+	}
+	public void setChanel(String chanel) {
+		this.chanel = chanel;
+	}
+	
+	public SynchronizationReactionType getReaction() {
+		return reaction;
+	}
+	
+	public void setReaction(SynchronizationReactionType reaction) {
+		this.reaction = reaction;
+	}
+
+	
+}
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationService.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationService.java
index 31c6c2ce3cc..c3c0ccccb3f 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationService.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationService.java
@@ -32,8 +32,10 @@
  * @author mederly
  */
 public interface SynchronizationService extends ResourceObjectChangeListener {
-	ObjectSynchronizationType determineSynchronizationPolicy(ResourceType resourceType,
-			PrismObject<? extends ShadowType> currentShadow, PrismObject<SystemConfigurationType> configuration, Task task, OperationResult result) throws
+
+	<F extends FocusType> SynchronizationContext<F> loadSynchronizationContext(PrismObject<ShadowType> applicableShadow, PrismObject<ShadowType> currentShadow, PrismObject<ResourceType> resource,
+			String sourceChanel, PrismObject<SystemConfigurationType> configuration,
+			Task task, OperationResult result) throws
 			SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException;
 
 	<F extends FocusType> boolean matchUserCorrelationRule(PrismObject<ShadowType> shadow, PrismObject<F> focus,
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationServiceImpl.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationServiceImpl.java
index 5df6a19ec05..7fb108857e2 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationServiceImpl.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationServiceImpl.java
@@ -43,8 +43,13 @@
 import com.evolveum.midpoint.model.impl.lens.LensFocusContext;
 import com.evolveum.midpoint.model.impl.lens.LensProjectionContext;
 import com.evolveum.midpoint.model.impl.util.Utils;
+import com.evolveum.midpoint.prism.PrismContainerDefinition;
+import com.evolveum.midpoint.prism.PrismContainerValue;
+import com.evolveum.midpoint.prism.PrismContext;
 import com.evolveum.midpoint.prism.PrismObject;
 import com.evolveum.midpoint.prism.PrismProperty;
+import com.evolveum.midpoint.prism.PrismPropertyDefinition;
+import com.evolveum.midpoint.prism.PrismPropertyDefinitionImpl;
 import com.evolveum.midpoint.prism.PrismPropertyValue;
 import com.evolveum.midpoint.prism.delta.ChangeType;
 import com.evolveum.midpoint.prism.delta.ItemDelta;
@@ -60,6 +65,7 @@
 import com.evolveum.midpoint.schema.GetOperationOptions;
 import com.evolveum.midpoint.schema.ResourceShadowDiscriminator;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.ExpressionConstants;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.internals.InternalsConfig;
@@ -86,6 +92,8 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ExpressionType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectReferenceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectSynchronizationDiscriminatorType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectSynchronizationSorterType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectSynchronizationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectTemplateType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ResourceType;
@@ -96,7 +104,6 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.SynchronizationSituationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.SynchronizationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.SystemConfigurationType;
-import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
 
 /**
  * Synchronization service receives change notifications from provisioning. It
@@ -120,13 +127,14 @@ public class SynchronizationServiceImpl implements SynchronizationService {
 	@Autowired private Clockwork clockwork;
 	@Autowired private ExpressionFactory expressionFactory;
 	@Autowired private SystemObjectCache systemObjectCache;
+	@Autowired private PrismContext prismContext;
 	
 	@Autowired
 	@Qualifier("cacheRepositoryService")
 	private RepositoryService repositoryService;
 
 	@Override
-	public void notifyChange(ResourceObjectShadowChangeDescription change, Task task, OperationResult parentResult) {
+	public <F extends FocusType> void notifyChange(ResourceObjectShadowChangeDescription change, Task task, OperationResult parentResult) {
 		validate(change);
 		Validate.notNull(parentResult, "Parent operation result must not be null.");
 
@@ -145,136 +153,53 @@ public void notifyChange(ResourceObjectShadowChangeDescription change, Task task
 			// We need this e.g. in case of delete
 			applicableShadow = change.getOldShadow();
 		}
-
+		
+		
 		SynchronizationEventInformation eventInfo = new SynchronizationEventInformation(applicableShadow,
 				change.getSourceChannel(), task);
 
 		try {
 
-			ResourceType resourceType = change.getResource().asObjectable();
 			PrismObject<SystemConfigurationType> configuration = systemObjectCache.getSystemConfiguration(subResult);
+			SynchronizationContext<F> syncCtx = loadSynchronizationContext(applicableShadow, currentShadow, change.getResource(), change.getSourceChannel(), configuration, task, subResult);
 
-			ObjectSynchronizationType synchronizationPolicy = determineSynchronizationPolicy(resourceType,
-					applicableShadow, configuration, task, subResult);
-
-			if (LOGGER.isTraceEnabled()) {
-				String policyDesc = null;
-				if (synchronizationPolicy != null) {
-					if (synchronizationPolicy.getName() == null) {
-						policyDesc = "(kind=" + synchronizationPolicy.getKind() + ", intent="
-								+ synchronizationPolicy.getIntent() + ", objectclass="
-								+ synchronizationPolicy.getObjectClass() + ")";
-					} else {
-						policyDesc = synchronizationPolicy.getName();
-					}
-				}
-				LOGGER.trace("SYNCHRONIZATION determined policy: {}", policyDesc);
-			}
+			ObjectSynchronizationType obejctSynchronization = syncCtx.getObjectSynchronization();
+			traceObjectSynchronization(obejctSynchronization);
 
-			if (synchronizationPolicy == null) {
-				String message = "SYNCHRONIZATION no matching policy for " + applicableShadow + " ("
-						+ applicableShadow.asObjectable().getObjectClass() + ") " + " on " + resourceType
-						+ ", ignoring change from channel " + change.getSourceChannel();
-				LOGGER.debug(message);
-				List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(applicableShadow, null);
-				executeShadowModifications(applicableShadow, modifications, task, subResult);
-				subResult.recordStatus(OperationResultStatus.NOT_APPLICABLE, message);
-				eventInfo.setNoSynchronizationPolicy();
-				eventInfo.record(task);
+			if (!checkSynchronizationPolicy(syncCtx, eventInfo, task, subResult)) {
 				return;
 			}
 
-			if (!isSynchronizationEnabled(synchronizationPolicy)) {
-				String message = "SYNCHRONIZATION is not enabled for " + resourceType
-						+ " ignoring change from channel " + change.getSourceChannel();
-				LOGGER.debug(message);
-				List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(applicableShadow, synchronizationPolicy.getIntent());
-				executeShadowModifications(applicableShadow, modifications, task, subResult);
-				subResult.recordStatus(OperationResultStatus.NOT_APPLICABLE, message);
-				eventInfo.setSynchronizationNotEnabled();
-				eventInfo.record(task);
+			if (!checkTaskConstraints(syncCtx, eventInfo, task, subResult)) {
 				return;
 			}
 
-			// check if the kind/intent in the syncPolicy satisfy constraints
-			// defined in task
-			if (!satisfyTaskConstraints(synchronizationPolicy, task)) {
-				LOGGER.trace(
-						"SYNCHRONIZATION skipping {} because it does not match kind/intent defined in task",
-						new Object[] { applicableShadow });
-				List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(applicableShadow, synchronizationPolicy.getIntent());
-				executeShadowModifications(currentShadow, modifications, task, subResult);
-				subResult.recordStatus(OperationResultStatus.NOT_APPLICABLE,
-						"Skipped because it does not match objectClass/kind/intent");
-				eventInfo.setDoesNotMatchTaskSpecification();
-				eventInfo.record(task);
+			if (!checkProtected(syncCtx, eventInfo, task, subResult)) {
 				return;
 			}
 
-			if (isProtected(currentShadow)) {
-				List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(applicableShadow, synchronizationPolicy.getIntent());
-				executeShadowModifications(applicableShadow, modifications, task, subResult);
-				subResult.recordSuccess();
-				eventInfo.record(task);
-				LOGGER.debug("SYNCHRONIZATION: DONE (dry run) for protected shadow {}", applicableShadow);
-				return;
-			}
-
-			Class<? extends FocusType> focusType = determineFocusClass(synchronizationPolicy, resourceType);
-
 			if (LOGGER.isTraceEnabled()) {
 				LOGGER.trace("Synchronization is enabled, focus class: {}, found applicable policy: {}",
-						focusType, Utils.getPolicyDesc(synchronizationPolicy));
+						syncCtx.getFocusClass(), Utils.getPolicyDesc(obejctSynchronization));
 			}
 
-			SynchronizationSituation situation = determineSituation(focusType, change, synchronizationPolicy,
-					configuration.asObjectable(), task, subResult);
-			if (logDebug) {
-				LOGGER.debug("SYNCHRONIZATION: SITUATION: '{}', currentOwner={}, correlatedOwner={}",
-						situation.getSituation().value(), situation.getCurrentOwner(),
-						situation.getCorrelatedOwner());
-			} else {
-				LOGGER.trace("SYNCHRONIZATION: SITUATION: '{}', currentOwner={}, correlatedOwner={}",
-						situation.getSituation().value(), situation.getCurrentOwner(),
-						situation.getCorrelatedOwner());
-			}
-			eventInfo.setOriginalSituation(situation.getSituation());
-			eventInfo.setNewSituation(situation.getSituation()); // overwritten later (TODO fix this!)
-
-			if (change.isUnrelatedChange() || Utils.isDryRun(task)) {
-				PrismObject<? extends ShadowType> object;
-				if (change.getCurrentShadow() != null) {
-					object = change.getCurrentShadow();
-				} else if (change.getOldShadow() != null) {
-					object = change.getOldShadow();
-				} else {
-					throw new IllegalStateException("No current nor old shadow present: " + change);
-				}
-
-				List<PropertyDelta<?>> modifications = SynchronizationUtils.createSynchronizationSituationAndDescriptionDelta(
-						object, situation.getSituation(), task.getChannel(), false);
-				if (StringUtils.isNotBlank(synchronizationPolicy.getIntent())) {
-					modifications.add(PropertyDelta.createModificationReplaceProperty(ShadowType.F_INTENT,
-							object.getDefinition(), synchronizationPolicy.getIntent()));
-				}
-				executeShadowModifications(object, modifications, task, subResult);
-				subResult.recordSuccess();
-				eventInfo.record(task);
-				LOGGER.debug("SYNCHRONIZATION: DONE (dry run/unrelated) for {}", object);
+			setupSituation(syncCtx, eventInfo, change, task, subResult);
+			
+			if (!checkDryRunAndUnrelatedChange(syncCtx, eventInfo, change, task, subResult)) {
 				return;
 			}
 
 			// must be here, because when the reaction has no action, the
-			// situation will be not set.
-			PrismObject<ShadowType> newCurrentShadow = saveSyncMetadata(
-					currentShadow, situation, change, synchronizationPolicy, task,
+			// situation won't be set.
+			PrismObject<ShadowType> newCurrentShadow = saveSyncMetadata(syncCtx, change, task,
 					parentResult);
 			if (newCurrentShadow != null) {
 				change.setCurrentShadow(newCurrentShadow);
+				syncCtx.setCurrentShadow(newCurrentShadow);
 			}
 
-			SynchronizationSituationType newSituation = reactToChange(focusType, change,
-					synchronizationPolicy, situation, resourceType, logDebug, configuration, task, subResult);
+			SynchronizationSituationType newSituation = reactToChange(syncCtx, change,
+					logDebug, task, subResult);
 			eventInfo.setNewSituation(newSituation);
 			eventInfo.record(task);
 			subResult.computeStatus();
@@ -297,30 +222,214 @@ public void notifyChange(ResourceObjectShadowChangeDescription change, Task task
 		}
 		LOGGER.debug("SYNCHRONIZATION: DONE for {}", currentShadow);
 	}
+	
+	@Override
+	public <F extends FocusType> SynchronizationContext<F> loadSynchronizationContext(PrismObject<ShadowType> applicableShadow, PrismObject<ShadowType> currentShadow, PrismObject<ResourceType> resource,
+			String sourceChanel, PrismObject<SystemConfigurationType> configuration,
+			Task task, OperationResult result)
+					throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
 
-	private List<PropertyDelta<?>> createShadowIntentAndSynchronizationTimestampDelta(PrismObject<ShadowType> currentShadow, String intent) {
-		List<PropertyDelta<?>> modifications = SynchronizationUtils.createSynchronizationTimestampsDelta(currentShadow);
-		if (StringUtils.isNotBlank(intent)) {
-			PropertyDelta<String> intentDelta = PropertyDelta.createModificationReplaceProperty(
-					ShadowType.F_INTENT, currentShadow.getDefinition(),
-					intent);
-			modifications.add(intentDelta);
+		SynchronizationContext<F> syncCtx = new SynchronizationContext<F>(applicableShadow, currentShadow, resource, sourceChanel);
+		syncCtx.setSystemConfiguration(configuration);
+		
+		SynchronizationType synchronization = resource.asObjectable().getSynchronization();
+		if (synchronization == null) {
+			return syncCtx;
+		}
+		
+		ObjectSynchronizationDiscriminatorType synchronizationDiscriminator = determineObjectSynchronizationDiscriminatorType(syncCtx, task, result);
+		if (synchronizationDiscriminator != null) {
+			LOGGER.trace("Setting synchronization situation to synchronization context: {}", synchronizationDiscriminator.getSynchronizationSituation());
+			syncCtx.setSituation(synchronizationDiscriminator.getSynchronizationSituation());
+			F owner = (F) syncCtx.getCurrentOwner();
+			if (owner != null && alreadyLinked(owner, syncCtx.getApplicableShadow())) {
+				LOGGER.trace("Setting owner to synchronization context: {}", synchronizationDiscriminator.getOwner());
+				syncCtx.setCurrentOwner((F) synchronizationDiscriminator.getOwner());
+			}
+			LOGGER.trace("Setting correlated owner to synchronization context: {}", synchronizationDiscriminator.getOwner());
+			syncCtx.setCorrelatedOwner((F) synchronizationDiscriminator.getOwner());
 		}
-		return modifications;
+		
+		for (ObjectSynchronizationType objectSynchronization : synchronization.getObjectSynchronization()) {
+			if (isPolicyApplicable(synchronizationDiscriminator, objectSynchronization, syncCtx.getResource())) {
+				syncCtx.setObjectSynchronization(objectSynchronization);
+				return syncCtx;
+			}
+		}
+		
+		for (ObjectSynchronizationType objectSynchronization : synchronization.getObjectSynchronization()) {
+			if (isPolicyApplicable(syncCtx, objectSynchronization, task, result)) {
+				syncCtx.setObjectSynchronization(objectSynchronization);
+				return syncCtx;
+			}
+		}
+		return syncCtx;
 	}
+	
+	private <F extends FocusType> ObjectSynchronizationDiscriminatorType determineObjectSynchronizationDiscriminatorType(SynchronizationContext<F> syncCtx, Task task, OperationResult subResult) 
+			throws SchemaException, ExpressionEvaluationException, ObjectNotFoundException, CommunicationException, 
+			ConfigurationException, SecurityViolationException {
 
-	private void executeShadowModifications(PrismObject<? extends ShadowType> object, List<PropertyDelta<?>> modifications,
-			Task task, OperationResult subResult) {
+		SynchronizationType synchronizationType = syncCtx.getResource().asObjectable().getSynchronization();
+		if (synchronizationType == null) {
+			return null;
+		}
+
+		ObjectSynchronizationSorterType divider = synchronizationType.getObjectSynchronizationSorter();
+		if (divider == null) {
+			return null;
+		}
+
+		return evaluateSynchronizationDivision(divider, syncCtx, task, subResult);
+
+	}
+
+	private boolean isPolicyApplicable(ObjectSynchronizationDiscriminatorType synchronizationDiscriminator, ObjectSynchronizationType synchronizationPolicy, PrismObject<ResourceType> resource) throws SchemaException {
+		if (synchronizationDiscriminator == null) {
+			return false;
+		}
+		return SynchronizationUtils.isPolicyApplicable(synchronizationDiscriminator, synchronizationPolicy, resource);
+	}
+	
+	private <F extends FocusType> boolean isPolicyApplicable(SynchronizationContext<F> syncCtx, ObjectSynchronizationType synchronizationPolicy, Task task, OperationResult result)
+					throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
+
+		if (!SynchronizationUtils.isPolicyApplicable(syncCtx.getApplicableShadow(), synchronizationPolicy, syncCtx.getResource())) {
+			return false;
+		}
+
+		Boolean conditionResult = evaluateSynchronizationPolicyCondition(synchronizationPolicy, syncCtx.getApplicableShadow(),
+				syncCtx.getResource(), syncCtx.getSystemConfiguration(), task, result);
+		return conditionResult != null ? conditionResult : true;
+	}
+	
+	private <F extends FocusType> ObjectSynchronizationDiscriminatorType evaluateSynchronizationDivision(ObjectSynchronizationSorterType synchronizationSorterType,
+			SynchronizationContext<F> syncCtx, Task task, OperationResult result)
+					throws SchemaException, ExpressionEvaluationException, ObjectNotFoundException, CommunicationException, ConfigurationException, SecurityViolationException {
+		if (synchronizationSorterType.getExpression() == null) {
+			return null;
+		}
+		ExpressionType classificationExpression = synchronizationSorterType.getExpression();
+		String desc = "syncrhonization divider type ";
+		ExpressionVariables variables = Utils.getDefaultExpressionVariables(null, syncCtx.getApplicableShadow(), null,
+				syncCtx.getResource(), syncCtx.getSystemConfiguration(), null);
+		variables.addVariableDefinition(ExpressionConstants.VAR_CHANNEL, syncCtx.getChanel());
 		try {
-			repositoryService.modifyObject(ShadowType.class, object.getOid(), modifications, subResult);
-			task.recordObjectActionExecuted(object, ChangeType.MODIFY, null);
-		} catch (Throwable t) {
-			task.recordObjectActionExecuted(object, ChangeType.MODIFY, t);
+			ModelExpressionThreadLocalHolder.pushExpressionEnvironment(new ExpressionEnvironment<>(task, result));
+			PrismPropertyDefinition<ObjectSynchronizationDiscriminatorType> discriminatorDef = prismContext.getSchemaRegistry()
+					.findPropertyDefinitionByElementName(new QName(SchemaConstants.NS_C, "objectSynchronizationDiscriminator"));
+//			PrismPropertyDefinition<ObjectSynchronizationDiscriminatorType> discriminatorDef = prismContext.getSchemaRegistry().findPropertyDefinitionByElementName();
+			PrismPropertyValue<ObjectSynchronizationDiscriminatorType> evaluateDiscriminator = ExpressionUtil.evaluateExpression(variables, discriminatorDef, 
+					classificationExpression, expressionFactory, desc, task, result);
+			if (evaluateDiscriminator == null) {
+				return null;
+			}
+			return evaluateDiscriminator.getValue();
 		} finally {
-			task.markObjectActionExecutedBoundary();
+			ModelExpressionThreadLocalHolder.popExpressionEnvironment();
 		}
 	}
+	
+	private Boolean evaluateSynchronizationPolicyCondition(ObjectSynchronizationType synchronizationPolicy,
+			PrismObject<? extends ShadowType> currentShadow, PrismObject<ResourceType> resource,
+			PrismObject<SystemConfigurationType> configuration, Task task, OperationResult result)
+					throws SchemaException, ExpressionEvaluationException, ObjectNotFoundException, CommunicationException, ConfigurationException, SecurityViolationException {
+		if (synchronizationPolicy.getCondition() == null) {
+			return null;
+		}
+		ExpressionType conditionExpressionType = synchronizationPolicy.getCondition();
+		String desc = "condition in object synchronization " + synchronizationPolicy.getName();
+		ExpressionVariables variables = Utils.getDefaultExpressionVariables(null, currentShadow, null,
+				resource, configuration, null);
+		try {
+			ModelExpressionThreadLocalHolder.pushExpressionEnvironment(new ExpressionEnvironment<>(task, result));
+			PrismPropertyValue<Boolean> evaluateCondition = ExpressionUtil.evaluateCondition(variables,
+					conditionExpressionType, expressionFactory, desc, task, result);
+			return evaluateCondition.getValue();
+		} finally {
+			ModelExpressionThreadLocalHolder.popExpressionEnvironment();
+		}
+	}
+	
+	private void traceObjectSynchronization(ObjectSynchronizationType obejctSynchronization) {
+		if (LOGGER.isTraceEnabled()) {
+			String policyDesc = null;
+			if (obejctSynchronization != null) {
+				if (obejctSynchronization.getName() == null) {
+					policyDesc = "(kind=" + obejctSynchronization.getKind() + ", intent="
+							+ obejctSynchronization.getIntent() + ", objectclass="
+							+ obejctSynchronization.getObjectClass() + ")";
+				} else {
+					policyDesc = obejctSynchronization.getName();
+				}
+			}
+			LOGGER.trace("SYNCHRONIZATION determined policy: {}", policyDesc);
+		}
+	}
+	
+	private <F extends FocusType> boolean checkSynchronizationPolicy(SynchronizationContext<F> syncCtx, SynchronizationEventInformation eventInfo, Task task, OperationResult subResult) {
+		ObjectSynchronizationType obejctSynchronization = syncCtx.getObjectSynchronization();
+		if (obejctSynchronization == null) {
+			String message = "SYNCHRONIZATION no matching policy for " + syncCtx.getApplicableShadow() + " ("
+					+ syncCtx.getApplicableShadow().asObjectable().getObjectClass() + ") " + " on " + syncCtx.getResource()
+					+ ", ignoring change from channel " + syncCtx.getChanel();
+			LOGGER.debug(message);
+			List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(syncCtx.getApplicableShadow(), null);
+			executeShadowModifications(syncCtx.getApplicableShadow(), modifications, task, subResult);
+			subResult.recordStatus(OperationResultStatus.NOT_APPLICABLE, message);
+			eventInfo.setNoSynchronizationPolicy();
+			eventInfo.record(task);
+			return false;
+		}
 
+		if (!isSynchronizationEnabled(obejctSynchronization)) {
+			String message = "SYNCHRONIZATION is not enabled for " + syncCtx.getResource()
+					+ " ignoring change from channel " + syncCtx.getChanel();
+			LOGGER.debug(message);
+			List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(syncCtx.getApplicableShadow(), obejctSynchronization.getIntent());
+			executeShadowModifications(syncCtx.getApplicableShadow(), modifications, task, subResult);
+			subResult.recordStatus(OperationResultStatus.NOT_APPLICABLE, message);
+			eventInfo.setSynchronizationNotEnabled();
+			eventInfo.record(task);
+			return false;
+		}
+		
+		return true;
+	}
+	
+	private boolean isSynchronizationEnabled(ObjectSynchronizationType synchronization) {
+		if (synchronization == null || synchronization.isEnabled() == null) {
+			return false;
+		}
+		return synchronization.isEnabled();
+	}
+	
+	/**
+	 * check if the kind/intent in the syncPolicy satisfy constraints defined in task
+	 * @param syncCtx
+	 * @param eventInfo
+	 * @param task
+	 * @param subResult
+	 * @return
+	 */
+	private <F extends FocusType> boolean checkTaskConstraints(SynchronizationContext<F> syncCtx, SynchronizationEventInformation eventInfo, Task task, OperationResult subResult) {
+		ObjectSynchronizationType obejctSynchronization = syncCtx.getObjectSynchronization();
+		if (!satisfyTaskConstraints(obejctSynchronization, task)) {
+			LOGGER.trace("SYNCHRONIZATION skipping {} because it does not match kind/intent defined in task",
+					new Object[] { syncCtx.getApplicableShadow() });
+			List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(syncCtx.getApplicableShadow(),
+					obejctSynchronization.getIntent());
+			executeShadowModifications(syncCtx.getCurrentShadow(), modifications, task, subResult);
+			subResult.recordStatus(OperationResultStatus.NOT_APPLICABLE,
+					"Skipped because it does not match objectClass/kind/intent");
+			eventInfo.setDoesNotMatchTaskSpecification();
+			eventInfo.record(task);
+			return false;
+		}
+		
+		return true;
+	}
+	
 	private boolean satisfyTaskConstraints(ObjectSynchronizationType synchronizationPolicy, Task task) {
 		PrismProperty<ShadowKindType> kind = task.getExtensionProperty(SchemaConstants.MODEL_EXTENSION_KIND);
 		if (kind != null && !kind.isEmpty()) {
@@ -348,6 +457,20 @@ private boolean satisfyTaskConstraints(ObjectSynchronizationType synchronization
 		return true;
 	}
 
+	
+	private <F extends FocusType> boolean checkProtected(SynchronizationContext<F> syncCtx, SynchronizationEventInformation eventInfo, Task task, OperationResult subResult) {
+		if (isProtected(syncCtx.getApplicableShadow())) {
+			List<PropertyDelta<?>> modifications = createShadowIntentAndSynchronizationTimestampDelta(syncCtx.getApplicableShadow(), syncCtx.getObjectSynchronization().getIntent());
+			executeShadowModifications(syncCtx.getApplicableShadow(), modifications, task, subResult);
+			subResult.recordSuccess();
+			eventInfo.setProtected();
+			eventInfo.record(task);
+			LOGGER.debug("SYNCHRONIZATION: DONE (dry run) for protected shadow {}", syncCtx.getApplicableShadow());
+			return false;
+		}
+		return true;
+	}
+	
 	private boolean isProtected(PrismObject<ShadowType> shadow) {
 		if (shadow == null) {
 			return false;
@@ -360,79 +483,57 @@ private boolean isProtected(PrismObject<ShadowType> shadow) {
 
 		return currentShadowType.isProtectedObject();
 	}
+	
+	private <F extends FocusType> boolean checkDryRunAndUnrelatedChange(SynchronizationContext<F> syncCtx, SynchronizationEventInformation eventInfo, ResourceObjectShadowChangeDescription change, Task task, OperationResult subResult) throws SchemaException {
+		
+		if (change.isUnrelatedChange() || Utils.isDryRun(task)) {
+			if (syncCtx.getApplicableShadow() == null) { 
+				throw new IllegalStateException("No current nor old shadow present: " + change);
+			}
 
-	private <F extends FocusType> Class<F> determineFocusClass(
-			ObjectSynchronizationType synchronizationPolicy, ResourceType resource)
-					throws ConfigurationException {
-		if (synchronizationPolicy == null) {
-			throw new IllegalStateException("synchronizationPolicy is null");
-		}
-		QName focusTypeQName = synchronizationPolicy.getFocusType();
-		if (focusTypeQName == null) {
-			return (Class<F>) UserType.class;
-		}
-		ObjectTypes objectType = ObjectTypes.getObjectTypeFromTypeQName(focusTypeQName);
-		if (objectType == null) {
-			throw new ConfigurationException(
-					"Unknown focus type " + focusTypeQName + " in synchronization policy in " + resource);
-		}
-		return (Class<F>) objectType.getClassDefinition();
-	}
-
-	@Override
-	public ObjectSynchronizationType determineSynchronizationPolicy(ResourceType resourceType,
-			PrismObject<? extends ShadowType> currentShadow,
-			PrismObject<SystemConfigurationType> configuration, Task task, OperationResult result)
-					throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
-
-		SynchronizationType synchronization = resourceType.getSynchronization();
-		if (synchronization == null) {
-			return null;
-		}
-		for (ObjectSynchronizationType objectSynchronization : synchronization.getObjectSynchronization()) {
-			if (isPolicyApplicable(currentShadow, objectSynchronization, resourceType.asPrismObject(),
-					configuration, task, result)) {
-				return objectSynchronization;
+			List<PropertyDelta<?>> modifications = SynchronizationUtils.createSynchronizationSituationAndDescriptionDelta(
+					syncCtx.getApplicableShadow(), syncCtx.getSituation(), task.getChannel(), false);
+			if (StringUtils.isNotBlank(syncCtx.getObjectSynchronization().getIntent())) {
+				modifications.add(PropertyDelta.createModificationReplaceProperty(ShadowType.F_INTENT,
+						syncCtx.getApplicableShadow().getDefinition(), syncCtx.getObjectSynchronization().getIntent()));
 			}
+			executeShadowModifications(syncCtx.getApplicableShadow(), modifications, task, subResult);
+			subResult.recordSuccess();
+			eventInfo.record(task);
+			LOGGER.debug("SYNCHRONIZATION: DONE (dry run/unrelated) for {}", syncCtx.getApplicableShadow());
+			return false;
 		}
-		return null;
+		return true;
 	}
-
-	private boolean isPolicyApplicable(PrismObject<? extends ShadowType> currentShadow,
-			ObjectSynchronizationType synchronizationPolicy, PrismObject<ResourceType> resource,
-			PrismObject<SystemConfigurationType> configuration, Task task, OperationResult result)
-					throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
-
-		if (!SynchronizationUtils.isPolicyApplicable(currentShadow, synchronizationPolicy, resource)) {
-			return false;
+	
+	private List<PropertyDelta<?>> createShadowIntentAndSynchronizationTimestampDelta(PrismObject<ShadowType> currentShadow,
+			String intent) {
+		List<PropertyDelta<?>> modifications = SynchronizationUtils.createSynchronizationTimestampsDelta(currentShadow);
+		if (StringUtils.isNotBlank(intent)) {
+			PropertyDelta<String> intentDelta = PropertyDelta.createModificationReplaceProperty(ShadowType.F_INTENT,
+					currentShadow.getDefinition(), intent);
+			modifications.add(intentDelta);
 		}
-
-		Boolean conditionResult = evaluateSynchronizationPolicyCondition(synchronizationPolicy, currentShadow,
-				resource, configuration, task, result);
-		return conditionResult != null ? conditionResult : true;
+		return modifications;
 	}
 
-	private Boolean evaluateSynchronizationPolicyCondition(ObjectSynchronizationType synchronizationPolicy,
-			PrismObject<? extends ShadowType> currentShadow, PrismObject<ResourceType> resource,
-			PrismObject<SystemConfigurationType> configuration, Task task, OperationResult result)
-					throws SchemaException, ExpressionEvaluationException, ObjectNotFoundException, CommunicationException, ConfigurationException, SecurityViolationException {
-		if (synchronizationPolicy.getCondition() == null) {
-			return null;
-		}
-		ExpressionType conditionExpressionType = synchronizationPolicy.getCondition();
-		String desc = "condition in object synchronization " + synchronizationPolicy.getName();
-		ExpressionVariables variables = Utils.getDefaultExpressionVariables(null, currentShadow, null,
-				resource, configuration, null);
+	private void executeShadowModifications(PrismObject<? extends ShadowType> object, List<PropertyDelta<?>> modifications,
+			Task task, OperationResult subResult) {
 		try {
-			ModelExpressionThreadLocalHolder.pushExpressionEnvironment(new ExpressionEnvironment<>(task, result));
-			PrismPropertyValue<Boolean> evaluateCondition = ExpressionUtil.evaluateCondition(variables,
-					conditionExpressionType, expressionFactory, desc, task, result);
-			return evaluateCondition.getValue();
+			repositoryService.modifyObject(ShadowType.class, object.getOid(), modifications, subResult);
+			task.recordObjectActionExecuted(object, ChangeType.MODIFY, null);
+		} catch (Throwable t) {
+			task.recordObjectActionExecuted(object, ChangeType.MODIFY, t);
 		} finally {
-			ModelExpressionThreadLocalHolder.popExpressionEnvironment();
+			task.markObjectActionExecutedBoundary();
 		}
 	}
 
+	
+	private <F extends FocusType> boolean alreadyLinked(F focus, PrismObject<ShadowType> shadow) {
+		return focus.getLinkRef().stream().anyMatch(link -> link.getOid().equals(shadow.getOid()));
+	}
+
 	private boolean isLogDebug(ResourceObjectShadowChangeDescription change) {
 		// Reconciliation changes are routine. Do not let it polute the
 		// logfiles.
@@ -484,14 +585,7 @@ private void validate(ResourceObjectShadowChangeDescription change) {
 	// TODO TODO TODO TODO
 	// }
 
-	private boolean isSynchronizationEnabled(ObjectSynchronizationType synchronization) {
-		if (synchronization == null || synchronization.isEnabled() == null) {
-			return false;
-		}
-		return synchronization.isEnabled();
-	}
-
-	/**
+		/**
 	 * XXX: in situation when one account belongs to two different idm users
 	 * (repository returns only first user, method
 	 * {@link com.evolveum.midpoint.model.api.ModelService#findShadowOwner(String, Task, OperationResult)}
@@ -499,23 +593,47 @@ private boolean isSynchronizationEnabled(ObjectSynchronizationType synchronizati
 	 * should be changed because otherwise we can't find
 	 * {@link SynchronizationSituationType#DISPUTED} situation
 	 */
-	private <F extends FocusType> SynchronizationSituation determineSituation(Class<F> focusType,
-			ResourceObjectShadowChangeDescription change, ObjectSynchronizationType synchronizationPolicy,
-			SystemConfigurationType configurationType, Task task, OperationResult result) {
+	private <F extends FocusType> void setupSituation(SynchronizationContext<F> syncCtx,
+			SynchronizationEventInformation eventInfo, ResourceObjectShadowChangeDescription change, Task task, OperationResult result) {
 
 		OperationResult subResult = result.createSubresult(CHECK_SITUATION);
 		LOGGER.trace("Determining situation for resource object shadow.");
 
-		SynchronizationSituation situation;
 		try {
 			String shadowOid = getOidFromChange(change);
 			Validate.notEmpty(shadowOid, "Couldn't get resource object shadow oid from change.");
-			PrismObject<F> owner = repositoryService.searchShadowOwner(shadowOid,
-					SelectorOptions.createCollection(GetOperationOptions.createAllowNotFound()), subResult);
-
-			if (owner != null) {
-				F ownerType = owner.asObjectable();
-				LOGGER.trace("Shadow OID {} does have owner: {}", shadowOid, ownerType.getName());
+			
+			F currentOwnerType = syncCtx.getCurrentOwner();
+			if (currentOwnerType == null) {
+
+				PrismObject<F> currrentOwner = repositoryService.searchShadowOwner(shadowOid,
+						SelectorOptions.createCollection(GetOperationOptions.createAllowNotFound()), subResult);
+				if (currrentOwner != null) {
+					currentOwnerType = currrentOwner.asObjectable();					
+				}
+			}
+			
+			F correlatedOwner = syncCtx.getCorrelatedOwner();
+			if (!isCorrelatedOwnerSameAsCurrentOwner(correlatedOwner, currentOwnerType)) {
+				LOGGER.error("Cannot synchronize {}, current owner and expected owner are not the same. Current owner: {}, expected owner: {}", syncCtx.getApplicableShadow(), currentOwnerType, correlatedOwner);
+				String msg= "Cannot synchronize " + syncCtx.getApplicableShadow()
+				+ ", current owner and expected owner are not the same. Current owner: " + currentOwnerType
+				+ ", expected owner: " + correlatedOwner;
+				result.recordFatalError(msg);
+				throw new ConfigurationException(msg);
+			}
+			
+			
+			if (currentOwnerType != null) {
+				
+				LOGGER.trace("Shadow OID {} does have owner: {}", shadowOid, currentOwnerType.getName());
+				
+				syncCtx.setCurrentOwner(currentOwnerType);
+				
+				if (syncCtx.getSituation() != null) {
+					return;
+				}
+				
 				SynchronizationSituationType state = null;
 				switch (getModificationType(change)) {
 					case ADD:
@@ -527,11 +645,10 @@ private <F extends FocusType> SynchronizationSituation determineSituation(Class<
 					case DELETE:
 						state = SynchronizationSituationType.DELETED;
 				}
-				situation = new SynchronizationSituation<>(ownerType, null, state);
+				syncCtx.setSituation(state);
 			} else {
 				LOGGER.trace("Resource object shadow doesn't have owner.");
-				situation = determineSituationWithCorrelation(focusType, change, synchronizationPolicy, owner,
-						configurationType, task, result);
+				determineSituationWithCorrelation(syncCtx, change, task, result);
 			}
 		} catch (Exception ex) {
 			LOGGER.error("Error occurred during resource object shadow owner lookup.");
@@ -540,9 +657,31 @@ private <F extends FocusType> SynchronizationSituation determineSituation(Class<
 					ex);
 		} finally {
 			subResult.computeStatus();
+			if (isLogDebug(change)) {
+				LOGGER.debug("SYNCHRONIZATION: SITUATION: '{}', currentOwner={}, correlatedOwner={}",
+						syncCtx.getSituation().value(), syncCtx.getCurrentOwner(),
+						syncCtx.getCorrelatedOwner());
+			} else {
+				LOGGER.trace("SYNCHRONIZATION: SITUATION: '{}', currentOwner={}, correlatedOwner={}",
+						syncCtx.getSituation().value(), syncCtx.getCurrentOwner(),
+						syncCtx.getCorrelatedOwner());
+			}
+			eventInfo.setOriginalSituation(syncCtx.getSituation());
+			eventInfo.setNewSituation(syncCtx.getSituation()); // overwritten later (TODO fix this!)
+
 		}
+	}
 
-		return situation;
+	private <F extends FocusType> boolean isCorrelatedOwnerSameAsCurrentOwner(F expectedOwner, F currentOwnerType) {
+		if (expectedOwner == null) {
+			return true;
+		}
+		
+		if (currentOwnerType == null) {
+			return true;
+		}
+		
+		return (expectedOwner.getOid().equals(currentOwnerType.getOid()));
 	}
 
 	private String getOidFromChange(ResourceObjectShadowChangeDescription change) {
@@ -560,7 +699,7 @@ private String getOidFromChange(ResourceObjectShadowChangeDescription change) {
 
 		return change.getObjectDelta().getOid();
 	}
-
+	
 	/**
 	 * Tries to match specified focus and shadow. Return true if it matches,
 	 * false otherwise.
@@ -571,13 +710,14 @@ public <F extends FocusType> boolean matchUserCorrelationRule(PrismObject<Shadow
 			PrismObject<SystemConfigurationType> configuration, Task task, OperationResult result)
 					throws ConfigurationException, SchemaException, ObjectNotFoundException,
 					ExpressionEvaluationException, CommunicationException, SecurityViolationException {
-		ObjectSynchronizationType synchronizationPolicy = determineSynchronizationPolicy(resourceType, shadow,
-				configuration, task, result);
+		
+		SynchronizationContext<F> synchronizationContext = loadSynchronizationContext(shadow, shadow, resourceType.asPrismObject(), task.getChannel(), configuration, task, result);
 		Class<F> focusClass;
 		// TODO is this correct? The problem is that synchronizationPolicy can
 		// be null...
+		ObjectSynchronizationType synchronizationPolicy = synchronizationContext.getObjectSynchronization();
 		if (synchronizationPolicy != null) {
-			focusClass = determineFocusClass(synchronizationPolicy, resourceType);
+			focusClass = synchronizationContext.getFocusClass();
 		} else {
 			//noinspection unchecked
 			focusClass = (Class<F>) focus.asObjectable().getClass();
@@ -595,21 +735,32 @@ public <F extends FocusType> boolean matchUserCorrelationRule(PrismObject<Shadow
 	 * data. Therefore let's apply the changes before running
 	 * correlation/confirmation
 	 */
-	private <F extends FocusType> SynchronizationSituation determineSituationWithCorrelation(
-			Class<F> focusType, ResourceObjectShadowChangeDescription change,
-			ObjectSynchronizationType synchronizationPolicy, PrismObject<F> owner,
-			SystemConfigurationType configurationType, Task task, OperationResult result)
+	private <F extends FocusType> void determineSituationWithCorrelation(SynchronizationContext<F> syncCtx, ResourceObjectShadowChangeDescription change,
+			Task task, OperationResult result)
 					throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
 
 		if (ChangeType.DELETE.equals(getModificationType(change))) {
 			// account was deleted and we know it didn't have owner
-			return new SynchronizationSituation<>(owner == null ? null : owner.asObjectable(), null,
-					SynchronizationSituationType.DELETED);
+			if (syncCtx.getSituation() == null) {
+				syncCtx.setSituation(SynchronizationSituationType.DELETED);
+			}
+			return;
 		}
 
+		F user = syncCtx.getCorrelatedOwner();
+		LOGGER.trace("Correlated owner present in synchronization context: {}", user);
+		if (user != null) {
+			if (syncCtx.getSituation() != null) {
+				return;
+			}
+			syncCtx.setSituation(getSynchornizationSituationFromChange(change));
+			return;
+		}
+		
+		
 		PrismObject<? extends ShadowType> resourceShadow = change.getCurrentShadow();
 
-		ObjectDelta syncDelta = change.getObjectDelta();
+		ObjectDelta<ShadowType> syncDelta = change.getObjectDelta();
 		if (resourceShadow == null && syncDelta != null && ChangeType.ADD.equals(syncDelta.getChangeType())) {
 			LOGGER.trace("Trying to compute current shadow from change delta add.");
 			PrismObject<ShadowType> shadow = syncDelta.computeChangedObject(syncDelta.getObjectToAdd());
@@ -622,12 +773,12 @@ private <F extends FocusType> SynchronizationSituation determineSituationWithCor
 		validateResourceInShadow(resourceShadow.asObjectable(), resource);
 
 		SynchronizationSituationType state = null;
-		LOGGER.trace(
-				"SYNCHRONIZATION: CORRELATION: Looking for list of {} objects based on correlation rule.",
-				focusType.getSimpleName());
-		List<PrismObject<F>> users = correlationConfirmationEvaluator.findFocusesByCorrelationRule(focusType,
+		ObjectSynchronizationType synchronizationPolicy = syncCtx.getObjectSynchronization();
+		LOGGER.trace("SYNCHRONIZATION: CORRELATION: Looking for list of {} objects based on correlation rule.",
+				syncCtx.getFocusClass().getSimpleName());
+		List<PrismObject<F>> users = correlationConfirmationEvaluator.findFocusesByCorrelationRule(syncCtx.getFocusClass(),
 				resourceShadow.asObjectable(), synchronizationPolicy.getCorrelation(), resource,
-				configurationType, task, result);
+				syncCtx.getSystemConfiguration().asObjectable(), task, result);
 		if (users == null) {
 			users = new ArrayList<>();
 		}
@@ -636,29 +787,19 @@ private <F extends FocusType> SynchronizationSituation determineSituationWithCor
 			if (synchronizationPolicy.getConfirmation() == null) {
 				LOGGER.trace("SYNCHRONIZATION: CONFIRMATION: no confirmation defined.");
 			} else {
-				LOGGER.debug(
-						"SYNCHRONIZATION: CONFIRMATION: Checking objects from correlation with confirmation rule.");
-				users = correlationConfirmationEvaluator.findUserByConfirmationRule(focusType, users,
-						resourceShadow.asObjectable(), resource, configurationType,
+				LOGGER.debug("SYNCHRONIZATION: CONFIRMATION: Checking objects from correlation with confirmation rule.");
+				users = correlationConfirmationEvaluator.findUserByConfirmationRule(syncCtx.getFocusClass(), users,
+						resourceShadow.asObjectable(), resource, syncCtx.getSystemConfiguration().asObjectable(),
 						synchronizationPolicy.getConfirmation(), task, result);
 			}
 		}
 
-		F user = null;
 		switch (users.size()) {
 			case 0:
 				state = SynchronizationSituationType.UNMATCHED;
 				break;
 			case 1:
-				switch (getModificationType(change)) {
-					case ADD:
-					case MODIFY:
-						state = SynchronizationSituationType.UNLINKED;
-						break;
-					case DELETE:
-						state = SynchronizationSituationType.DELETED;
-						break;
-				}
+				state = getSynchornizationSituationFromChange(change);
 
 				user = users.get(0).asObjectable();
 				break;
@@ -666,7 +807,20 @@ private <F extends FocusType> SynchronizationSituation determineSituationWithCor
 				state = SynchronizationSituationType.DISPUTED;
 		}
 
-		return new SynchronizationSituation<>(null, user, state);
+		syncCtx.setCorrelatedOwner(user);
+		syncCtx.setSituation(state);
+	}
+	
+	private SynchronizationSituationType getSynchornizationSituationFromChange(ResourceObjectShadowChangeDescription change) {
+		switch (getModificationType(change)) {
+			case ADD:
+			case MODIFY:
+				return SynchronizationSituationType.UNLINKED;
+			case DELETE:
+				return SynchronizationSituationType.DELETED;
+		}
+		
+		return null;
 	}
 
 	private void validateResourceInShadow(ShadowType shadow, ResourceType resource) {
@@ -694,20 +848,18 @@ private ChangeType getModificationType(ResourceObjectShadowChangeDescription cha
 		return ChangeType.ADD;
 	}
 
-	private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F> focusClass,
-			ResourceObjectShadowChangeDescription change, ObjectSynchronizationType synchronizationPolicy,
-			SynchronizationSituation<F> situation, ResourceType resource, boolean logDebug,
-			PrismObject<SystemConfigurationType> configuration, Task task, OperationResult parentResult)
+	private <F extends FocusType> SynchronizationSituationType reactToChange(SynchronizationContext<F> syncCtx,
+			ResourceObjectShadowChangeDescription change, boolean logDebug,
+			Task task, OperationResult parentResult)
 					throws ConfigurationException, ObjectNotFoundException, SchemaException,
 					PolicyViolationException, ExpressionEvaluationException, ObjectAlreadyExistsException,
 					CommunicationException, SecurityViolationException {
 
-		SynchronizationSituationType newSituation = situation.getSituation();
+		SynchronizationSituationType newSituation = syncCtx.getSituation();
 
-		SynchronizationReactionType reactionDefinition = findReactionDefinition(synchronizationPolicy,
-				situation, change.getSourceChannel(), resource);
-		if (reactionDefinition == null) {
-			LOGGER.trace("No reaction is defined for situation {} in {}", situation.getSituation(), resource);
+		findReactionDefinition(syncCtx);
+		if (syncCtx.getReaction() == null) {
+			LOGGER.trace("No reaction is defined for situation {} in {}", syncCtx.getSituation(), syncCtx.getResource());
 			return newSituation;
 		}
 
@@ -719,7 +871,7 @@ private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F
 		// shadow = change.getOldShadow();
 		// }
 
-		Boolean doReconciliation = determineReconciliation(synchronizationPolicy, reactionDefinition);
+		Boolean doReconciliation = determineReconciliation(syncCtx.getObjectSynchronization(), syncCtx.getReaction());
 		if (doReconciliation == null) {
 			// We have to do reconciliation if we have got a full shadow and no
 			// delta.
@@ -730,17 +882,16 @@ private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F
 			}
 		}
 
-		Boolean limitPropagation = determinePropagationLimitation(synchronizationPolicy, reactionDefinition,
-				change.getSourceChannel());
+		Boolean limitPropagation = determinePropagationLimitation(syncCtx.getObjectSynchronization(), syncCtx.getReaction(),
+				syncCtx.getChanel());
 		ModelExecuteOptions options = new ModelExecuteOptions();
 		options.setReconcile(doReconciliation);
 		options.setLimitPropagation(limitPropagation);
 
-		final boolean willSynchronize = isSynchronize(reactionDefinition);
+		final boolean willSynchronize = isSynchronize(syncCtx.getReaction());
 		LensContext<F> lensContext = null;
 		if (willSynchronize) {
-			lensContext = createLensContext(focusClass, change, reactionDefinition, synchronizationPolicy,
-					situation, options, configuration, parentResult);
+			lensContext = createLensContext(syncCtx, change, syncCtx.getReaction(), options, parentResult);
 		}
 
 		if (LOGGER.isTraceEnabled() && lensContext != null) {
@@ -752,8 +903,7 @@ private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F
 
 			// there's no point in calling executeAction without context - so
 			// the actions are executed only if synchronize == true
-			executeActions(reactionDefinition, lensContext, situation, BeforeAfterType.BEFORE, resource,
-					logDebug, task, parentResult);
+			executeActions(syncCtx, lensContext, BeforeAfterType.BEFORE, logDebug, task, parentResult);
 
 			Iterator<LensProjectionContext> iterator = lensContext.getProjectionContextsIterator();
 			LensProjectionContext originalProjectionContext = iterator.hasNext() ? iterator.next() : null;
@@ -766,7 +916,7 @@ private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F
 					PolicyViolationException | ExpressionEvaluationException | ObjectAlreadyExistsException |
 					CommunicationException | SecurityViolationException | PreconditionViolationException e) {
 				LOGGER.error("SYNCHRONIZATION: Error in synchronization on {} for situation {}: {}: {}. Change was {}",
-						resource, situation.getSituation(), e.getClass().getSimpleName(), e.getMessage(), change, e);
+						syncCtx.getResource(), syncCtx.getSituation(), e.getClass().getSimpleName(), e.getMessage(), change, e);
 				// what to do here? We cannot throw the error back. All that the notifyChange method
 				// could do is to convert it to SystemException. But that indicates an internal error and it will
 				// break whatever code called the notifyChange in the first place. We do not want that.
@@ -778,7 +928,7 @@ private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F
 			// note: actions "AFTER" seem to be useless here (basically they
 			// modify lens context - which is relevant only if followed by
 			// clockwork run)
-			executeActions(reactionDefinition, lensContext, situation, BeforeAfterType.AFTER, resource,
+			executeActions(syncCtx, lensContext, BeforeAfterType.AFTER,
 					logDebug, task, parentResult);
 
 			if (originalProjectionContext != null) {
@@ -787,7 +937,7 @@ private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F
 
 		} else {
 			LOGGER.trace("Skipping clockwork run on {} for situation {}, synchronize is set to false.",
-					new Object[] { resource, situation.getSituation() });
+					new Object[] { syncCtx.getResource(), syncCtx.getSituation() });
 		}
 
 		return newSituation;
@@ -831,15 +981,14 @@ private Boolean determinePropagationLimitation(ObjectSynchronizationType synchro
 	}
 
 	@NotNull
-	private <F extends FocusType> LensContext<F> createLensContext(Class<F> focusClass,
+	private <F extends FocusType> LensContext<F> createLensContext(SynchronizationContext<F> syncCtx, 
 			ResourceObjectShadowChangeDescription change, SynchronizationReactionType reactionDefinition,
-			ObjectSynchronizationType synchronizationPolicy, SynchronizationSituation<F> situation,
-			ModelExecuteOptions options, PrismObject<SystemConfigurationType> configuration,
-			OperationResult parentResult) throws ObjectNotFoundException, SchemaException {
+			ModelExecuteOptions options, 
+			OperationResult parentResult) throws ObjectNotFoundException, SchemaException, ConfigurationException {
 
-		LensContext<F> context = contextFactory.createSyncContext(focusClass, change);
+		LensContext<F> context = contextFactory.createSyncContext(syncCtx.getFocusClass(), change);
 		context.setLazyAuditRequest(true);
-		context.setSystemConfiguration(configuration);
+		context.setSystemConfiguration(syncCtx.getSystemConfiguration());
 		context.setOptions(options);
 
 		ResourceType resource = change.getResource().asObjectable();
@@ -854,14 +1003,14 @@ private <F extends FocusType> LensContext<F> createLensContext(Class<F> focusCla
 
 		// Projection context
 
-		ShadowKindType kind = getKind(shadow, synchronizationPolicy);
-		String intent = getIntent(shadow, synchronizationPolicy);
+		ShadowKindType kind = getKind(shadow, syncCtx.getObjectSynchronization());
+		String intent = getIntent(shadow, syncCtx.getObjectSynchronization());
 		boolean thombstone = isThombstone(change);
 		ResourceShadowDiscriminator descr = new ResourceShadowDiscriminator(resource.getOid(), kind, intent, thombstone);
 		LensProjectionContext projectionContext = context.createProjectionContext(descr);
 		projectionContext.setResource(resource);
 		projectionContext.setOid(getOidFromChange(change));
-		projectionContext.setSynchronizationSituationDetected(situation.getSituation());
+		projectionContext.setSynchronizationSituationDetected(syncCtx.getSituation());
 
 		// insert object delta if available in change
 		ObjectDelta<? extends ShadowType> delta = change.getObjectDelta();
@@ -890,8 +1039,8 @@ private <F extends FocusType> LensContext<F> createLensContext(Class<F> focusCla
 		projectionContext.setDoReconciliation(ModelExecuteOptions.isReconcile(options));
 
 		// Focus context
-		if (situation.getCurrentOwner() != null) {
-			F focusType = situation.getCurrentOwner();
+		if (syncCtx.getCurrentOwner() != null) {
+			F focusType = syncCtx.getCurrentOwner();
 			LensFocusContext<F> focusContext = context.createFocusContext();
 			PrismObject<F> focusOld = (PrismObject<F>) focusType.asPrismObject();
 			focusContext.setLoadedObject(focusOld);
@@ -901,8 +1050,8 @@ private <F extends FocusType> LensContext<F> createLensContext(Class<F> focusCla
 		ObjectReferenceType objectTemplateRef = null;
 		if (reactionDefinition.getObjectTemplateRef() != null) {
 			objectTemplateRef = reactionDefinition.getObjectTemplateRef();
-		} else if (synchronizationPolicy.getObjectTemplateRef() != null) {
-			objectTemplateRef = synchronizationPolicy.getObjectTemplateRef();
+		} else if (syncCtx.getObjectSynchronization().getObjectTemplateRef() != null) {
+			objectTemplateRef = syncCtx.getObjectSynchronization().getObjectTemplateRef();
 		}
 		if (objectTemplateRef != null) {
 			ObjectTemplateType objectTemplate = repositoryService
@@ -968,24 +1117,23 @@ private boolean isSynchronize(SynchronizationReactionType reactionDefinition) {
 		return !reactionDefinition.getAction().isEmpty();
 	}
 
-	private SynchronizationReactionType findReactionDefinition(
-			ObjectSynchronizationType synchronizationPolicy, SynchronizationSituation situation,
-			String channel, ResourceType resource) throws ConfigurationException {
+	private <F extends FocusType> void findReactionDefinition(SynchronizationContext<F> syncCtx) throws ConfigurationException {
 		SynchronizationReactionType defaultReaction = null;
-		for (SynchronizationReactionType reaction : synchronizationPolicy.getReaction()) {
+		for (SynchronizationReactionType reaction : syncCtx.getObjectSynchronization().getReaction()) {
 			SynchronizationSituationType reactionSituation = reaction.getSituation();
 			if (reactionSituation == null) {
-				throw new ConfigurationException("No situation defined for a reaction in " + resource);
+				throw new ConfigurationException("No situation defined for a reaction in " + syncCtx.getResource());
 			}
-			if (reactionSituation.equals(situation.getSituation())) {
+			if (reactionSituation.equals(syncCtx.getSituation())) {
 				if (reaction.getChannel() != null && !reaction.getChannel().isEmpty()) {
 					if (reaction.getChannel().contains("") || reaction.getChannel().contains(null)) {
 						defaultReaction = reaction;
 					}
-					if (reaction.getChannel().contains(channel)) {
-						return reaction;
+					if (reaction.getChannel().contains(syncCtx.getChanel())) {
+						syncCtx.setReaction(reaction);
+						return;
 					} else {
-						LOGGER.trace("Skipping reaction {} because the channel does not match {}", reaction, channel);
+						LOGGER.trace("Skipping reaction {} because the channel does not match {}", reaction, syncCtx.getChanel());
 						continue;
 					}
 				} else {
@@ -994,15 +1142,15 @@ private SynchronizationReactionType findReactionDefinition(
 			}
 		}
 		LOGGER.trace("Using default reaction {}", defaultReaction);
-		return defaultReaction;
+		syncCtx.setReaction(defaultReaction);
 	}
 
 	/**
 	 * Saves situation, timestamps, kind and intent (if needed)
 	 */
-	private PrismObject<ShadowType> saveSyncMetadata(PrismObject<ShadowType> shadow,
-			SynchronizationSituation situation, ResourceObjectShadowChangeDescription change,
-			ObjectSynchronizationType synchronizationPolicy, Task task, OperationResult parentResult) {
+	private <F extends FocusType> PrismObject<ShadowType> saveSyncMetadata(SynchronizationContext<F> syncCtx, ResourceObjectShadowChangeDescription change,
+			Task task, OperationResult parentResult) {
+		PrismObject<ShadowType> shadow = syncCtx.getCurrentShadow();
 		if (shadow == null) {
 			return null;
 		}
@@ -1010,11 +1158,11 @@ private PrismObject<ShadowType> saveSyncMetadata(PrismObject<ShadowType> shadow,
 		ShadowType shadowType = shadow.asObjectable();
 		// new situation description
 		List<PropertyDelta<?>> deltas = SynchronizationUtils
-				.createSynchronizationSituationAndDescriptionDelta(shadow, situation.getSituation(),
+				.createSynchronizationSituationAndDescriptionDelta(shadow, syncCtx.getSituation(),
 						change.getSourceChannel(), true);
 
 		if (shadowType.getKind() == null) {
-			ShadowKindType kind = synchronizationPolicy.getKind();
+			ShadowKindType kind = syncCtx.getObjectSynchronization().getKind();
 			if (kind == null) {
 				kind = ShadowKindType.ACCOUNT;
 			}
@@ -1024,7 +1172,7 @@ private PrismObject<ShadowType> saveSyncMetadata(PrismObject<ShadowType> shadow,
 		}
 
 		if (shadowType.getIntent() == null) {
-			String intent = synchronizationPolicy.getIntent();
+			String intent = syncCtx.getObjectSynchronization().getIntent();
 			if (intent == null) {
 				intent = SchemaConstants.INTENT_DEFAULT;
 			}
@@ -1065,12 +1213,12 @@ private PrismObject<ShadowType> saveSyncMetadata(PrismObject<ShadowType> shadow,
 		return null;
 	}
 
-	private <F extends FocusType> void executeActions(SynchronizationReactionType reactionDef,
-			LensContext<F> context, SynchronizationSituation<F> situation, BeforeAfterType order,
-			ResourceType resource, boolean logDebug, Task task, OperationResult parentResult)
+	private <F extends FocusType> void executeActions(SynchronizationContext<F> syncCtx,
+			LensContext<F> context, BeforeAfterType order,
+			boolean logDebug, Task task, OperationResult parentResult)
 					throws ConfigurationException, SchemaException {
 
-		for (SynchronizationActionType actionDef : reactionDef.getAction()) {
+		for (SynchronizationActionType actionDef : syncCtx.getReaction().getAction()) {
 			if ((actionDef.getOrder() == null && order == BeforeAfterType.BEFORE)
 					|| (actionDef.getOrder() != null && actionDef.getOrder() == order)) {
 
@@ -1079,15 +1227,15 @@ private <F extends FocusType> void executeActions(SynchronizationReactionType re
 					handlerUri = actionDef.getRef();
 				}
 				if (handlerUri == null) {
-					LOGGER.error("Action definition in resource {} doesn't contain handler URI", resource);
+					LOGGER.error("Action definition in resource {} doesn't contain handler URI", syncCtx.getResource());
 					throw new ConfigurationException(
-							"Action definition in resource " + resource + " doesn't contain handler URI");
+							"Action definition in resource " + syncCtx.getResource() + " doesn't contain handler URI");
 				}
 
 				Action action = actionManager.getActionInstance(handlerUri);
 				if (action == null) {
 					LOGGER.warn("Couldn't create action with uri '{}' in resource {}, skipping action.",
-							new Object[] { handlerUri, resource });
+							new Object[] { handlerUri, syncCtx.getResource() });
 					continue;
 				}
 
@@ -1104,7 +1252,7 @@ private <F extends FocusType> void executeActions(SynchronizationReactionType re
 				} else {
 					LOGGER.trace("SYNCHRONIZATION: ACTION: Executing: {}.", action.getClass());
 				}
-
+				SynchronizationSituation<F> situation = new SynchronizationSituation<F>(syncCtx.getCurrentOwner(), syncCtx.getCorrelatedOwner(), syncCtx.getSituation());
 				action.handle(context, situation, parameters, task, parentResult);
 			}
 		}
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/AbstractConfiguredModelIntegrationTest.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/AbstractConfiguredModelIntegrationTest.java
index 8471cf1e39e..52b521b9824 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/AbstractConfiguredModelIntegrationTest.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/AbstractConfiguredModelIntegrationTest.java
@@ -494,6 +494,7 @@ public class AbstractConfiguredModelIntegrationTest extends AbstractModelIntegra
 	protected static final QName PIRACY_MARK = new QName(NS_PIRACY, "mark");
 	protected static final QName PIRACY_KEY = new QName(NS_PIRACY, "key");
 	protected static final QName PIRACY_BINARY_ID = new QName(NS_PIRACY, "binaryId");
+	protected static final QName RELATION_PIRACY_CAPTAIN = new QName(NS_PIRACY, "captain");
 
     protected static final ItemPath ROLE_EXTENSION_COST_CENTER_PATH = new ItemPath(RoleType.F_EXTENSION, new QName(NS_PIRACY, "costCenter"));
 
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestMisc.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestMisc.java
index 63874d90a0f..5c443ee64b5 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestMisc.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestMisc.java
@@ -41,11 +41,13 @@
 import com.evolveum.midpoint.schema.GetOperationOptions;
 import com.evolveum.midpoint.schema.RepositoryDiag;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.task.api.Task;
 import com.evolveum.midpoint.test.DummyResourceContoller;
 import com.evolveum.midpoint.test.util.TestUtil;
 import com.evolveum.midpoint.util.DOMUtil;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RelationDefinitionType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
 
@@ -267,6 +269,29 @@ public void test312UpdateBinaryIdClean() throws Exception {
         PrismAsserts.assertPropertyValue(userAfter, getExtensionPath(PIRACY_BINARY_ID), KEY);
 	}
 	
+	/**
+     * MID-4660, MID-4491, MID-3581
+     */
+    @Test
+    public void test320DefaultRelations() throws Exception {
+		final String TEST_NAME="test320DefaultRelations";
+        displayTestTitle(TEST_NAME);
+        
+        Task task = createTask(TEST_NAME);
+        OperationResult result = task.getResult();
+        
+        // WHEN
+        displayWhen(TEST_NAME);
+        List<RelationDefinitionType> relations = modelInteractionService.getRelationDefinitions(result);
+        
+        // THEN
+ 		displayThen(TEST_NAME);
+ 		display("Relations", relations);
+        assertRelationDef(relations, SchemaConstants.ORG_MANAGER, "RelationTypes.Manager");
+        assertRelationDef(relations, SchemaConstants.ORG_OWNER, "RelationTypes.Owner");
+        assertEquals("Unexpected number of relation definitions", 7, relations.size());
+    }
+	
 	/**
 	 * MID-3879
 	 */
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/gensync/TestEditSchema.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/gensync/TestEditSchema.java
index c18a782f393..4fb63f25ecc 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/gensync/TestEditSchema.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/gensync/TestEditSchema.java
@@ -22,6 +22,7 @@
 
 import java.io.File;
 import java.util.Collection;
+import java.util.List;
 
 import javax.xml.namespace.QName;
 
@@ -57,8 +58,10 @@
 import com.evolveum.midpoint.schema.RetrieveOption;
 import com.evolveum.midpoint.schema.SearchResultList;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.schema.util.MiscSchemaUtil;
+import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
 import com.evolveum.midpoint.task.api.Task;
 import com.evolveum.midpoint.test.IntegrationTestTools;
 import com.evolveum.midpoint.test.util.TestUtil;
@@ -80,6 +83,7 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.LookupTableType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.PasswordType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RelationDefinitionType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowKindType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowType;
@@ -111,18 +115,18 @@ public void initSystem(Task initTask, OperationResult initResult) throws Excepti
     @Test
     public void test100LookupLanguagesGet() throws Exception {
 		final String TEST_NAME="test100LookupLanguagesGet";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -139,21 +143,21 @@ public void test100LookupLanguagesGet() throws Exception {
     @Test
     public void test102LookupLanguagesGetExclude() throws Exception {
 		final String TEST_NAME="test102LookupLanguagesGetExclude";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(LookupTableType.F_ROW,
     			GetOperationOptions.createRetrieve(RetrieveOption.EXCLUDE));
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -170,18 +174,18 @@ public void test102LookupLanguagesGetExclude() throws Exception {
     @Test
     public void test110LookupLanguagesGetAll() throws Exception {
 		final String TEST_NAME="test110LookupLanguagesGetAll";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		PrismObject<LookupTableType> lookup = getLookupTableAll(LOOKUP_LANGUAGES_OID, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[]{"en_US", "en", "English (US)"},
@@ -193,14 +197,14 @@ public void test110LookupLanguagesGetAll() throws Exception {
     @Test
     public void test120LookupLanguagesGetByKeyExact() throws Exception {
         final String TEST_NAME="test120LookupLanguagesGetByKeyExact";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         RelationalValueSearchQuery query = new RelationalValueSearchQuery(LookupTableRowType.F_KEY, "sk_SK", RelationalValueSearchType.EXACT);
         Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(LookupTableType.F_ROW,
@@ -208,7 +212,7 @@ public void test120LookupLanguagesGetByKeyExact() throws Exception {
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[] { "sk_SK", "sk", "Slovak" });
@@ -217,14 +221,14 @@ public void test120LookupLanguagesGetByKeyExact() throws Exception {
     @Test
     public void test121LookupLanguagesGetByKeyStartingWith() throws Exception {
         final String TEST_NAME="test121LookupLanguagesGetByKeyStartingWith";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         RelationalValueSearchQuery query = new RelationalValueSearchQuery(LookupTableRowType.F_KEY, "e", RelationalValueSearchType.STARTS_WITH);
         Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(LookupTableType.F_ROW,
@@ -232,7 +236,7 @@ public void test121LookupLanguagesGetByKeyStartingWith() throws Exception {
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[]{"en_US", "en", "English (US)"},
@@ -242,14 +246,14 @@ public void test121LookupLanguagesGetByKeyStartingWith() throws Exception {
     @Test
     public void test122LookupLanguagesGetByKeyContaining() throws Exception {
         final String TEST_NAME="test122LookupLanguagesGetByKeyContaining";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         RelationalValueSearchQuery query = new RelationalValueSearchQuery(LookupTableRowType.F_KEY, "r", RelationalValueSearchType.SUBSTRING);
         Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(LookupTableType.F_ROW,
@@ -257,7 +261,7 @@ public void test122LookupLanguagesGetByKeyContaining() throws Exception {
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[]{"tr_TR", "tr", "Turkish"});
@@ -266,14 +270,14 @@ public void test122LookupLanguagesGetByKeyContaining() throws Exception {
     @Test
     public void test123LookupLanguagesGetByKeyContainingWithPaging() throws Exception {
         final String TEST_NAME="test123LookupLanguagesGetByKeyContainingWithPaging";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         ObjectPaging paging = ObjectPaging.createPaging(2, 1, LookupTableRowType.F_KEY, OrderDirection.ASCENDING);
         RelationalValueSearchQuery query = new RelationalValueSearchQuery(LookupTableRowType.F_KEY, "_", RelationalValueSearchType.SUBSTRING, paging);
@@ -282,7 +286,7 @@ public void test123LookupLanguagesGetByKeyContainingWithPaging() throws Exceptio
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[] { "sk_SK", "sk", "Slovak" });
@@ -291,14 +295,14 @@ public void test123LookupLanguagesGetByKeyContainingWithPaging() throws Exceptio
     @Test
     public void test124LookupLanguagesGetByKeyContainingReturningNothing() throws Exception {
         final String TEST_NAME="test124LookupLanguagesGetByKeyContainingReturningNothing";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         RelationalValueSearchQuery query = new RelationalValueSearchQuery(LookupTableRowType.F_KEY, "xyz", RelationalValueSearchType.SUBSTRING);
         Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(LookupTableType.F_ROW,
@@ -306,7 +310,7 @@ public void test124LookupLanguagesGetByKeyContainingReturningNothing() throws Ex
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         IntegrationTestTools.display("Languages", lookup);
@@ -322,14 +326,14 @@ public void test124LookupLanguagesGetByKeyContainingReturningNothing() throws Ex
     @Test
     public void test130LookupLanguagesGetByValueExact() throws Exception {
         final String TEST_NAME="test130LookupLanguagesGetByValueExact";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         RelationalValueSearchQuery query = new RelationalValueSearchQuery(LookupTableRowType.F_VALUE, "sk", RelationalValueSearchType.EXACT);
         Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(LookupTableType.F_ROW,
@@ -337,7 +341,7 @@ public void test130LookupLanguagesGetByValueExact() throws Exception {
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[] { "sk_SK", "sk", "Slovak" });
@@ -350,14 +354,14 @@ public void test130LookupLanguagesGetByValueExact() throws Exception {
     @Test
     public void test131LookupLanguagesGetByLabelStartingWith() throws Exception {
         final String TEST_NAME="test131LookupLanguagesGetByLabelStartingWith";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         String fragment = "Eng";
         // TODO or fragment = new PolyStringType(new PolyString("Eng", "eng")) ?
@@ -367,7 +371,7 @@ public void test131LookupLanguagesGetByLabelStartingWith() throws Exception {
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[]{"en_US", "en", "English (US)"},
@@ -377,14 +381,14 @@ public void test131LookupLanguagesGetByLabelStartingWith() throws Exception {
     @Test
     public void test133LookupLanguagesGetByValueContainingWithPaging() throws Exception {
         final String TEST_NAME="test123LookupLanguagesGetByKeyContainingWithPaging";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         ObjectPaging paging = ObjectPaging.createPaging(0, 1, LookupTableRowType.F_LABEL, OrderDirection.DESCENDING); // using sorting key other than the one used in search
         RelationalValueSearchQuery query = new RelationalValueSearchQuery(LookupTableRowType.F_VALUE, "n", RelationalValueSearchType.SUBSTRING, paging);
@@ -393,7 +397,7 @@ public void test133LookupLanguagesGetByValueContainingWithPaging() throws Except
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[] { "en_US", "en", "English (US)" });
@@ -405,14 +409,14 @@ public void test133LookupLanguagesGetByValueContainingWithPaging() throws Except
     @Test(enabled = false)
     public void test140LookupLanguagesGetByIdExisting() throws Exception {
         final String TEST_NAME="test140LookupLanguagesGetByIdExisting";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 
         Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(
                 new ItemPath(
@@ -422,7 +426,7 @@ public void test140LookupLanguagesGetByIdExisting() throws Exception {
         PrismObject<LookupTableType> lookup = modelService.getObject(LookupTableType.class, LOOKUP_LANGUAGES_OID, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
         checkLookupResult(lookup, new String[] { "en_US", "en", "English (US)" });
@@ -448,10 +452,10 @@ private void checkLookupResult(PrismObject<LookupTableType> lookup, String[]...
     @Test
     public void test150LookupLanguagesAddRowFull() throws Exception {
 		final String TEST_NAME="test150LookupLanguagesAddRow";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -462,11 +466,11 @@ public void test150LookupLanguagesAddRowFull() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -496,10 +500,10 @@ public void test150LookupLanguagesAddRowFull() throws Exception {
     @Test
     public void test152LookupLanguagesAddRowKeyLabel() throws Exception {
 		final String TEST_NAME="test152LookupLanguagesAddRowKeyLabel";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -509,11 +513,11 @@ public void test152LookupLanguagesAddRowKeyLabel() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -544,10 +548,10 @@ public void test152LookupLanguagesAddRowKeyLabel() throws Exception {
     @Test
     public void test154LookupLanguagesAddRowKeyValue() throws Exception {
 		final String TEST_NAME="test154LookupLanguagesAddRowKeyValue";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -557,11 +561,11 @@ public void test154LookupLanguagesAddRowKeyValue() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -593,10 +597,10 @@ public void test154LookupLanguagesAddRowKeyValue() throws Exception {
     @Test
     public void test156LookupLanguagesAddRowExistingKey() throws Exception {
 		final String TEST_NAME="test156LookupLanguagesAddRowExistingKey";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -607,7 +611,7 @@ public void test156LookupLanguagesAddRowExistingKey() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         boolean exception = false;
         try {
             modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
@@ -617,11 +621,11 @@ public void test156LookupLanguagesAddRowExistingKey() throws Exception {
         AssertJUnit.assertFalse(exception);     // as per description in https://wiki.evolveum.com/display/midPoint/Development+with+LookupTable
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
-        task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        task = createTask(TEST_NAME);
         result = task.getResult();
 		PrismObject<LookupTableType> lookup = getLookupTableAll(LOOKUP_LANGUAGES_OID, task, result);
 
@@ -654,10 +658,10 @@ public void test156LookupLanguagesAddRowExistingKey() throws Exception {
     @Test
     public void test162LookupLanguagesDeleteRowFullNoId() throws Exception {
 		final String TEST_NAME="test162LookupLanguagesDeleteRowFullNoId";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -668,11 +672,11 @@ public void test162LookupLanguagesDeleteRowFullNoId() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -702,10 +706,10 @@ public void test162LookupLanguagesDeleteRowFullNoId() throws Exception {
     @Test
     public void test164LookupLanguagesDeleteRowFullId() throws Exception {
 		final String TEST_NAME="test164LookupLanguagesDeleteRowFullId";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -717,20 +721,18 @@ public void test164LookupLanguagesDeleteRowFullId() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
-		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
+        displayWhen(TEST_NAME);
+		executeChanges(delta, null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		displayThen(TEST_NAME);
+		assertSuccess(result);
 
 		PrismObject<LookupTableType> lookup = getLookupTableAll(LOOKUP_LANGUAGES_OID, task, result);
 
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		assertSuccess(result);
 
-		IntegrationTestTools.display("Languages", lookup);
+		display("Languages", lookup);
 
 		assertEquals("Wrong lang lookup name", LOOKUP_LANGUAGES_NAME, lookup.asObjectable().getName().getOrig());
 
@@ -750,10 +752,10 @@ public void test164LookupLanguagesDeleteRowFullId() throws Exception {
     @Test
     public void test166LookupLanguagesDeleteRowIdOnly() throws Exception {
 		final String TEST_NAME="test166LookupLanguagesDeleteRowIdOnly";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -762,20 +764,18 @@ public void test166LookupLanguagesDeleteRowIdOnly() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
-		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
+        displayWhen(TEST_NAME);
+		executeChanges(delta, null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		displayThen(TEST_NAME);
+		assertSuccess(result);
 
 		PrismObject<LookupTableType> lookup = getLookupTableAll(LOOKUP_LANGUAGES_OID, task, result);
 
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		assertSuccess(result);
 
-		IntegrationTestTools.display("Languages", lookup);
+		display("Languages", lookup);
 
 		assertEquals("Wrong lang lookup name", LOOKUP_LANGUAGES_NAME, lookup.asObjectable().getName().getOrig());
 
@@ -794,10 +794,10 @@ public void test166LookupLanguagesDeleteRowIdOnly() throws Exception {
     @Test
     public void test168LookupLanguagesDeleteRowByKey() throws Exception {
 		final String TEST_NAME="test168LookupLanguagesDeleteRowByKey";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row = new LookupTableRowType();
@@ -806,18 +806,16 @@ public void test168LookupLanguagesDeleteRowByKey() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		displayThen(TEST_NAME);
+		assertSuccess(result);
 
 		PrismObject<LookupTableType> lookup = getLookupTableAll(LOOKUP_LANGUAGES_OID, task, result);
 
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		assertSuccess(result);
 
 		IntegrationTestTools.display("Languages", lookup);
 
@@ -837,10 +835,10 @@ public void test168LookupLanguagesDeleteRowByKey() throws Exception {
     @Test
     public void test170LookupLanguagesReplaceRows() throws Exception {
 		final String TEST_NAME="test170LookupLanguagesReplaceRows";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         LookupTableRowType row1 = new LookupTableRowType();
@@ -862,11 +860,11 @@ public void test170LookupLanguagesReplaceRows() throws Exception {
         		LOOKUP_LANGUAGES_OID, LookupTableType.F_ROW, prismContext, row1, row2, row3);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		modelService.executeChanges(MiscSchemaUtil.createCollection(delta), null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -893,23 +891,23 @@ public void test170LookupLanguagesReplaceRows() throws Exception {
     @Test
     public void test180LookupLanguagesReplaceObject() throws Exception {
         final String TEST_NAME="test180LookupLanguagesReplaceObject";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         PrismObject<LookupTableType> replacement = PrismTestUtil.parseObject(LOOKUP_LANGUAGES_REPLACEMENT_FILE);
         ObjectDelta<LookupTableType> delta = ObjectDelta.createAddDelta(replacement);
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         ModelExecuteOptions options = ModelExecuteOptions.createOverwrite();
         options.setRaw(true);
         modelService.executeChanges(MiscSchemaUtil.createCollection(delta), options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
 
@@ -933,10 +931,10 @@ public void test180LookupLanguagesReplaceObject() throws Exception {
     @Test
     public void test182LookupLanguagesReimport() throws Exception {
         final String TEST_NAME="test182LookupLanguagesReimport";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         ImportOptionsType options = new ImportOptionsType();
@@ -944,11 +942,11 @@ public void test182LookupLanguagesReimport() throws Exception {
         options.setKeepOid(true);
 
         // WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		modelService.importObjectsFromFile(LOOKUP_LANGUAGES_FILE, options, task, result);
 
         // THEN
-        TestUtil.displayThen(TEST_NAME);
+        displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
 
@@ -996,21 +994,21 @@ private PrismObject<LookupTableType> getLookupTableAll(String oid, Task task, Op
     @Test
     public void test200EditSchemaUser() throws Exception {
 		final String TEST_NAME="test200EditSchemaUser";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         PrismObjectDefinition<UserType> userDef = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(UserType.class);
         PrismObject<UserType> user = userDef.instantiate();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObjectDefinition<UserType> editDef = getEditObjectDefinition(user);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 
 
 		PrismAsserts.assertEmphasized(editDef, UserType.F_NAME, true);
@@ -1073,18 +1071,18 @@ public void test200EditSchemaUser() throws Exception {
     @Test
     public void test210UserDefinition() throws Exception {
 		final String TEST_NAME="test210UserDefinition";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObject<UserType> user = modelService.getObject(UserType.class, USER_JACK_OID, null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -1119,23 +1117,15 @@ public void validate(PrismPropertyDefinition<String> propDef, String name) throw
 			}
 		});
 
-		assertContainer(user, UserType.F_CREDENTIALS, new Validator<PrismContainerDefinition<CredentialsType>>() {
-			@Override
-			public void validate(PrismContainerDefinition<CredentialsType> credentialsDef, String name)
-					throws Exception {
+		assertContainer(user, UserType.F_CREDENTIALS, (credentialsDef, name) -> {
 				assertNotNull("No definition for credentials in user", credentialsDef);
 				assertTrue("Credentials not readable", credentialsDef.canRead());
-			}
-
-		}, true);
+			}, true);
 
 		assertProperty(user, new ItemPath(UserType.F_CREDENTIALS, CredentialsType.F_PASSWORD, PasswordType.F_VALUE),
-			new Validator<PrismPropertyDefinition<String>>() {
-				@Override
-				public void validate(PrismPropertyDefinition<String> propDef, String name) throws Exception {
+			(propDef, name) -> {
 					assertTrue("Password not readable", propDef.canRead());
-				}
-			});
+				});
 
         assertSteadyResources();
     }
@@ -1147,7 +1137,7 @@ public void validate(PrismPropertyDefinition<String> propDef, String name) throw
     @Test
     public void test211SchemaRegistryUntouched() throws Exception {
 		final String TEST_NAME="test211SchemaRegistryUntouched";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         assertUntouchedUserDefinition();
         assertSteadyResources();
@@ -1159,20 +1149,20 @@ public void test211SchemaRegistryUntouched() throws Exception {
     @Test
     public void test213ModifiedUserJack() throws Exception {
 		final String TEST_NAME="test213ModifiedUserJack";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         modifyObjectReplaceProperty(UserType.class, USER_JACK_OID, UserType.F_PREFERRED_LANGUAGE, task, result, "en_PR");
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObject<UserType> user = modelService.getObject(UserType.class, USER_JACK_OID, null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -1233,21 +1223,21 @@ public void validate(PrismPropertyDefinition<String> propDef, String name) throw
 	@Test
     public void test250EditSchemaRole() throws Exception {
 		final String TEST_NAME="test250EditSchemaRole";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         PrismObjectDefinition<RoleType> roleDef = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(RoleType.class);
         PrismObject<RoleType> role = roleDef.instantiate();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObjectDefinition<RoleType> editDef = getEditObjectDefinition(role);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 
 		// TODO
 		PrismPropertyDefinition requestableDef = editDef.findPropertyDefinition(RoleType.F_REQUESTABLE);
@@ -1260,20 +1250,20 @@ public void test250EditSchemaRole() throws Exception {
     @Test
     public void test260EditShadowSchemaKindIntent() throws Exception {
 		final String TEST_NAME="test260EditShadowSchemaKindIntent";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         ResourceShadowDiscriminator discr = new ResourceShadowDiscriminator(RESOURCE_DUMMY_OID, ShadowKindType.ACCOUNT, null);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		PrismObjectDefinition<ShadowType> editDef = modelInteractionService.getEditShadowDefinition(discr, AuthorizationPhaseType.REQUEST, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
 
@@ -1293,21 +1283,21 @@ public void test260EditShadowSchemaKindIntent() throws Exception {
     @Test
     public void test261EditShadowSchemaObjectclass() throws Exception {
 		final String TEST_NAME="test261EditShadowSchemaObjectclass";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         ResourceShadowDiscriminator discr = new ResourceShadowDiscriminator(RESOURCE_DUMMY_OID, dummyResourceCtl.getAccountObjectClassQName());
         IntegrationTestTools.display("Discr", discr);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		PrismObjectDefinition<ShadowType> editDef = modelInteractionService.getEditShadowDefinition(discr, AuthorizationPhaseType.REQUEST, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
 
@@ -1327,21 +1317,21 @@ public void test261EditShadowSchemaObjectclass() throws Exception {
     @Test
     public void test263EditShadowSchemaEmpty() throws Exception {
 		final String TEST_NAME="test263EditShadowSchemaEmpty";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         ResourceShadowDiscriminator discr = new ResourceShadowDiscriminator(null, null);
         IntegrationTestTools.display("Discr", discr);
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		PrismObjectDefinition<ShadowType> editDef = modelInteractionService.getEditShadowDefinition(discr, AuthorizationPhaseType.REQUEST, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
 
@@ -1359,18 +1349,18 @@ public void test263EditShadowSchemaEmpty() throws Exception {
     @Test
     public void test265EditShadowSchemaNull() throws Exception {
 		final String TEST_NAME="test265EditShadowSchemaNull";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		PrismObjectDefinition<ShadowType> editDef = modelInteractionService.getEditShadowDefinition(null, AuthorizationPhaseType.REQUEST, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
         result.computeStatus();
         TestUtil.assertSuccess(result);
 
@@ -1389,36 +1379,60 @@ public void test265EditShadowSchemaNull() throws Exception {
     @Test
     public void test300RoleTypes() throws Exception {
 		final String TEST_NAME="test300RoleTypes";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         assertRoleTypes(getUser(USER_JACK_OID), "application","system","it");
     }
-
+    
     /**
+     * MID-4660, MID-4491, MID-3581
+     */
+    @Test
+    public void test310CustomRelations() throws Exception {
+		final String TEST_NAME="test310CustomRelations";
+        displayTestTitle(TEST_NAME);
+        
+        Task task = createTask(TEST_NAME);
+        OperationResult result = task.getResult();
+        
+        // WHEN
+        displayWhen(TEST_NAME);
+        List<RelationDefinitionType> relations = modelInteractionService.getRelationDefinitions(result);
+        
+        // THEN
+ 		displayThen(TEST_NAME);
+ 		display("Relations", relations);
+        assertRelationDef(relations, SchemaConstants.ORG_MANAGER, "RelationTypes.Manager");
+        assertRelationDef(relations, SchemaConstants.ORG_OWNER, "Master");
+        assertRelationDef(relations, RELATION_PIRACY_CAPTAIN, "Captain");
+        assertEquals("Unexpected number of relation definitions", 8, relations.size());
+    }
+
+	/**
      * Login as Otis. Otis has a restricted authorizations. Check that schema is presented accordingly to
      * these limitations.
      */
     @Test
     public void test800OtisEditSchemaUser() throws Exception {
 		final String TEST_NAME="test800OtisEditSchemaUser";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
         login(USER_OTIS_USERNAME);
 
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
         PrismObjectDefinition<UserType> userDef = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(UserType.class);
         PrismObject<UserType> user = userDef.instantiate();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObjectDefinition<UserType> editDef = getEditObjectDefinition(user);
-        IntegrationTestTools.display("Otis edit schema", editDef);
+        display("Otis edit schema", editDef);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 
 		PrismPropertyDefinition<PolyString> nameDef = editDef.findPropertyDefinition(UserType.F_NAME);
 		assertNotNull("No definition for name in user", nameDef);
@@ -1471,20 +1485,20 @@ public void test800OtisEditSchemaUser() throws Exception {
     @Test
     public void test810OtisGetJack() throws Exception {
 		final String TEST_NAME="test810OtisGetJack";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
         login(USER_OTIS_USERNAME);
 
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
         PrismObject<UserType> user = modelService.getObject(UserType.class, USER_JACK_OID, null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
@@ -1555,20 +1569,20 @@ public void validate(PrismPropertyDefinition<String> propDef, String name) throw
     @Test
     public void test820OtisSearchUsers() throws Exception {
 		final String TEST_NAME="test820OtisSearchUsers";
-        TestUtil.displayTestTitle(this, TEST_NAME);
+        displayTestTitle(TEST_NAME);
 
         // GIVEN
         login(USER_OTIS_USERNAME);
 
-        Task task = taskManager.createTaskInstance(TestEditSchema.class.getName() + "." + TEST_NAME);
+        Task task = createTask(TEST_NAME);
         OperationResult result = task.getResult();
 
 		// WHEN
-        TestUtil.displayWhen(TEST_NAME);
+        displayWhen(TEST_NAME);
 		SearchResultList<PrismObject<UserType>> users = modelService.searchObjects(UserType.class, null, null, task, result);
 
 		// THEN
-		TestUtil.displayThen(TEST_NAME);
+		displayThen(TEST_NAME);
 		result.computeStatus();
 		TestUtil.assertSuccess(result);
 
diff --git a/model/model-intest/src/test/resources/gensync/system-configuration.xml b/model/model-intest/src/test/resources/gensync/system-configuration.xml
index a847f566e59..abfc1a8d95f 100644
--- a/model/model-intest/src/test/resources/gensync/system-configuration.xml
+++ b/model/model-intest/src/test/resources/gensync/system-configuration.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <!--
-  ~ Copyright (c) 2010-2017 Evolveum
+  ~ Copyright (c) 2010-2018 Evolveum
   ~
   ~ Licensed under the Apache License, Version 2.0 (the "License");
   ~ you may not use this file except in compliance with the License.
@@ -17,7 +17,9 @@
 
 <systemConfiguration oid="00000000-0000-0000-0000-000000000001" version="0"
 	xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-	xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
+	xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+	xmlns:org='http://midpoint.evolveum.com/xml/ns/public/common/org-3'
+	xmlns:piracy="http://midpoint.evolveum.com/xml/ns/samples/piracy">
     <name>SystemConfiguration</name>
     <logging>
     	<rootLoggerAppender>File Appender</rootLoggerAppender>
@@ -40,4 +42,27 @@
     	<type>c:RoleType</type>
     	<objectTemplateRef oid="fc0ace70-688f-11e3-ab09-001e8c717e5b"/>
     </objectTemplate>
+    <roleManagement>
+    	<relations>
+    		<!-- MID-4660, MID-4491, MID-3581 -->
+    		<relation>
+    			<ref>piracy:captain</ref>
+    			<description>This is completely new relation</description>
+    			<display>
+    				<label>Captain</label>
+    			</display>
+    			<category>organization</category>
+    			<category>governance</category>
+    		</relation>
+    		<relation>
+    			<ref>org:owner</ref>
+    			<description>This is redefined default relation</description>
+    			<display>
+    				<label>Master</label>
+    			</display>
+    			<category>policy</category>
+    			<category>governance</category>
+    		</relation>
+    	</relations>
+    </roleManagement>
 </systemConfiguration>
diff --git a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
index 924683d8457..392fef68ee8 100644
--- a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
+++ b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
@@ -4526,8 +4526,7 @@ protected <F extends FocusType> RoleSelectionSpecification getAssignableRoleSpec
 		Task task = taskManager.createTaskInstance(AbstractModelIntegrationTest.class+".getAssignableRoleSpecification");
 		OperationResult result = task.getResult();
 		RoleSelectionSpecification spec = modelInteractionService.getAssignableRoleSpecification(focus, task, result);
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		assertSuccess(result);
 		return spec;
 	}
 
diff --git a/provisioning/provisioning-api/src/main/java/com/evolveum/midpoint/provisioning/api/ResourceObjectChangeListener.java b/provisioning/provisioning-api/src/main/java/com/evolveum/midpoint/provisioning/api/ResourceObjectChangeListener.java
index 0bc2d4dc124..4e91c549f61 100644
--- a/provisioning/provisioning-api/src/main/java/com/evolveum/midpoint/provisioning/api/ResourceObjectChangeListener.java
+++ b/provisioning/provisioning-api/src/main/java/com/evolveum/midpoint/provisioning/api/ResourceObjectChangeListener.java
@@ -17,6 +17,7 @@
 
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.task.api.Task;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
 
 /**
  * @author Radovan Semancik
@@ -46,6 +47,6 @@ public interface ResourceObjectChangeListener extends ProvisioningListener {
 	 * @param change
 	 *            change description
 	 */
-	public void notifyChange(ResourceObjectShadowChangeDescription change, Task task, OperationResult parentResult);
+	public <F extends FocusType> void notifyChange(ResourceObjectShadowChangeDescription change, Task task, OperationResult parentResult);
 
 }
diff --git a/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java b/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java
index 3598105b29b..a43ebbab967 100644
--- a/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java
+++ b/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java
@@ -1937,12 +1937,12 @@ protected void assertNotLinked(String userOid, String accountOid) throws ObjectN
 		assertNotLinked(user, accountOid);
 	}
 
-	protected void assertNotLinked(PrismObject<UserType> user, PrismObject<ShadowType> account) throws ObjectNotFoundException, SchemaException {
+	protected <F extends FocusType> void assertNotLinked(PrismObject<F> user, PrismObject<ShadowType> account) throws ObjectNotFoundException, SchemaException {
 		assertNotLinked(user, account.getOid());
 	}
 
-	protected void assertNotLinked(PrismObject<UserType> user, String accountOid) throws ObjectNotFoundException, SchemaException {
-		PrismReference linkRef = user.findReference(UserType.F_LINK_REF);
+	protected <F extends FocusType> void assertNotLinked(PrismObject<F> user, String accountOid) throws ObjectNotFoundException, SchemaException {
+		PrismReference linkRef = user.findReference(FocusType.F_LINK_REF);
 		if (linkRef == null) {
 			return;
 		}
@@ -1955,7 +1955,7 @@ protected void assertNotLinked(PrismObject<UserType> user, String accountOid) th
 		assertFalse("User " + user + " IS linked to account " + accountOid + " but not expecting it", found);
 	}
 
-	protected void assertNoLinkedAccount(PrismObject<UserType> user) {
+	protected <F extends FocusType> void assertNoLinkedAccount(PrismObject<F> user) {
 		PrismReference accountRef = user.findReference(UserType.F_LINK_REF);
 		if (accountRef == null) {
 			return;
@@ -2370,7 +2370,6 @@ protected <T> T getAttributeValue(PrismObject<? extends ShadowType> shadow, QNam
 		return null; // not reached
 	}
 	
-
 	protected XMLGregorianCalendar getTimestamp(String duration) {
 		return XmlTypeConverter.addDuration(clock.currentTimeXMLGregorianCalendar(), duration);
 	}
@@ -2381,4 +2380,10 @@ protected void clockForward(String duration) {
 		XMLGregorianCalendar after = clock.currentTimeXMLGregorianCalendar();
 		display("Clock going forward", before + " --[" + duration + "]--> " + after);
 	}
+	
+	protected void assertRelationDef(List<RelationDefinitionType> relations, QName qname, String expectedLabel) {
+    	RelationDefinitionType relDef = ObjectTypeUtil.findRelationDefinition(relations, qname);
+    	assertNotNull("No definition for relation "+qname, relDef);
+    	assertEquals("Wrong relation "+qname+" label", expectedLabel, relDef.getDisplay().getLabel());
+	}
 }
diff --git a/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java b/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java
index e7c4eba4ddf..84ce9783506 100644
--- a/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java
+++ b/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java
@@ -108,6 +108,15 @@ public class AuthorizationConstants {
 	public static final QName AUTZ_UI_USER_HISTORY_QNAME = new QName(NS_AUTHORIZATION_UI, "userHistory");
 	public static final String AUTZ_UI_USER_HISTORY_URL = NS_AUTHORIZATION_UI + "#userHistory";
 
+	public static final QName AUTZ_UI_ORG_UNIT_HISTORY_QNAME = new QName(NS_AUTHORIZATION_UI, "orgUnitHistory");
+	public static final String AUTZ_UI_ORG_UNIT_HISTORY_URL = NS_AUTHORIZATION_UI + "#orgUnitHistory";
+
+	public static final QName AUTZ_UI_ROLE_HISTORY_QNAME = new QName(NS_AUTHORIZATION_UI, "roleHistory");
+	public static final String AUTZ_UI_ROLE_HISTORY_URL = NS_AUTHORIZATION_UI + "#roleHistory";
+
+	public static final QName AUTZ_UI_SERVICE_HISTORY_QNAME = new QName(NS_AUTHORIZATION_UI, "serviceHistory");
+	public static final String AUTZ_UI_SERVICE_HISTORY_URL = NS_AUTHORIZATION_UI + "#serviceHistory";
+
 	public static final QName AUTZ_UI_USER_HISTORY_XML_REVIEW_QNAME = new QName(NS_AUTHORIZATION_UI, "userHistoryXmlReview");
 	public static final String AUTZ_UI_USER_HISTORY_XML_REVIEW_URL = NS_AUTHORIZATION_UI + "#userHistoryXmlReview";
 
diff --git a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestServiceAccountsClassifier.java b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestServiceAccountsClassifier.java
new file mode 100644
index 00000000000..8c97a796af0
--- /dev/null
+++ b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestServiceAccountsClassifier.java
@@ -0,0 +1,177 @@
+package com.evolveum.midpoint.testing.story;
+
+import static org.testng.Assert.assertFalse;
+import static org.testng.AssertJUnit.assertNotNull;
+
+import java.io.File;
+
+import javax.xml.namespace.QName;
+
+import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.annotation.DirtiesContext.ClassMode;
+import org.springframework.test.context.ContextConfiguration;
+import org.testng.annotations.Test;
+
+import com.evolveum.icf.dummy.resource.DummyAccount;
+import com.evolveum.icf.dummy.resource.DummySyncStyle;
+import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.prism.path.ItemPath;
+import com.evolveum.midpoint.prism.util.PrismAsserts;
+import com.evolveum.midpoint.schema.constants.MidPointConstants;
+import com.evolveum.midpoint.schema.result.OperationResult;
+import com.evolveum.midpoint.task.api.Task;
+import com.evolveum.midpoint.test.util.MidPointTestConstants;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ServiceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+
+@ContextConfiguration(locations = {"classpath:ctx-story-test-main.xml"})
+@DirtiesContext(classMode = ClassMode.AFTER_CLASS)
+public class TestServiceAccountsClassifier extends AbstractStoryTest {
+
+	public static final File TEST_DIR = new File(MidPointTestConstants.TEST_RESOURCES_DIR, "service-accounts-classifier");
+	
+	protected static final File RESOURCE_DUMMY_CLASSIFIER_FILE = new File(TEST_DIR, "resource-dummy-classifier.xml");
+	protected static final String RESOURCE_DUMMY_CLASSIFIER_OID = "1169ac14-8377-11e8-b404-5b5a1a8af0db";
+	private static final String RESOURCE_DUMMY_CLASSIFIER_NS = MidPointConstants.NS_RI;
+	
+	private static final File ROLE_EMPLOYEE_FILE = new File(TEST_DIR, "role-employee.xml");
+	private static final String ROLE_EMPLOYEE_OID = "23d90f70-1924-419e-9beb-78a8bde6d261";
+	
+	private static final File SERVICE_JIRA_FILE = new File(TEST_DIR, "service-jira.xml");
+	private static final String SERVICE_JIRA_OID = "c0c010c0-d34d-b33f-f00d-111111122222";
+	
+	private static final String ACCOUNT_DUMMY_JIRA_USERNAME = "jira";
+	private static final String ACCOUNT_DUMMY_WIKI_USERNAME = "wiki";
+	
+	private static final File TASK_RECONCILE_DUMMY_CLASSIFIER_FILE = new File(TEST_DIR, "task-dummy-classifier-reconcile.xml");
+	private static final String TASK_RECONCILE_DUMMY_CLASSIFIER_OID = "10335c7c-838f-11e8-93a6-4b1dd0ab58e4";
+	
+	private static final String NS_EXT = "http://midpoint.evolveum.com/xml/ns/story/serviceAccountsClassifier/ext";
+	private static final QName F_ACCOUNT_NAME = new QName(NS_EXT, "accountName");
+	
+	@Override
+	public void initSystem(Task initTask, OperationResult initResult) throws Exception {
+		super.initSystem(initTask, initResult);
+
+		assertServices(0);
+		
+		importObjectFromFile(ROLE_EMPLOYEE_FILE, initResult);
+		
+		initDummyResourcePirate(null, RESOURCE_DUMMY_CLASSIFIER_FILE, RESOURCE_DUMMY_CLASSIFIER_OID, initTask, initResult);
+		getDummyResource().setSyncStyle(DummySyncStyle.SMART);
+	}
+	
+	@Test
+	public void test001assigneJackEmployeeRole() throws Exception {
+		final String TEST_NAME = "test001assigneJackEmployeeRole";
+		displayTestTitle(TEST_NAME);
+		
+		//WHEN
+		displayWhen(TEST_NAME);
+		assignRole(USER_JACK_OID, ROLE_EMPLOYEE_OID);
+		
+		//THEN
+		PrismObject<UserType> userAfter = getUser(USER_JACK_OID);
+		assertAccount(userAfter, RESOURCE_DUMMY_CLASSIFIER_OID);
+		
+		//TODO: assert attributes?
+	}
+	
+	@Test
+	public void test100createService() throws Exception {
+		final String TEST_NAME = "test100createService";
+		displayTestTitle(TEST_NAME);
+		
+		//WHEN
+		addObject(SERVICE_JIRA_FILE);
+		
+		//THEN
+		PrismObject<ServiceType> service = getObject(ServiceType.class, SERVICE_JIRA_OID);
+		display("Service magazine after", service);
+		assertNotNull("No magazine service", service);
+		
+		assertNoLinkedAccount(service);
+	}
+	
+	@Test
+	public void test150StartReconTask() throws Exception {
+		final String TEST_NAME = "test150StartReconTask";
+		displayTestTitle(TEST_NAME);
+		
+		assertUsers(getNumberOfUsers());
+		assertServices(1);
+		
+		// WHEN
+        displayWhen(TEST_NAME);
+        
+        importObjectFromFile(TASK_RECONCILE_DUMMY_CLASSIFIER_FILE);
+
+		// THEN
+		displayThen(TEST_NAME);
+		
+		waitForTaskStart(TASK_RECONCILE_DUMMY_CLASSIFIER_OID, true);
+		
+		assertServices(1);
+		assertUsers(getNumberOfUsers());
+	}
+	
+	@Test
+	public void test151LinkServiceAccountRecon() throws Exception {
+		final String TEST_NAME = "test151LinkServiceAccountRecon";
+		displayTestTitle(TEST_NAME);
+		
+		// Preconditions
+		assertServices(1);
+
+        DummyAccount account = new DummyAccount(ACCOUNT_DUMMY_JIRA_USERNAME);
+		account.setEnabled(true);
+		
+		// WHEN
+        displayWhen(TEST_NAME);
+
+		getDummyResource().addAccount(account);
+
+        waitForTaskNextRunAssertSuccess(TASK_RECONCILE_DUMMY_CLASSIFIER_OID, true);
+		
+		// THEN
+		displayThen(TEST_NAME);
+		
+		assertServices(1);
+		PrismObject<ServiceType> serviceJirafter = getObject(ServiceType.class, SERVICE_JIRA_OID);
+		display("Service magazine after", serviceJirafter);
+		assertNotNull("No magazine service", serviceJirafter);
+		PrismAsserts.assertPropertyValue(serviceJirafter, new ItemPath(ServiceType.F_EXTENSION, F_ACCOUNT_NAME), ACCOUNT_DUMMY_JIRA_USERNAME);
+		assertLinks(serviceJirafter, 1);
+		
+	}
+	
+	@Test
+	public void test152InactivateUnmatchedAccountRecon() throws Exception {
+		final String TEST_NAME = "test152InactivateUnmatchedAccountRecon";
+		displayTestTitle(TEST_NAME);
+		
+		// Preconditions
+		assertServices(1);
+
+        DummyAccount account = new DummyAccount(ACCOUNT_DUMMY_WIKI_USERNAME);
+		account.setEnabled(true);
+		
+		// WHEN
+        displayWhen(TEST_NAME);
+
+		getDummyResource().addAccount(account);
+
+        waitForTaskNextRunAssertSuccess(TASK_RECONCILE_DUMMY_CLASSIFIER_OID, true);
+		
+		// THEN
+		displayThen(TEST_NAME);
+		
+		assertServices(1);
+		
+		DummyAccount dummyAccount = getDummyAccount(getDummyResource().getInstanceName(), ACCOUNT_DUMMY_WIKI_USERNAME);
+		assertFalse(dummyAccount.isEnabled(), "Dummy account should be disabled");
+	}
+	
+	
+	
+}
diff --git a/testing/story/src/test/resources/logback-test.xml b/testing/story/src/test/resources/logback-test.xml
index 465adab5d27..47f19fe93d3 100644
--- a/testing/story/src/test/resources/logback-test.xml
+++ b/testing/story/src/test/resources/logback-test.xml
@@ -62,6 +62,7 @@
 	<logger name="com.evolveum.midpoint.model.impl.sync" level="TRACE" />
 	<logger name="com.evolveum.midpoint.model.impl.sync.ReconciliationTaskHandler" level="DEBUG" />
 	<logger name="com.evolveum.midpoint.model.impl.sync.CorrelationConfirmationEvaluator" level="DEBUG" />
+	<logger name="com.evolveum.midpoint.common.SynchronizationUtils" level="TRACE" />
     <logger name="com.evolveum.midpoint.provisioning" level="DEBUG" />
     <logger name="com.evolveum.midpoint.provisioning.impl.ResourceManager" level="DEBUG" />
 	<logger name="com.evolveum.midpoint.expression" level="DEBUG" />
diff --git a/testing/story/src/test/resources/schema/serviceAccountsClassifier.xsd b/testing/story/src/test/resources/schema/serviceAccountsClassifier.xsd
new file mode 100644
index 00000000000..458e7131d62
--- /dev/null
+++ b/testing/story/src/test/resources/schema/serviceAccountsClassifier.xsd
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+
+<!--
+  ~ Copyright (c) 2010-2017 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<xsd:schema elementFormDefault="qualified"
+            targetNamespace="http://midpoint.evolveum.com/xml/ns/story/serviceAccountsClassifier/ext"
+            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+            xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
+            xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
+            xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+
+	<xsd:import namespace="http://prism.evolveum.com/xml/ns/public/types-3"/>
+	<xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/common/common-3"/>
+
+    <xsd:complexType name="ServiceExtensionType">
+        <xsd:annotation>
+            <xsd:appinfo>
+                <a:extension ref="c:ServiceType"/>
+            </xsd:appinfo>
+        </xsd:annotation>
+        <xsd:sequence>
+           <xsd:element name="accountName" type="xsd:string" minOccurs="0">
+				<xsd:annotation>
+					<xsd:appinfo>
+						<a:indexed>true</a:indexed>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:element>
+        </xsd:sequence>
+    </xsd:complexType>
+
+</xsd:schema>
diff --git a/testing/story/src/test/resources/service-accounts-classifier/resource-dummy-classifier.xml b/testing/story/src/test/resources/service-accounts-classifier/resource-dummy-classifier.xml
new file mode 100644
index 00000000000..b4bdcc24111
--- /dev/null
+++ b/testing/story/src/test/resources/service-accounts-classifier/resource-dummy-classifier.xml
@@ -0,0 +1,309 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright (c) 2010-2018 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<resource oid="1169ac14-8377-11e8-b404-5b5a1a8af0db"
+		  xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+          xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+          xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
+          xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
+		  xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3"
+          xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
+          xmlns:piracy="http://midpoint.evolveum.com/xml/ns/samples/piracy"
+          xmlns:ext="http://midpoint.evolveum.com/xml/ns/story/serviceAccountsClassifier/ext"
+          xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+
+	<name>Dummy Resource Classifier</name>
+	<connectorRef type="ConnectorType">
+		<filter>
+			<q:and>
+				<q:equal>
+					<q:path>connectorType</q:path>
+					<q:value>com.evolveum.icf.dummy.connector.DummyConnector</q:value>
+				</q:equal>
+				<q:equal>
+					<q:path>connectorVersion</q:path>
+					<q:value>2.0</q:value>
+				</q:equal>
+			</q:and>
+		</filter>
+	</connectorRef>
+	<connectorConfiguration xmlns:icfi="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.icf.dummy/com.evolveum.icf.dummy.connector.DummyConnector"
+	               xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3">
+					   
+		<icfc:configurationProperties>
+			<icfi:instanceId></icfi:instanceId> <!-- Default instance. -->
+			<icfi:uselessGuardedString>
+				<clearValue>whatever</clearValue>
+			</icfi:uselessGuardedString>
+			<icfi:uselessString>USEless</icfi:uselessString>
+		</icfc:configurationProperties>
+		
+		<icfc:resultsHandlerConfiguration>
+			<icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler>
+			<icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
+			<icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler>
+		</icfc:resultsHandlerConfiguration>
+
+	</connectorConfiguration>
+	
+	<schemaHandling>
+		<objectType>
+			<kind>account</kind>
+			<intent>default</intent>
+			<default>true</default>
+			<objectClass>ri:AccountObjectClass</objectClass>
+			<attribute>
+				<ref>icfs:name</ref>
+				<displayName>Username</displayName>
+				<outbound>
+				    <strength>strong</strength>
+				    <source>
+				    	<path>$user/name</path>
+				    </source>
+					<expression>
+						<script>
+							<code>
+								name + iterationToken
+							</code>
+						</script>
+					</expression>
+				</outbound>
+			</attribute>
+			<attribute>
+				<ref>icfs:uid</ref>
+			</attribute>
+			<attribute>
+				<ref>ri:fullname</ref>
+				<outbound>
+					<source>
+						<path>$user/fullName</path>
+					</source>
+				</outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:title</ref>
+				<tolerant>true</tolerant>
+			</attribute>
+			<attribute>
+				<ref>ri:location</ref>
+				<displayName>Location</displayName>
+				<outbound>
+					<strength>strong</strength>
+					<source>
+						<path>
+							$user/locality
+						</path>
+					</source>
+				</outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:ship</ref>
+				<displayName>Ship</displayName>
+			</attribute>
+			<attribute>
+				<ref>ri:weapon</ref>
+				<displayName>Weapon</displayName>
+			</attribute>
+			<attribute>
+				<ref>ri:drink</ref>
+				<displayName>Drink</displayName>
+				<tolerant>false</tolerant>
+			</attribute>
+			<attribute>
+				<ref>ri:quote</ref>
+				<displayName>Quote</displayName>
+				<tolerant>false</tolerant>
+			</attribute>
+            <attribute>
+                <ref>ri:gossip</ref>
+                <displayName>Gossip</displayName>
+                <tolerant>true</tolerant>
+            </attribute>
+            <attribute>
+                <ref>ri:water</ref>
+                <limitations>
+                	<ignore>true</ignore>
+                </limitations>
+            </attribute>
+            
+			<iteration>
+				<maxIterations>5</maxIterations>
+			</iteration>
+                        
+            <activation>
+            	<existence>
+            		<outbound/>
+            	</existence>
+            	<administrativeStatus>
+            		<outbound/>
+            	</administrativeStatus>
+            	<lockoutStatus>
+            		<outbound/>
+            	</lockoutStatus>
+            </activation>
+            
+            <credentials>
+                <password>
+                    <outbound/>
+                </password>
+            </credentials>
+            
+		</objectType>
+
+		<!-- Service accounts. Same as user accounts, just no outbound mappings. -->
+		<objectType>
+			<kind>account</kind>
+			<intent>service</intent>
+			<default>false</default>
+			<objectClass>ri:AccountObjectClass</objectClass>
+			<attribute>
+				<ref>icfs:name</ref>
+				<displayName>Username</displayName>
+				<inbound>
+					<target>
+						<path>extension/ext:accountName</path>
+					</target>
+				</inbound>
+			</attribute>
+			<attribute>
+				<ref>ri:fullname</ref>
+				<inbound>
+					<target>
+						<path>description</path>
+					</target>
+				</inbound>
+			</attribute>
+		</objectType>
+		
+	</schemaHandling>
+	
+	<synchronization>
+	
+	 	<objectSynchronizationSorter>
+			<expression>
+				<trace>true</trace>
+				<script>
+					<code>
+					
+						import com.evolveum.midpoint.xml.ns._public.common.common_3.*
+						import javax.xml.namespace.QName
+						import com.evolveum.midpoint.prism.query.builder.QueryBuilder
+						import com.evolveum.midpoint.prism.path.ItemPath
+						import com.evolveum.midpoint.schema.constants.SchemaConstants
+						import com.evolveum.midpoint.util.exception.ConfigurationException
+						import com.evolveum.midpoint.schema.util.ShadowUtil
+					
+						discriminator = new ObjectSynchronizationDiscriminatorType();
+						
+						owner = midpoint.searchShadowOwner(shadow.getOid());
+						
+						if (owner == null) {
+							accountNamePath = new QName("http://midpoint.evolveum.com/xml/ns/story/serviceAccountsClassifier/ext", "accountName");
+							query = QueryBuilder.queryFor(ServiceType.class, midpoint.getPrismContext())
+								.item(new ItemPath(ServiceType.F_EXTENSION, accountNamePath)).eq(ShadowUtil.getSecondaryIdentifierRealValue(shadow.asPrismObject()))
+							.build()
+							
+							applicableServices = midpoint.searchObjects(ServiceType.class, query)
+							if (applicableServices.isEmpty()) {
+								log.info("No applicable services found, returning UNMATCHED situation for account/default")
+								discriminator.setSynchronizationSituation(SynchronizationSituationType.UNMATCHED)
+								discriminator.setKind(ShadowKindType.ACCOUNT)
+								discriminator.setIntent("default")
+								return discriminator
+							}
+							
+							if (applicableServices.size() == 1) {
+								log.info("Corresponding service found, returning UNLINKED situation for account/service")
+								log.info("service {}", applicableServices.get(0))
+								discriminator.setOwner(applicableServices.get(0))
+								discriminator.setKind(ShadowKindType.ACCOUNT)
+								discriminator.setIntent("service")
+								discriminator.setSynchronizationSituation(SynchronizationSituationType.UNLINKED)
+								return discriminator
+							}
+							
+							log.info("Unexpected situation, throw exception rather")
+							throw new ConfigurationException("Wrong configuration, cannot determine what to do.");
+						}
+						
+						ownerType = owner.asObjectable();
+						if (ownerType instanceof UserType) {
+							discriminator.setIntent("default")
+							
+						} else if (ownerType instanceof ServiceType) {
+							discriminator.setIntent("service")
+						}
+						
+						discriminator.setOwner(ownerType)
+						discriminator.setKind(ShadowKindType.ACCOUNT)
+						discriminator.setSynchronizationSituation(SynchronizationSituationType.LINKED)
+						log.info("owner: ", ownerType)
+						return discriminator
+					</code>
+				</script>
+			</expression>
+		</objectSynchronizationSorter>
+	
+		<objectSynchronization>
+			<objectClass>ri:AccountObjectClass</objectClass>
+			<kind>account</kind>
+			<intent>service</intent>
+			<focusType>ServiceType</focusType>
+			<enabled>true</enabled>
+			<reaction>
+	            <situation>linked</situation>
+	            <synchronize>true</synchronize>
+	        </reaction>
+	        <reaction>
+	            <situation>unlinked</situation>
+	            <synchronize>true</synchronize>
+	            <action>
+	            	<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
+	            </action>
+	        </reaction>
+        </objectSynchronization>
+        
+        <objectSynchronization>
+			<objectClass>ri:AccountObjectClass</objectClass>
+			<kind>account</kind>
+			<intent>default</intent>
+			<focusType>UserType</focusType>
+			<enabled>true</enabled>
+			<reaction>
+	            <situation>linked</situation>
+	            <synchronize>true</synchronize>
+	        </reaction>
+	        <reaction>
+	            <situation>unmatched</situation>
+	            <synchronize>true</synchronize>
+	            <action>
+	            	<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#inactivateShadow</handlerUri>
+	            </action>
+	        </reaction>
+	        <reaction>
+	            <situation>deleted</situation>
+	            <synchronize>true</synchronize>
+	            <action>
+	            	<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#deleteFocus</handlerUri>
+	            </action>
+	        </reaction>
+        </objectSynchronization>
+       
+	</synchronization>
+
+</resource>
diff --git a/testing/story/src/test/resources/service-accounts-classifier/role-employee.xml b/testing/story/src/test/resources/service-accounts-classifier/role-employee.xml
new file mode 100644
index 00000000000..19577d4aec4
--- /dev/null
+++ b/testing/story/src/test/resources/service-accounts-classifier/role-employee.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright (c) 2010-2017 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<role oid="23d90f70-1924-419e-9beb-78a8bde6d261"
+      xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">
+   <name>Employee</name>
+   <inducement id="1">
+      <construction>
+         <resourceRef oid="1169ac14-8377-11e8-b404-5b5a1a8af0db" type="ResourceType"><!-- Dummy Classifier--></resourceRef>
+         <kind>account</kind>
+         <intent>default</intent>
+      </construction>
+   </inducement>
+</role>
diff --git a/testing/story/src/test/resources/service-accounts-classifier/service-jira.xml b/testing/story/src/test/resources/service-accounts-classifier/service-jira.xml
new file mode 100644
index 00000000000..f32eda40917
--- /dev/null
+++ b/testing/story/src/test/resources/service-accounts-classifier/service-jira.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright (c) 2010-2017 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<service oid="c0c010c0-d34d-b33f-f00d-111111122222" 
+		xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
+		xmlns:c='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
+		xmlns:t='http://prism.evolveum.com/xml/ns/public/types-3'
+		xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+		xmlns:xsd='http://www.w3.org/2001/XMLSchema'
+		xmlns:ext="http://midpoint.evolveum.com/xml/ns/story/serviceAccountsClassifier/ext"
+		xmlns:piracy='http://midpoint.evolveum.com/xml/ns/samples/piracy'>
+    <name>service-jira-admin</name>
+    <description>Technical account for JIRA</description>
+    <displayName>JIRA</displayName>
+    <extension>
+    	<ext:accountName>jira</ext:accountName>
+    </extension>
+</service>
diff --git a/testing/story/src/test/resources/service-accounts-classifier/task-dummy-classifier-reconcile.xml b/testing/story/src/test/resources/service-accounts-classifier/task-dummy-classifier-reconcile.xml
new file mode 100644
index 00000000000..2acc65d78bc
--- /dev/null
+++ b/testing/story/src/test/resources/service-accounts-classifier/task-dummy-classifier-reconcile.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright (c) 2010-2018 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!--Reconciliation task definition for dummy resource -->
+
+<task oid="10335c7c-838f-11e8-93a6-4b1dd0ab58e4"
+	xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+	xmlns:syncext="http://midpoint.evolveum.com/xml/ns/public/model/extension-3"
+	xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+								  
+	<!-- Resource printable name -->
+	<name>Reconciliation: Dummy</name>
+	
+	<extension>
+		<syncext:objectclass>ri:AccountObjectClass</syncext:objectclass>
+	</extension>
+	
+	<taskIdentifier>10335c7c-838f-11e8-93a6-4b1dd0ab58e4</taskIdentifier>
+	<ownerRef oid="00000000-0000-0000-0000-000000000002"/>
+	<executionStatus>runnable</executionStatus>
+
+	<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/synchronization/task/reconciliation/handler-3</handlerUri>
+	<objectRef oid="1169ac14-8377-11e8-b404-5b5a1a8af0db" type="ResourceType"/>
+	<recurrence>recurring</recurrence>
+	<schedule>
+		<interval>3</interval>
+	</schedule>
+
+</task>
diff --git a/tools/xjc-plugin/src/main/java/com/evolveum/midpoint/schema/xjc/schema/SchemaProcessor.java b/tools/xjc-plugin/src/main/java/com/evolveum/midpoint/schema/xjc/schema/SchemaProcessor.java
index cfe2b1c1e50..0f34aa45d2b 100644
--- a/tools/xjc-plugin/src/main/java/com/evolveum/midpoint/schema/xjc/schema/SchemaProcessor.java
+++ b/tools/xjc-plugin/src/main/java/com/evolveum/midpoint/schema/xjc/schema/SchemaProcessor.java
@@ -23,6 +23,7 @@
 import com.evolveum.midpoint.prism.PrismContainerValue;
 import com.evolveum.midpoint.prism.PrismContext;
 import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.prism.PrismObjectValue;
 import com.evolveum.midpoint.prism.PrismReference;
 import com.evolveum.midpoint.prism.PrismReferenceValue;
 import com.evolveum.midpoint.prism.Raw;
@@ -106,6 +107,7 @@ public class SchemaProcessor implements Processor {
     // The "as" prefix is chosen to avoid clash with usual "get" for the fields and also to indicate that
     //   the it returns the same object in a different representation and not a composed/aggregated object
     public static final String METHOD_AS_PRISM_OBJECT = "asPrismObject";
+    public static final String METHOD_AS_PRISM_OBJECT_VALUE = "asPrismObjectValue";
     public static final String METHOD_AS_PRISM_CONTAINER_VALUE = "asPrismContainerValue";
     private static final String METHOD_AS_PRISM_CONTAINER = "asPrismContainer";
     // The "setup" prefix is chosen avoid collision with regular setters for generated fields
@@ -180,7 +182,8 @@ public boolean run(Outline outline, Options options, ErrorHandler errorHandler)
                     List.class, Objectable.class, StringBuilder.class, XmlAccessorType.class, XmlElement.class, XmlType.class,
                     XmlAttribute.class, XmlAnyAttribute.class, XmlAnyElement.class, PrismContainer.class, Equals.class,
                     PrismContainerArrayList.class, HashCode.class, PrismContainerDefinition.class, Containerable.class,
-					Referencable.class, Raw.class, Enum.class, XmlEnum.class, PolyStringType.class, XmlTypeConverter.class);
+					Referencable.class, Raw.class, Enum.class, XmlEnum.class, PolyStringType.class, XmlTypeConverter.class,
+					PrismObjectValue.class);
 
             StepSchemaConstants stepSchemaConstants = new StepSchemaConstants();
             stepSchemaConstants.run(outline, options, errorHandler);
@@ -1721,8 +1724,8 @@ private void createContainerFieldSetterBody(JFieldVar field, ClassOutline classO
 
         JVar cont;
         if (isPrismContainer(param.type(), classOutline.parent())) {
-            cont = body.decl(CLASS_MAP.get(PrismObject.class), FIELD_CONTAINER_VALUE_LOCAL_VAR_NAME, JOp.cond(param.ne(JExpr._null()),
-                    JExpr.invoke(param, METHOD_AS_PRISM_CONTAINER_VALUE), JExpr._null()));
+            cont = body.decl(CLASS_MAP.get(PrismContainerValue.class), FIELD_CONTAINER_VALUE_LOCAL_VAR_NAME, 
+            		JOp.cond(param.ne(JExpr._null()), JExpr.invoke(param, METHOD_AS_PRISM_CONTAINER_VALUE), JExpr._null()));
         } else {
             cont = body.decl(CLASS_MAP.get(PrismContainerValue.class), FIELD_CONTAINER_VALUE_LOCAL_VAR_NAME,
                     JOp.cond(param.ne(JExpr._null()), JExpr.invoke(param, METHOD_AS_PRISM_CONTAINER_VALUE), JExpr._null()));