diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectListPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectListPanel.java
index ce2fa7836a4..ed881ed8aa1 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectListPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/component/ObjectListPanel.java
@@ -389,24 +389,23 @@ public IModel<?> getDataModel(IModel<SelectableBean<O>> rowModel) {
                                 return Model.of("");
                             }
                             Item<?, ?> item = null;
-                            if (columnPath != null) {
-                                item = value.asPrismContainerValue().findItem(columnPath);
-                            }
-                            Item object = value.asPrismObject();
-                            if (item != null) {
-                                object = item;
-                            }
                             if (expression != null) {
                                 Task task = getPageBase().createSimpleTask("evaluate column expression");
                                 try {
+                                    if (columnPath != null) {
+                                        item = value.asPrismContainerValue().findItem(columnPath);
+                                    }
+                                    Item object = value.asPrismObject();
+                                    if (item != null) {
+                                        object = item;
+                                    }
                                     ExpressionVariables expressionVariables = new ExpressionVariables();
                                     expressionVariables.put(ExpressionConstants.VAR_OBJECT, object, object.getClass());
                                     String stringValue = ExpressionUtil.evaluateStringExpression(expressionVariables, getPageBase().getPrismContext(), expression,
                                             MiscSchemaUtil.getExpressionProfile(), getPageBase().getExpressionFactory(), "evaluate column expression",
                                             task, task.getResult()).iterator().next();
                                     return Model.of(stringValue);
-                                } catch (SchemaException | ExpressionEvaluationException | ObjectNotFoundException | CommunicationException
-                                        | ConfigurationException | SecurityViolationException e) {
+                                } catch (Exception e) {
                                     LOGGER.error("Couldn't execute expression for name column");
                                     OperationResult result = task.getResult();
                                     OperationResultStatusPresentationProperties props = OperationResultStatusPresentationProperties.parseOperationalResultStatus(result.getStatus());
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/prism/wrapper/PrismObjectWrapper.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/prism/wrapper/PrismObjectWrapper.java
index 306b7b8a39f..6144febc825 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/prism/wrapper/PrismObjectWrapper.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/prism/wrapper/PrismObjectWrapper.java
@@ -17,7 +17,6 @@
  */
 public interface PrismObjectWrapper<O extends ObjectType> extends PrismContainerWrapper<O> {
 
-
     ObjectDelta<O> getObjectDelta() throws SchemaException;
 
     PrismObject<O> getObject();
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/WebComponentUtil.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/WebComponentUtil.java
index af2f625580c..e80cb3f368f 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/WebComponentUtil.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/api/util/WebComponentUtil.java
@@ -663,7 +663,7 @@ public static TaskType createSingleRecurrenceTask(String taskName, QName applica
 
     public static boolean canSuspendTask(TaskType task, PageBase pageBase) {
         return pageBase.isAuthorized(ModelAuthorizationAction.SUSPEND_TASK, task.asPrismObject())
-                && (isRunnableTask(task) || isRunningTask(task))
+                && (isRunnableTask(task) || isRunningTask(task) || isWaitingTask(task))
                 && !isWorkflowTask(task);
     }
 
@@ -687,6 +687,10 @@ public static boolean isRunningTask(TaskType task) {
         return task != null && task.getNodeAsObserved() != null;
     }
 
+    public static boolean isWaitingTask(TaskType task) {
+        return task != null && TaskExecutionStatusType.WAITING == task.getExecutionStatus();
+    }
+
     public static boolean isSuspendedTask(TaskType task) {
         return task != null && TaskExecutionStatusType.SUSPENDED == task.getExecutionStatus();
     }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/InfoBoxPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/InfoBoxPanel.java
index 677b9dd54a3..437bc4f9e83 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/InfoBoxPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/InfoBoxPanel.java
@@ -6,31 +6,9 @@
  */
 package com.evolveum.midpoint.gui.impl.component.box;
 
-import java.util.ArrayList;
-import java.util.Collection;
 import java.util.HashMap;
-import java.util.List;
-
 import javax.xml.namespace.QName;
 
-import com.evolveum.midpoint.gui.api.component.BasePanel;
-import com.evolveum.midpoint.gui.api.model.LoadableModel;
-import com.evolveum.midpoint.model.api.util.DashboardUtils;
-import com.evolveum.midpoint.prism.PrismObject;
-import com.evolveum.midpoint.prism.path.ItemPath;
-import com.evolveum.midpoint.prism.xnode.ListXNode;
-import com.evolveum.midpoint.prism.xnode.MapXNode;
-import com.evolveum.midpoint.prism.xnode.PrimitiveXNode;
-import com.evolveum.midpoint.prism.xnode.XNode;
-import com.evolveum.midpoint.schema.result.OperationResult;
-import com.evolveum.midpoint.util.QNameUtil;
-import com.evolveum.midpoint.web.page.admin.server.PageTask;
-import com.evolveum.midpoint.web.page.admin.server.PageTasks;
-import com.evolveum.midpoint.xml.ns._public.common.audit_3.AuditEventRecordType;
-import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
-
-import com.evolveum.prism.xml.ns._public.types_3.ItemPathType;
-
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.Validate;
 import org.apache.wicket.AttributeModifier;
@@ -41,17 +19,21 @@
 import org.apache.wicket.model.PropertyModel;
 import org.apache.wicket.request.mapper.parameter.PageParameters;
 
+import com.evolveum.midpoint.gui.api.component.BasePanel;
+import com.evolveum.midpoint.gui.api.model.LoadableModel;
 import com.evolveum.midpoint.gui.api.page.PageBase;
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 import com.evolveum.midpoint.gui.api.util.WebModelServiceUtils;
 import com.evolveum.midpoint.model.api.interaction.DashboardWidget;
+import com.evolveum.midpoint.model.api.util.DashboardUtils;
+import com.evolveum.midpoint.prism.PrismObject;
+import com.evolveum.midpoint.prism.query.ObjectFilter;
+import com.evolveum.midpoint.schema.ResourceShadowDiscriminator;
+import com.evolveum.midpoint.schema.result.OperationResult;
+import com.evolveum.midpoint.schema.util.ObjectQueryUtil;
 import com.evolveum.midpoint.task.api.Task;
-import com.evolveum.midpoint.util.exception.CommunicationException;
-import com.evolveum.midpoint.util.exception.ConfigurationException;
-import com.evolveum.midpoint.util.exception.ExpressionEvaluationException;
-import com.evolveum.midpoint.util.exception.ObjectNotFoundException;
+import com.evolveum.midpoint.util.QNameUtil;
 import com.evolveum.midpoint.util.exception.SchemaException;
-import com.evolveum.midpoint.util.exception.SecurityViolationException;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
 import com.evolveum.midpoint.web.page.admin.reports.PageAuditLogViewer;
@@ -59,6 +41,8 @@
 import com.evolveum.midpoint.web.page.admin.resources.PageResources;
 import com.evolveum.midpoint.web.page.admin.roles.PageRole;
 import com.evolveum.midpoint.web.page.admin.roles.PageRoles;
+import com.evolveum.midpoint.web.page.admin.server.PageTask;
+import com.evolveum.midpoint.web.page.admin.server.PageTasks;
 import com.evolveum.midpoint.web.page.admin.services.PageService;
 import com.evolveum.midpoint.web.page.admin.services.PageServices;
 import com.evolveum.midpoint.web.page.admin.users.PageOrgTree;
@@ -66,6 +50,9 @@
 import com.evolveum.midpoint.web.page.admin.users.PageUser;
 import com.evolveum.midpoint.web.page.admin.users.PageUsers;
 import com.evolveum.midpoint.web.util.OnePageParameterEncoder;
+import com.evolveum.midpoint.xml.ns._public.common.audit_3.AuditEventRecordType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
+import com.evolveum.prism.xml.ns._public.query_3.SearchFilterType;
 
 /**
  * @author skublik
@@ -207,10 +194,10 @@ private void navigateToObjectCollectionPage(DashboardWidgetType dashboardWidget)
             PageParameters parameters = new PageParameters();
             if (QNameUtil.match(collection.getType(), ShadowType.COMPLEX_TYPE)) {
                 pageType = PageResource.class;
-                String oid = getResourceOid(collection.getFilter().getFilterClauseXNode());
+                String oid = getResourceOid(collection.getFilter());
                 if (oid != null) {
                     parameters.add(OnePageParameterEncoder.PARAMETER, oid);
-                    Integer tab = getResourceTab(collection.getFilter().getFilterClauseXNode());
+                    Integer tab = getResourceTab(collection.getFilter());
                     if (tab != null) {
                         parameters.add(PageResource.PARAMETER_SELECTED_TAB, tab);
                     } else {
@@ -257,72 +244,22 @@ private void navigateToObjectPage() {
         getPageBase().navigateToNext(pageType, parameters);
     }
 
-    private Integer getResourceTab(MapXNode mapXNode) {
-        for (QName name : mapXNode.keySet()) {
-            XNode xNode = mapXNode.get(name);
-            if (QNameUtil.match(name, new QName("equal"))) {
-                List<MapXNode> listXNode = new ArrayList<>();
-                if (xNode instanceof MapXNode) {
-                    listXNode.add((MapXNode) xNode);
-                } else if (xNode instanceof ListXNode) {
-                    listXNode.addAll((Collection<? extends MapXNode>) ((ListXNode) xNode).asList());
-                }
-                for (MapXNode equalXNode : listXNode) {
-                    if (equalXNode.get(new QName("path")) != null
-                            && ((ItemPathType) ((PrimitiveXNode) equalXNode.get(new QName("path")))
-                            .getValue()).getItemPath().equivalent(ItemPath.create("kind"))) {
-                        XNode value = equalXNode.get(new QName("value"));
-                        if (value instanceof PrimitiveXNode) {
-                            ShadowKindType kind = ShadowKindType.fromValue(((PrimitiveXNode)value).getValueParser().getStringValue());
-                            if (ShadowKindType.ACCOUNT.equals(kind)) {
-                                return 2;
-                            } else if (ShadowKindType.ENTITLEMENT.equals(kind)) {
-                                return 3;
-                            } else if (ShadowKindType.GENERIC.equals(kind)) {
-                                return 4;
-                            }
-                            return null;
-                        }
-                    }
-                }
-            }
-            if (xNode instanceof MapXNode) {
-                Integer ret = getResourceTab((MapXNode) xNode);
-                if (ret != null) {
-                    return ret;
-                }
-            }
+    private Integer getResourceTab(SearchFilterType searchFilterType) {
+        ResourceShadowDiscriminator discriminator = getResourceShadowDiscriminator(searchFilterType);
+        if (discriminator == null) {
+            return null;
         }
-        return null;
-    }
-
-    private String getResourceOid(MapXNode mapXNode) {
-        for (QName name : mapXNode.keySet()) {
-            XNode xNode = mapXNode.get(name);
-            if (QNameUtil.match(name, new QName("ref"))) {
-                List<MapXNode> listXNode = new ArrayList<>();
-                if (xNode instanceof MapXNode) {
-                    listXNode.add((MapXNode) xNode);
-                } else if (xNode instanceof ListXNode) {
-                    listXNode.addAll((Collection<? extends MapXNode>) ((ListXNode) xNode).asList());
-                }
-                for (MapXNode equalXNode : listXNode) {
-                    if (equalXNode.get(new QName("path")) != null
-                            && ((ItemPathType) ((PrimitiveXNode) equalXNode.get(new QName("path")))
-                            .getValue()).getItemPath().equivalent(ItemPath.create("resourceRef"))) {
-                        XNode value = equalXNode.get(new QName("value"));
-                        if (value instanceof MapXNode) {
-                            PrimitiveXNode oid = ((PrimitiveXNode) ((MapXNode) value).get(new QName("oid")));
-                            if (oid != null) {
-                                return oid.getValueParser().getStringValue();
-                            }
-                        }
-                    }
-                }
-            }
-            if (xNode instanceof MapXNode) {
-                return getResourceOid((MapXNode) xNode);
-            }
+        ShadowKindType shadowKindType = discriminator.getKind();
+        if (shadowKindType == null) {
+            return null;
+        }
+        switch (shadowKindType) {
+            case ACCOUNT:
+                return 2;
+            case ENTITLEMENT:
+                return 3;
+            case GENERIC:
+                return 4;
         }
         return null;
     }
@@ -341,8 +278,8 @@ protected boolean existLinkRef() {
                 ObjectCollectionType collection = getObjectCollectionType();
                 if(collection != null && collection.getType() != null && collection.getType().getLocalPart() != null) {
                     if (QNameUtil.match(collection.getType(), ShadowType.COMPLEX_TYPE)) {
-                        String oid = getResourceOid(collection.getFilter().getFilterClauseXNode());
-                        return !StringUtils.isEmpty(oid);
+                       String oid = getResourceOid(collection.getFilter());
+                       return StringUtils.isNotBlank(oid);
                     }
                     return getLinksRefCollections().containsKey(collection.getType().getLocalPart());
                 }  else {
@@ -366,45 +303,34 @@ protected boolean existLinkRef() {
         return false;
     }
 
-    private boolean isDataNull(DashboardWidgetType dashboardWidgetType) {
-        if(dashboardWidgetType.getData() == null) {
-            LOGGER.error("Data is not found in widget " + dashboardWidgetType.getIdentifier());
-            return true;
-        }
-        return false;
+    private String getResourceOid(SearchFilterType searchFilterType) {
+       ResourceShadowDiscriminator discriminator = getResourceShadowDiscriminator(searchFilterType);
+       if (discriminator == null) {
+           return null;
+       }
+       return discriminator.getResourceOid();
     }
 
-    private boolean isPresentationNull(IModel<DashboardWidgetType> model) {
-        if(model.getObject().getPresentation() == null) {
-            LOGGER.error("Presentation is not found in widget " + model.getObject().getIdentifier());
-            return true;
-        }
-        return false;
-    }
+    private ResourceShadowDiscriminator getResourceShadowDiscriminator(SearchFilterType searchFilterType) {
+        try {
+            ObjectFilter filter = getPrismContext().getQueryConverter().createObjectFilter(ShadowType.class, searchFilterType);
+            return ObjectQueryUtil.getCoordinates(filter, getPrismContext());
+        } catch (SchemaException e) {
+            LOGGER.error("Cannot convert filter: {}", e.getMessage(), e);
 
-    private boolean isViewOfWidgetNull(IModel<DashboardWidgetType> model) {
-        if(isPresentationNull(model)) {
-            return true;
-        }
-        if(model.getObject().getPresentation().getView() == null) {
-            LOGGER.error("View of presentation is not found in widget " + model.getObject().getIdentifier());
-            return true;
         }
-        return false;
+        return null;
     }
 
-    private boolean isSourceTypeOfDataNull(DashboardWidgetType dashboardWidgetType) {
-        if(isDataNull(dashboardWidgetType)) {
-            return true;
-        }
-        if(dashboardWidgetType.getData().getSourceType() == null) {
-            LOGGER.error("SourceType of data is not found in widget " + dashboardWidgetType.getIdentifier());
+    private boolean isDataNull(DashboardWidgetType dashboardWidgetType) {
+        if(dashboardWidgetType.getData() == null) {
+            LOGGER.error("Data is not found in widget " + dashboardWidgetType.getIdentifier());
             return true;
         }
         return false;
     }
 
-    private boolean isCollectionOfDataNull(DashboardWidgetType model) {
+   private boolean isCollectionOfDataNull(DashboardWidgetType model) {
         if(isDataNull(model)) {
             return true;
         }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/SmallInfoBoxPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/SmallInfoBoxPanel.java
index f6350ba3e88..79ec2ea8b31 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/SmallInfoBoxPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/component/box/SmallInfoBoxPanel.java
@@ -51,18 +51,18 @@ protected void customInitLayout(WebMarkupContainer parentInfoBox) {
         Label moreInfoBoxLabel = new Label(ID_MORE_INFO_BOX_LABEL, getPageBase().createStringResource("PageDashboard.infobox.moreInfo"));
         moreInfoBox.add(moreInfoBoxLabel);
 
-            moreInfoBox.add(new AjaxEventBehavior("click") {
-                private static final long serialVersionUID = 1L;
-
-                @Override
-                protected void onEvent(AjaxRequestTarget target) {
-                    navigateToPage();
-                }
-            });
-            moreInfoBox.add(AttributeModifier.append("class", "cursor-pointer"));
-
-            setInvisible(moreInfoBox);
-            moreInfoBox.add(AttributeModifier.append("style", "height: 26px; background:rgba(0, 0, 0, 0.1) !important;"));
+        moreInfoBox.add(new AjaxEventBehavior("click") {
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            protected void onEvent(AjaxRequestTarget target) {
+                navigateToPage();
+            }
+        });
+        moreInfoBox.add(AttributeModifier.append("class", "cursor-pointer"));
+
+        setInvisible(moreInfoBox);
+        moreInfoBox.add(AttributeModifier.append("style", "height: 26px; background:rgba(0, 0, 0, 0.1) !important;"));
     }
 
     @Override
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.html
index bd5de809bd6..29654fb5897 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.html
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.html
@@ -10,7 +10,7 @@
 <body>
 <wicket:panel>
     <div class="search-item"  wicket:id="searchItemContainer">
-        <div class="col-sm-3 search-item-label" wicket:id="searchItemLabel" />
+        <div class="col-sm-3 search-item-label" wicket:id="searchItemLabel" style="width: auto !important;" />
         <div class="search-item-field" wicket:id="searchItemField" />
         <a wicket:id="removeButton" class="btn btn-xs btn-default search-item-remove-button pull-right">
             <i class="fa fa-remove"/>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.java
index 9743f151393..210e6cac883 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchItemPanel.java
@@ -200,10 +200,10 @@ public void bind(Component component) {
                 default:
                     searchItemField = new TextPanel<String>(ID_SEARCH_ITEM_FIELD, new PropertyModel<>(getModel(), "value"));
             }
-            searchItemField.add(AttributeModifier.append("class", "col-sm-7"));
+            searchItemField.add(AttributeModifier.append("class", "col-sm-6"));
             if (searchItemField instanceof InputPanel && !(searchItemField instanceof AutoCompleteTextPanel)) {
                 ((InputPanel) searchItemField).getBaseFormComponent().add(WebComponentUtil.getSubmitOnEnterKeyDownBehavior("searchSimple"));
-                ((InputPanel) searchItemField).getBaseFormComponent().add(AttributeAppender.append("style", "width: 200px; max-width: 400px !important;"));
+                ((InputPanel) searchItemField).getBaseFormComponent().add(AttributeAppender.append("style", "width: 140px; max-width: 400px !important;"));
                 ((InputPanel) searchItemField).getBaseFormComponent().add(new EmptyOnBlurAjaxFormUpdatingBehaviour());
             }
         }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchPanel.java
index 4ad2bcd0351..cbbdf9cd0a5 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/search/SearchPanel.java
@@ -111,7 +111,7 @@ public SearchPanel(String id, IModel<Search> model, boolean advancedSearch) {
     }
 
     private <S extends SearchItem, T extends Serializable> void initLayout() {
-        moreDialogModel = new LoadableModel<MoreDialogDto>(true) {
+        moreDialogModel = new LoadableModel<MoreDialogDto>(false) {
 
             private static final long serialVersionUID = 1L;
 
@@ -162,6 +162,7 @@ protected void searchPerformed(AjaxRequestTarget target){
 
             @Override
             public void onClick(AjaxRequestTarget target) {
+                moreDialogModel.reset();
                 Component button = SearchPanel.this.get(createComponentPath(ID_FORM, ID_MORE_GROUP, ID_MORE));
                 Component popover = SearchPanel.this.get(createComponentPath(ID_POPOVER));
                 togglePopover(target, button, popover, 14);
@@ -692,7 +693,6 @@ private void addOneItemPerformed(Property property, AjaxRequestTarget target) {
         SearchItem item = search.addItem(property.getDefinition());
         item.setEditWhenVisible(true);
 
-        moreDialogModel.reset();
         refreshSearchForm(target);
     }
 
@@ -708,7 +708,6 @@ private void addItemPerformed(AjaxRequestTarget target) {
             search.addItem(property.getDefinition());
         }
 
-        moreDialogModel.reset();
         refreshSearchForm(target);
     }
 
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/wizard/WizardSteps.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/wizard/WizardSteps.java
index eaa33575b5e..52fa306d83f 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/wizard/WizardSteps.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/wizard/WizardSteps.java
@@ -1,17 +1,13 @@
 /*
- * Copyright (c) 2010-2017 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
  */
-
 package com.evolveum.midpoint.web.component.wizard;
 
-import com.evolveum.midpoint.gui.api.component.BasePanel;
-import com.evolveum.midpoint.gui.api.page.PageBase;
-import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
-import com.evolveum.midpoint.web.component.wizard.resource.component.WizardHelpDialog;
-import com.evolveum.midpoint.web.page.admin.resources.PageResourceWizard;
+import java.util.List;
+
 import org.apache.wicket.AttributeModifier;
 import org.apache.wicket.ajax.AjaxRequestTarget;
 import org.apache.wicket.ajax.markup.html.AjaxLink;
@@ -19,16 +15,16 @@
 import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 import org.apache.wicket.extensions.wizard.IWizardStep;
 import org.apache.wicket.markup.html.basic.Label;
-import org.apache.wicket.markup.html.form.Form;
 import org.apache.wicket.markup.html.list.ListItem;
 import org.apache.wicket.markup.html.list.ListView;
 import org.apache.wicket.model.IModel;
 
-import java.util.List;
+import com.evolveum.midpoint.gui.api.component.BasePanel;
+import com.evolveum.midpoint.gui.api.page.PageBase;
+import com.evolveum.midpoint.web.component.util.VisibleEnableBehaviour;
+import com.evolveum.midpoint.web.component.wizard.resource.component.WizardHelpDialog;
+import com.evolveum.midpoint.web.page.admin.resources.PageResourceWizard;
 
-/**
- * @author lazyman
- */
 public class WizardSteps extends BasePanel<List<WizardStepDto>> {
 
     private static final String ID_LINK_REPEATER = "linkRepeater";
@@ -69,7 +65,6 @@ protected void onError(AjaxRequestTarget target) {
                     @Override
                     public boolean isEnabled() {
                         final boolean enabled = ((PageResourceWizard) getPageBase()).isCurrentStepComplete();
-//                        System.out.println(dto.getName() + " enabled = " + enabled);
                         return enabled;
                     }
 
@@ -79,21 +74,13 @@ public boolean isVisible() {
                     }
                 });
 
-                button.add(AttributeModifier.replace("class", new IModel<String>() {
-                    @Override
-                    public String getObject() {
-                        return dto.getWizardStep() == getActiveStep() ? "current" : null;
-                    }
-                }));
+                button.add(AttributeModifier.replace("class", (IModel<String>) () ->
+                        dto.getWizardStep() == getActiveStep() ? "current" : null));
 
-                button.add(AttributeModifier.replace("style", new IModel<String>() {
-                    @Override
-                    public String getObject() {
-                        final boolean enabled = ((PageResourceWizard) getPageBase()).isCurrentStepComplete();
-//                        System.out.println(dto.getName() + " enabled2 = " + enabled);
-                        return enabled ? null : "color: #FFF;";        // TODO respect color scheme (and find a better style for disabled anyway...)
-                    }
-                }));
+                button.add(AttributeModifier.replace("style", (IModel<String>) () ->
+                        // TODO respect color scheme (and find a better style for disabled anyway...)
+                        ((PageResourceWizard) getPageBase()).isCurrentStepComplete()
+                                ? null : "color: #FFF;"));
 
                 Label label = new Label(ID_LABEL, createLabelModel(dto.getName()));
                 button.add(label);
@@ -103,6 +90,7 @@ public String getObject() {
 
         AjaxLink<Void> help = new AjaxLink<Void>(ID_BUTTON_HELP) {
             private static final long serialVersionUID = 1L;
+
             @Override
             public void onClick(AjaxRequestTarget target) {
                 showHelpPerformed(target);
@@ -114,39 +102,33 @@ public void onClick(AjaxRequestTarget target) {
         initModals();
     }
 
-    private void initModals(){
+    private void initModals() {
         ModalWindow helpWindow = new WizardHelpDialog(ID_HELP_MODAL, getActiveStep());
         add(helpWindow);
     }
 
-    public void updateModal(){
-        WizardHelpDialog window = (WizardHelpDialog)get(ID_HELP_MODAL);
+    public void updateModal() {
+        WizardHelpDialog window = (WizardHelpDialog) get(ID_HELP_MODAL);
 
-        if(window != null && getRequestCycle().find(AjaxRequestTarget.class).isPresent()){
+        if (window != null && getRequestCycle().find(AjaxRequestTarget.class).isPresent()) {
             AjaxRequestTarget target = getRequestCycle().find(AjaxRequestTarget.class).get();
-            window.updateModal(target ,getActiveStep());
+            window.updateModal(target, getActiveStep());
         }
     }
 
     private IModel<String> createLabelModel(final String key) {
-        return new IModel<String>() {
-
-            @Override
-            public String getObject() {
-                return PageBase.createStringResourceStatic(getPage(), key).getString();
-//                return new StringResourceModel(key, getPage(), null, key).getString();
-            }
-        };
+        return (IModel<String>) () -> PageBase.createStringResourceStatic(getPage(), key).getString();
     }
 
-    public void changeStepPerformed(AjaxRequestTarget target, WizardStepDto dto){}
+    public void changeStepPerformed(AjaxRequestTarget target, WizardStepDto dto) {
+    }
 
-    private void showHelpPerformed(AjaxRequestTarget target){
-        WizardHelpDialog window = (WizardHelpDialog)get(ID_HELP_MODAL);
+    private void showHelpPerformed(AjaxRequestTarget target) {
+        WizardHelpDialog window = (WizardHelpDialog) get(ID_HELP_MODAL);
         window.show(target);
     }
 
-    public IWizardStep getActiveStep(){
+    public IWizardStep getActiveStep() {
         return null;
     }
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageDebugList.html b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageDebugList.html
index dd4b938e6c2..b759d78ddfd 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageDebugList.html
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageDebugList.html
@@ -32,8 +32,8 @@
                 </label>
             </div>
         </div>
-        <div class="form-group" style="padding: 0px 5px 0px 20px;">
-            <input wicket:id="oidFilter" style="min-width: 240px;"
+        <div class="form-group" style="padding: 0px 5px 5px 20px;">
+            <input wicket:id="oidFilter" style="min-width: 228px;"
                    wicket:message="placeholder:pageDebugList.oidFilter" class="form-control input-sm" type="text"/>
             <a wicket:id="searchByOidButton" class="btn btn-sm btn-primary">
                 <i class="fa fa-search fa-lg"/>
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java
index bab33e4b73c..ce5e6cdc122 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceTasksPanel.java
@@ -178,7 +178,7 @@ protected List<CompiledObjectCollectionView> getNewObjectInfluencesList() {
             public void onClick(AjaxRequestTarget target) {
                 List<String> oids = createOidList(getTaskListPanel().getSelectedObjects());
                 if (!oids.isEmpty()) {
-                    OperationResult result = TaskOperationUtils.runNowPerformed(pageBase.getTaskService(), oids, pageBase);
+                    OperationResult result = TaskOperationUtils.runNowPerformed(oids, pageBase);
                     pageBase.showResult(result);
                 } else {
                     noTasksSelected();
@@ -193,9 +193,9 @@ public void onClick(AjaxRequestTarget target) {
 
             @Override
             public void onClick(AjaxRequestTarget target) {
-                List<String> oids = createOidList(getTaskListPanel().getSelectedObjects());
-                if (!oids.isEmpty()) {
-                    OperationResult result = TaskOperationUtils.resumePerformed(pageBase.getTaskService(), oids, pageBase);
+                List<TaskType> tasks = getTaskListPanel().getSelectedObjects();
+                if (!tasks.isEmpty()) {
+                    OperationResult result = TaskOperationUtils.resumeTasks(tasks, pageBase);
                     pageBase.showResult(result);
                 } else {
                     noTasksSelected();
@@ -210,9 +210,9 @@ public void onClick(AjaxRequestTarget target) {
 
             @Override
             public void onClick(AjaxRequestTarget target) {
-                List<String> oids = createOidList(getTaskListPanel().getSelectedObjects());
-                if (!oids.isEmpty()) {
-                    OperationResult result = TaskOperationUtils.suspendPerformed(pageBase.getTaskService(), oids, pageBase);
+                List<TaskType> tasks = getTaskListPanel().getSelectedObjects();
+                if (!tasks.isEmpty()) {
+                    OperationResult result = TaskOperationUtils.suspendTasks(tasks, pageBase);
                     pageBase.showResult(result);
                 } else {
                     noTasksSelected();
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/PageTask.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/PageTask.java
index 2b1386b3147..83183617e3d 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/PageTask.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/PageTask.java
@@ -73,6 +73,8 @@
 import com.evolveum.midpoint.web.util.TaskOperationUtils;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
 
+import static java.util.Collections.singletonList;
+
 @PageDescriptor(
         urls = {
                 @Url(mountUrl = "/admin/task", matchUrlForSecurity = "/admin/task")
@@ -184,8 +186,11 @@ private void createSuspendButton(RepeatingView repeatingView) {
         AjaxButton suspend = new AjaxButton(repeatingView.newChildId(), createStringResource("pageTaskEdit.button.suspend")) {
             @Override
             public void onClick(AjaxRequestTarget target) {
-                String taskOid = getObjectWrapper().getOid();
-                OperationResult result = TaskOperationUtils.suspendPerformed(getTaskService(), Collections.singletonList(taskOid), PageTask.this);
+                PrismObject<TaskType> task = getObjectWrapper().getObject();
+                if (task == null) {
+                    return;
+                }
+                OperationResult result = TaskOperationUtils.suspendTasks(singletonList(task.asObjectable()), PageTask.this);
                 afterOperation(target, result);
             }
         };
@@ -198,8 +203,11 @@ private void createResumeButton(RepeatingView repeatingView) {
         AjaxButton resume = new AjaxButton(repeatingView.newChildId(), createStringResource("pageTaskEdit.button.resume")) {
             @Override
             public void onClick(AjaxRequestTarget target) {
-                String oid = getObjectWrapper().getOid();
-                OperationResult result = TaskOperationUtils.resumePerformed(getTaskService(), Collections.singletonList(oid), PageTask.this);
+                PrismObject<TaskType> task = getObjectWrapper().getObject();
+                if (task == null) {
+                    return;
+                }
+                OperationResult result = TaskOperationUtils.resumeTasks(singletonList(task.asObjectable()), PageTask.this);
                 afterOperation(target, result);
             }
         };
@@ -214,7 +222,7 @@ private void createRunNowButton(RepeatingView repeatingView) {
             public void onClick(AjaxRequestTarget target) {
                 String oid = getObjectWrapper().getOid();
                 refreshEnabled = Boolean.TRUE;
-                OperationResult result = TaskOperationUtils.runNowPerformed(getTaskService(), Collections.singletonList(oid), PageTask.this);
+                OperationResult result = TaskOperationUtils.runNowPerformed(singletonList(oid), PageTask.this);
                 afterOperation(target, result);
             }
         };
@@ -719,7 +727,7 @@ private <IW extends ItemWrapper, VW extends PrismValueWrapper> void applyOldPage
                         if (!(val instanceof PrismContainerValueWrapper)) {
                             continue;
                         }
-                        ItemPath lastItemPath = ItemPath.create(Collections.singletonList(((PrismContainerValueWrapper) val).getPath().last()));
+                        ItemPath lastItemPath = ItemPath.create(singletonList(((PrismContainerValueWrapper) val).getPath().last()));
                         PrismContainerValueWrapper oldVal = oldValWrapper.findContainerValue(lastItemPath);
                         applyOldPageContainersState(oldVal, (PrismContainerValueWrapper) val);
                     }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/TaskTablePanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/TaskTablePanel.java
index c539c27a0ae..7903a094bd8 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/TaskTablePanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/server/TaskTablePanel.java
@@ -7,12 +7,14 @@
 package com.evolveum.midpoint.web.page.admin.server;
 
 import java.util.*;
-import java.util.stream.Collectors;
 import javax.xml.datatype.XMLGregorianCalendar;
 
+import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
 import com.evolveum.midpoint.web.component.data.column.AjaxLinkPanel;
 import com.evolveum.midpoint.web.page.admin.server.dto.TaskDtoExecutionStatus;
 
+import com.evolveum.midpoint.web.util.TaskOperationUtils;
+
 import org.apache.commons.collections4.CollectionUtils;
 import org.apache.wicket.Component;
 import org.apache.wicket.ajax.AjaxRequestTarget;
@@ -699,36 +701,17 @@ public IModel<Boolean> getVisible() {
     }
 
     //region Task-level actions
-    //TODO unify with TaskOperationUtils
     private void suspendTasksPerformed(AjaxRequestTarget target, IModel<SelectableBean<TaskType>> selectedTask) {
         List<TaskType> selectedTasks = getSelectedTasks(target, selectedTask);
         if (selectedTasks == null) {
             return;
         }
-        Task opTask = createSimpleTask(OPERATION_SUSPEND_TASKS);
-        OperationResult result = opTask.getResult();
-        try {
-            List<TaskType> plainTasks = selectedTasks.stream().filter(dto -> !isManageableTreeRoot(dto)).collect(Collectors.toList());
-            List<TaskType> trees = selectedTasks.stream().filter(TaskTablePanel::isManageableTreeRoot).collect(Collectors.toList());
-            boolean suspendedPlain = suspendPlainTasks(plainTasks, result, opTask);
-            boolean suspendedTrees = suspendTrees(trees, result, opTask);
-            result.computeStatus();
-            if (result.isSuccess()) {
-                if (suspendedPlain && suspendedTrees) {
-                    result.recordStatus(OperationResultStatus.SUCCESS, createStringResource("pageTasks.message.suspendTasksPerformed.success").getString());
-                } else {
-                    result.recordWarning(createStringResource("pageTasks.message.suspendTasksPerformed.warning").getString());
-                }
-            }
-        } catch (ObjectNotFoundException | SchemaException | SecurityViolationException | ExpressionEvaluationException | RuntimeException | CommunicationException | ConfigurationException e) {
-            result.recordFatalError(createStringResource("pageTasks.message.suspendTasksPerformed.fatalError").getString(), e);
-        }
+        OperationResult result = TaskOperationUtils.suspendTasks(selectedTasks, getPageBase());
         showResult(result);
 
         //refresh feedback and table
         refreshTable(TaskType.class, target);
         clearCache();
-
     }
 
     private void resumeTasksPerformed(AjaxRequestTarget target, IModel<SelectableBean<TaskType>> selectedTask) {
@@ -736,22 +719,7 @@ private void resumeTasksPerformed(AjaxRequestTarget target, IModel<SelectableBea
         if (selectedTasks == null) {
             return;
         }
-        Task opTask = createSimpleTask(OPERATION_RESUME_TASKS);
-        OperationResult result = opTask.getResult();
-        try {
-            List<TaskType> plainTasks = selectedTasks.stream().filter(dto -> !isManageableTreeRoot(dto)).collect(Collectors.toList());
-            List<TaskType> trees = selectedTasks.stream().filter(TaskTablePanel::isManageableTreeRoot).collect(Collectors.toList());
-            getTaskService().resumeTasks(getOids(plainTasks), opTask, result);
-            for (TaskType tree : trees) {
-                getTaskService().resumeTaskTree(tree.getOid(), opTask, result);
-            }
-            result.computeStatus();
-            if (result.isSuccess()) {
-                result.recordStatus(OperationResultStatus.SUCCESS, createStringResource("pageTasks.message.resumeTasksPerformed.success").getString());
-            }
-        } catch (ObjectNotFoundException | SchemaException | SecurityViolationException | ExpressionEvaluationException | RuntimeException | CommunicationException | ConfigurationException e) {
-            result.recordFatalError(createStringResource("pageTasks.message.resumeTasksPerformed.fatalError").getString(), e);
-        }
+        OperationResult result = TaskOperationUtils.resumeTasks(selectedTasks, getPageBase());
         showResult(result);
 
         //refresh feedback and table
@@ -760,29 +728,6 @@ private void resumeTasksPerformed(AjaxRequestTarget target, IModel<SelectableBea
 
     }
 
-    private boolean suspendPlainTasks(List<TaskType> plainTasks, OperationResult result, Task opTask)
-            throws SecurityViolationException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException,
-            CommunicationException, ConfigurationException {
-        if (!plainTasks.isEmpty()) {
-            return getTaskService().suspendTasks(getOids(plainTasks), PageTasks.WAIT_FOR_TASK_STOP, opTask, result);
-        } else {
-            return true;
-        }
-    }
-
-    private boolean suspendTrees(List<TaskType> roots, OperationResult result, Task opTask)
-            throws SecurityViolationException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException,
-            CommunicationException, ConfigurationException {
-        boolean suspended = true;
-        if (!roots.isEmpty()) {
-            for (TaskType root : roots) {
-                boolean s = getTaskService().suspendTaskTree(root.getOid(), PageTasks.WAIT_FOR_TASK_STOP, opTask, result);
-                suspended = suspended && s;
-            }
-        }
-        return suspended;
-    }
-
     private List<TaskType> getSelectedTasks(AjaxRequestTarget target, IModel<SelectableBean<TaskType>> selectedTask) {
         List<TaskType> selectedTasks = new ArrayList<>();
         if (selectedTask != null) {
@@ -797,7 +742,6 @@ private List<TaskType> getSelectedTasks(AjaxRequestTarget target, IModel<Selecta
         }
 
         return selectedTasks;
-
     }
 
     private void scheduleTasksPerformed(AjaxRequestTarget target, IModel<SelectableBean<TaskType>> selectedTask) {
@@ -809,7 +753,7 @@ private void scheduleTasksPerformed(AjaxRequestTarget target, IModel<SelectableB
         Task opTask = createSimpleTask(OPERATION_SCHEDULE_TASKS);
         OperationResult result = opTask.getResult();
         try {
-            getTaskService().scheduleTasksNow(getOids(selectedTasks), opTask, result);
+            getTaskService().scheduleTasksNow(ObjectTypeUtil.getOids(selectedTasks), opTask, result);
             result.computeStatus();
             if (result.isSuccess()) {
                 result.recordStatus(OperationResultStatus.SUCCESS, createStringResource("pageTasks.message.scheduleTasksPerformed.success").getString());
@@ -834,7 +778,7 @@ private void deleteTaskConfirmedPerformed(AjaxRequestTarget target, IModel<Selec
         Task opTask = createSimpleTask(OPERATION_DELETE_TASKS);
         OperationResult result = opTask.getResult();
         try {
-            getTaskService().suspendAndDeleteTasks(getOids(selectedTasks), WAIT_FOR_TASK_STOP, true, opTask, result);
+            getTaskService().suspendAndDeleteTasks(ObjectTypeUtil.getOids(selectedTasks), WAIT_FOR_TASK_STOP, true, opTask, result);
             result.computeStatus();
             if (result.isSuccess()) {
                 result.recordStatus(OperationResultStatus.SUCCESS,
@@ -993,7 +937,7 @@ private IModel<String> getTaskConfirmationMessageModel(ColumnMenuAction<Selectab
     // must be static, otherwise JVM crashes (probably because of some wicket serialization issues)
     @SuppressWarnings("unchecked")
     private static boolean isCoordinator(IModel<?> rowModel, boolean isHeader) {
-        if (isNotTaskModel(rowModel)) {
+        if (!isTaskModel(rowModel)) {
             return false;
         }
         TaskType task = getTask((IModel<SelectableBean<TaskType>>) rowModel, isHeader);
@@ -1003,22 +947,16 @@ private static boolean isCoordinator(IModel<?> rowModel, boolean isHeader) {
     // must be static, otherwise JVM crashes (probably because of some wicket serialization issues)
     @SuppressWarnings("unchecked")
     private static boolean isManageableTreeRoot(IModel<?> rowModel, boolean isHeader) {
-        if (isNotTaskModel(rowModel)) {
+        if (!isTaskModel(rowModel)) {
             return false;
         }
         TaskType task = getTask((IModel<SelectableBean<TaskType>>) rowModel, isHeader);
-        return task != null && isManageableTreeRoot(task);
-    }
-
-    private static boolean isNotTaskModel(IModel<?> rowModel) {
-        if (rowModel == null) {
-            return false;
-        }
-        return rowModel.getObject() instanceof SelectableBean;
+        return task != null && TaskTypeUtil.isManageableTreeRoot(task);
     }
 
-    private static boolean isManageableTreeRoot(TaskType taskType) {
-        return TaskTypeUtil.isCoordinator(taskType) || TaskTypeUtil.isPartitionedMaster(taskType);
+    @SuppressWarnings("BooleanMethodIsAlwaysInverted")
+    private static boolean isTaskModel(IModel<?> rowModel) {
+        return rowModel != null && rowModel.getObject() instanceof SelectableBean;
     }
 
     private static TaskType getTask(IModel<SelectableBean<TaskType>> rowModel, boolean isHeader) {
@@ -1033,11 +971,4 @@ private static TaskType getTask(IModel<SelectableBean<TaskType>> rowModel, boole
         return null;
     }
 
-    public static List<String> getOids(List<TaskType> taskDtoList) {
-        List<String> retval = new ArrayList<>();
-        for (TaskType taskDto : taskDtoList) {
-            retval.add(taskDto.getOid());
-        }
-        return retval;
-    }
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAnonymousAuthenticationFilter.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAnonymousAuthenticationFilter.java
index dab9b371bc8..e7ec1740244 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAnonymousAuthenticationFilter.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAnonymousAuthenticationFilter.java
@@ -1,45 +1,45 @@
 /*
- * Copyright (c) 2010-2019 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
  */
 package com.evolveum.midpoint.web.security.filter;
 
+import static com.evolveum.midpoint.schema.util.SecurityPolicyUtil.NO_CUSTOM_IGNORED_LOCAL_PATH;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.List;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.authentication.AuthenticationDetailsSource;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
+import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
+import org.springframework.util.Assert;
+
 import com.evolveum.midpoint.model.api.authentication.AuthModule;
 import com.evolveum.midpoint.model.api.authentication.AuthenticationChannel;
-import com.evolveum.midpoint.prism.PrismContainer;
+import com.evolveum.midpoint.model.api.authentication.MidpointAuthentication;
+import com.evolveum.midpoint.model.api.authentication.ModuleAuthentication;
 import com.evolveum.midpoint.prism.PrismContext;
-import com.evolveum.midpoint.prism.schema.SchemaRegistry;
 import com.evolveum.midpoint.schema.util.SecurityPolicyUtil;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
-import com.evolveum.midpoint.model.api.authentication.MidpointAuthentication;
-import com.evolveum.midpoint.model.api.authentication.ModuleAuthentication;
 import com.evolveum.midpoint.web.security.factory.channel.AuthChannelRegistryImpl;
 import com.evolveum.midpoint.web.security.factory.module.AuthModuleRegistryImpl;
 import com.evolveum.midpoint.web.security.util.SecurityUtils;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AuthenticationSequenceType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AuthenticationsPolicyType;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.authentication.AnonymousAuthenticationToken;
-import org.springframework.security.authentication.AuthenticationDetailsSource;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
-import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
-import org.springframework.util.Assert;
-
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.List;
 
 /**
  * @author skublik
@@ -49,17 +49,16 @@ public class MidpointAnonymousAuthenticationFilter extends AnonymousAuthenticati
 
     private static final Trace LOGGER = TraceManager.getTrace(MidpointAnonymousAuthenticationFilter.class);
 
-    private AuthModuleRegistryImpl authRegistry;
-
-    private AuthChannelRegistryImpl authChannelRegistry;
-
-    private PrismContext prismContext;
+    private final AuthModuleRegistryImpl authRegistry;
+    private final AuthChannelRegistryImpl authChannelRegistry;
+    private final PrismContext prismContext;
+    private final String key;
 
     private AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();
-    private String key;
 
-    public MidpointAnonymousAuthenticationFilter(AuthModuleRegistryImpl authRegistry, AuthChannelRegistryImpl authChannelRegistry, PrismContext prismContext,
-                                                 String key, Object principal, List<GrantedAuthority> authorities) {
+    public MidpointAnonymousAuthenticationFilter(AuthModuleRegistryImpl authRegistry,
+            AuthChannelRegistryImpl authChannelRegistry, PrismContext prismContext,
+            String key, Object principal, List<GrantedAuthority> authorities) {
         super(key, principal, authorities);
         this.key = key;
         this.authRegistry = authRegistry;
@@ -78,8 +77,7 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
                 LOGGER.debug("Populated SecurityContextHolder with anonymous token: '"
                         + SecurityContextHolder.getContext().getAuthentication() + "'");
             }
-        }
-        else {
+        } else {
             if (SecurityContextHolder.getContext().getAuthentication() instanceof MidpointAuthentication) {
                 MidpointAuthentication mpAuthentication = (MidpointAuthentication) SecurityContextHolder.getContext().getAuthentication();
                 ModuleAuthentication moduleAuthentication = mpAuthentication.getProcessingModuleAuthentication();
@@ -102,17 +100,19 @@ protected Authentication createAuthentication(HttpServletRequest request) {
         Authentication auth = createBasicAuthentication(request);
 
         MidpointAuthentication authentication = new MidpointAuthentication(SecurityPolicyUtil.createDefaultSequence());
-        AuthenticationsPolicyType authenticationsPolicy = null;
+        AuthenticationsPolicyType authenticationsPolicy;
         try {
-            authenticationsPolicy = SecurityPolicyUtil.createDefaultAuthenticationPolicy(prismContext.getSchemaRegistry());
+            authenticationsPolicy = SecurityPolicyUtil.createDefaultAuthenticationPolicy(
+                    NO_CUSTOM_IGNORED_LOCAL_PATH, prismContext.getSchemaRegistry());
         } catch (SchemaException e) {
             LOGGER.error("Couldn't get default authentication policy");
             throw new IllegalArgumentException("Couldn't get default authentication policy", e);
         }
         AuthenticationSequenceType sequence = SecurityPolicyUtil.createDefaultSequence();
         AuthenticationChannel authenticationChannel = SecurityUtils.buildAuthChannel(authChannelRegistry, sequence);
-        List<AuthModule> authModules = SecurityUtils.buildModuleFilters(authRegistry, sequence, request, authenticationsPolicy.getModules(),
-                null, new HashMap<Class<? extends Object>, Object>(), authenticationChannel);
+        List<AuthModule> authModules = SecurityUtils.buildModuleFilters(
+                authRegistry, sequence, request, authenticationsPolicy.getModules(),
+                null, new HashMap<>(), authenticationChannel);
         authentication.setAuthModules(authModules);
         ModuleAuthentication module = authModules.get(0).getBaseModuleAuthentication();
         module.setAuthentication(auth);
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAuthFilter.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAuthFilter.java
index 0be451aaf02..110eba28c76 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAuthFilter.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/security/filter/MidpointAuthFilter.java
@@ -6,6 +6,8 @@
  */
 package com.evolveum.midpoint.web.security.filter;
 
+import static com.evolveum.midpoint.schema.util.SecurityPolicyUtil.NO_CUSTOM_IGNORED_LOCAL_PATH;
+
 import java.io.IOException;
 import java.util.List;
 import java.util.Map;
@@ -55,7 +57,7 @@ public class MidpointAuthFilter extends GenericFilterBean {
     @Autowired private PrismContext prismContext;
     @Autowired private TaskManager taskManager;
 
-    private AuthenticationsPolicyType authenticationPolicy;
+    private volatile AuthenticationsPolicyType defaultAuthenticationPolicy;
 
     private final PreLogoutFilter preLogoutFilter = new PreLogoutFilter();
 
@@ -73,11 +75,23 @@ public void createFilterForAuthenticatedRequest() {
         module.setObjectPostProcessor(objectObjectPostProcessor);
     }
 
-    public AuthenticationsPolicyType getDefaultAuthenticationPolicy() throws SchemaException {
-        if (authenticationPolicy == null) {
-            authenticationPolicy = SecurityPolicyUtil.createDefaultAuthenticationPolicy(prismContext.getSchemaRegistry());
+    /**
+     * Creates default authentication policy because the configured one is empty.
+     * Either <b>authentication</b> element is missing, or it has no <b>sequence</b> elements.
+     * However, if there are some <b>ignoreLocalPath</b> elements defined (not null or empty),
+     * they override the default ignored paths.
+     * <p>
+     * The default policy is cached for this filter, if there are changes affecting the default
+     * policy (e.g. only changes to <b>ignoreLocalPath</b> without any <b>sequence</b> elements),
+     * midPoint must be restarted.
+     */
+    private AuthenticationsPolicyType getDefaultAuthenticationPolicy(
+            List<String> customIgnoredLocalPaths) throws SchemaException {
+        if (defaultAuthenticationPolicy == null) {
+            defaultAuthenticationPolicy = SecurityPolicyUtil.createDefaultAuthenticationPolicy(
+                    customIgnoredLocalPaths, prismContext.getSchemaRegistry());
         }
-        return authenticationPolicy;
+        return defaultAuthenticationPolicy;
     }
 
     @Override
@@ -110,7 +124,7 @@ private void doFilterInternal(ServletRequest request, ServletResponse response,
         } catch (SchemaException e) {
             LOGGER.error("Couldn't load Authentication policy", e);
             try {
-                authenticationsPolicy = getDefaultAuthenticationPolicy();
+                authenticationsPolicy = getDefaultAuthenticationPolicy(NO_CUSTOM_IGNORED_LOCAL_PATH);
             } catch (SchemaException schemaException) {
                 LOGGER.error("Couldn't get default authentication policy");
                 throw new IllegalArgumentException("Couldn't get default authentication policy", e);
@@ -123,9 +137,11 @@ private void doFilterInternal(ServletRequest request, ServletResponse response,
             return;
         }
 
-        AuthenticationSequenceType sequence = getAuthenticationSequence(mpAuthentication, httpRequest, authenticationsPolicy);
+        AuthenticationSequenceType sequence =
+                getAuthenticationSequence(mpAuthentication, httpRequest, authenticationsPolicy);
         if (sequence == null) {
-            throw new IllegalArgumentException("Couldn't find sequence for URI '" + httpRequest.getRequestURI() + "' in authentication of Security Policy with oid " + securityPolicy.getOid());
+            throw new IllegalArgumentException("Couldn't find sequence for URI '" + httpRequest.getRequestURI()
+                    + "' in authentication of Security Policy with oid " + securityPolicy.getOid());
         }
 
         //change generic logout path to logout path for actual module
@@ -171,7 +187,8 @@ private void doFilterInternal(ServletRequest request, ServletResponse response,
             mpAuthentication.setAuthenticationChannel(authenticationChannel);
         }
 
-        MidpointAuthFilter.VirtualFilterChain vfc = new MidpointAuthFilter.VirtualFilterChain(chain, authModules.get(indexOfProcessingModule).getSecurityFilterChain().getFilters());
+        MidpointAuthFilter.VirtualFilterChain vfc = new MidpointAuthFilter.VirtualFilterChain(
+                chain, authModules.get(indexOfProcessingModule).getSecurityFilterChain().getFilters());
         vfc.doFilter(httpRequest, response);
     }
 
@@ -229,7 +246,8 @@ private List<AuthModule> createAuthenticationModuleBySequence(MidpointAuthentica
         if (mpAuthentication == null || !sequence.equals(mpAuthentication.getSequence())) {
             SecurityContextHolder.getContext().setAuthentication(null);
             authenticationManager.getProviders().clear();
-            authModules = SecurityUtils.buildModuleFilters(authModuleRegistry, sequence, httpRequest, modules,
+            authModules = SecurityUtils.buildModuleFilters(
+                    authModuleRegistry, sequence, httpRequest, modules,
                     credentialsPolicy, sharedObjects, authenticationChannel);
         } else {
             authModules = mpAuthentication.getAuthModules();
@@ -262,17 +280,20 @@ private AuthenticationSequenceType getAuthenticationSequence(MidpointAuthenticat
         return sequence;
     }
 
-    private AuthenticationsPolicyType getAuthenticationPolicy(PrismObject<SecurityPolicyType> authPolicy) throws SchemaException {
-        //security policy without authentication
-        AuthenticationsPolicyType authenticationsPolicy;
-        if (authPolicy == null || authPolicy.asObjectable().getAuthentication() == null
-                || authPolicy.asObjectable().getAuthentication().getSequence() == null
-                || authPolicy.asObjectable().getAuthentication().getSequence().isEmpty()) {
-            authenticationsPolicy = getDefaultAuthenticationPolicy();
+    private AuthenticationsPolicyType getAuthenticationPolicy(
+            PrismObject<SecurityPolicyType> securityPolicy) throws SchemaException {
+
+        if (securityPolicy == null || securityPolicy.asObjectable().getAuthentication() == null) {
+            // there is no <authentication> element, we want default without any changes
+            return getDefaultAuthenticationPolicy(NO_CUSTOM_IGNORED_LOCAL_PATH);
+        } else if (securityPolicy.asObjectable().getAuthentication().getSequence() == null
+                || securityPolicy.asObjectable().getAuthentication().getSequence().isEmpty()) {
+            // in this case we want to honour eventual <ignoreLocalPath> elements
+            return getDefaultAuthenticationPolicy(
+                    securityPolicy.asObjectable().getAuthentication().getIgnoredLocalPath());
         } else {
-            authenticationsPolicy = authPolicy.asObjectable().getAuthentication();
+            return securityPolicy.asObjectable().getAuthentication();
         }
-        return authenticationsPolicy;
     }
 
     private PrismObject<SecurityPolicyType> getSecurityPolicy() throws SchemaException {
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/util/TaskOperationUtils.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/util/TaskOperationUtils.java
index 9ccef1f7f18..738c805d04d 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/util/TaskOperationUtils.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/util/TaskOperationUtils.java
@@ -6,13 +6,15 @@
  */
 package com.evolveum.midpoint.web.util;
 
-import java.util.Collection;
 import java.util.List;
+import java.util.stream.Collectors;
 
 import com.evolveum.midpoint.gui.api.page.PageBase;
 import com.evolveum.midpoint.model.api.TaskService;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.schema.result.OperationResultStatus;
+import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
+import com.evolveum.midpoint.schema.util.TaskTypeUtil;
 import com.evolveum.midpoint.task.api.Task;
 import com.evolveum.midpoint.util.exception.CommunicationException;
 import com.evolveum.midpoint.util.exception.ConfigurationException;
@@ -21,57 +23,114 @@
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.exception.SecurityViolationException;
 import com.evolveum.midpoint.web.page.admin.server.PageTasks;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.TaskType;
+
+import org.jetbrains.annotations.NotNull;
 
 public class TaskOperationUtils {
 
     private static final String DOT_CLASS = TaskOperationUtils.class.getName() + ".";
-    private static final String OPERATION_SUSPEND_TASKS = DOT_CLASS + "suspendTask";
-    private static final String OPERATION_RESUME_TASK = DOT_CLASS + "resumeTask";
-    private static final String OPERATION_RUN_NOW_TASK = DOT_CLASS + "runNowTask";
+    private static final String OPERATION_SUSPEND_TASKS = DOT_CLASS + "suspendTasks";
+    private static final String OPERATION_RESUME_TASKS = DOT_CLASS + "resumeTasks";
+    private static final String OPERATION_RUN_NOW_TASKS = DOT_CLASS + "runNowTasks";
 
-    public static OperationResult suspendPerformed(TaskService taskService, Collection<String> oids, PageBase pageBase) {
-        Task opTask = pageBase.createSimpleTask(OPERATION_SUSPEND_TASKS);
+    /**
+     * Suspends tasks "intelligently" i.e. tries to recognize whether to suspend a single task,
+     * or to suspend the whole tree. (Maybe this differentiation should be done by the task manager itself.)
+     *
+     * It is also questionable whether we should create the task here or it should be done by the caller.
+     * For the time being it is done here.
+     */
+    public static OperationResult suspendTasks(List<TaskType> selectedTasks, PageBase pageBase) {
+        Task opTask = pageBase.createSimpleTask(TaskOperationUtils.OPERATION_SUSPEND_TASKS);
         OperationResult result = opTask.getResult();
+
         try {
-            boolean suspended = taskService.suspendTasks(oids,
-                    PageTasks.WAIT_FOR_TASK_STOP, opTask, result);
+            TaskService taskService = pageBase.getTaskService();
+
+            List<TaskType> plainTasks = getPlainTasks(selectedTasks);
+            List<TaskType> treeRoots = getTreeRoots(selectedTasks);
+            boolean allPlainTasksSuspended = suspendPlainTasks(taskService, plainTasks, result, opTask);
+            boolean allTreesSuspended = suspendTrees(taskService, treeRoots, result, opTask);
 
             result.computeStatus();
             if (result.isSuccess()) {
-                if (suspended) {
-                    result.recordStatus(OperationResultStatus.SUCCESS, pageBase.createStringResource("TaskOperationUtils.message.suspendPerformed.success").getString());
+                if (allPlainTasksSuspended && allTreesSuspended) {
+                    result.recordStatus(OperationResultStatus.SUCCESS,
+                            pageBase.createStringResource("TaskOperationUtils.message.suspendPerformed.success").getString());
                 } else {
                     result.recordWarning(pageBase.createStringResource("TaskOperationUtils.message.suspendPerformed.warning").getString());
                 }
             }
-        } catch (ObjectNotFoundException | SchemaException | SecurityViolationException | ExpressionEvaluationException | RuntimeException | CommunicationException | ConfigurationException e) {
-            result.recordFatalError(pageBase.createStringResource("TaskOperationUtils.message.suspendPerformed.fatalError").getString(), e);
+        } catch (Throwable t) {
+            result.recordFatalError(pageBase.createStringResource("pageTasks.message.suspendTasksPerformed.fatalError").getString(), t);
         }
 
         return result;
+    }
 
+    private static boolean suspendPlainTasks(TaskService taskService, List<TaskType> plainTasks, OperationResult result, Task opTask)
+            throws SecurityViolationException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException,
+            CommunicationException, ConfigurationException {
+        //noinspection SimplifiableIfStatement
+        if (!plainTasks.isEmpty()) {
+            return taskService.suspendTasks(ObjectTypeUtil.getOids(plainTasks), PageTasks.WAIT_FOR_TASK_STOP, opTask, result);
+        } else {
+            return true;
+        }
+    }
+
+    private static boolean suspendTrees(TaskService taskService, List<TaskType> roots, OperationResult result, Task opTask)
+            throws SecurityViolationException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException,
+            CommunicationException, ConfigurationException {
+        boolean suspended = true;
+        if (!roots.isEmpty()) {
+            for (TaskType root : roots) {
+                boolean s = taskService.suspendTaskTree(root.getOid(), PageTasks.WAIT_FOR_TASK_STOP, opTask, result);
+                suspended = suspended && s;
+            }
+        }
+        return suspended;
     }
 
-    public static OperationResult resumePerformed(TaskService taskService, List<String> oids, PageBase pageBase) {
-        Task opTask = pageBase.createSimpleTask(OPERATION_RESUME_TASK);
+    /**
+     * Resumes tasks "intelligently" i.e. tries to recognize whether to resume a single task,
+     * or to resume the whole tree. See {@link #suspendTasks(List, PageBase)}.
+     */
+    public static OperationResult resumeTasks(List<TaskType> selectedTasks, PageBase pageBase) {
+        Task opTask = pageBase.createSimpleTask(OPERATION_RESUME_TASKS);
         OperationResult result = opTask.getResult();
+
         try {
-            taskService.resumeTasks(oids, opTask, result);
-            result.computeStatus();
+            TaskService taskService = pageBase.getTaskService();
 
+            List<TaskType> plainTasks = getPlainTasks(selectedTasks);
+            List<TaskType> treeRoots = getTreeRoots(selectedTasks);
+            taskService.resumeTasks(ObjectTypeUtil.getOids(plainTasks), opTask, result);
+            for (TaskType treeRoot : treeRoots) {
+                taskService.resumeTaskTree(treeRoot.getOid(), opTask, result);
+            }
+            result.computeStatus();
             if (result.isSuccess()) {
-                result.recordStatus(OperationResultStatus.SUCCESS, pageBase.createStringResource("TaskOperationUtils.message.resumePerformed.success").getString());
+                result.recordStatus(OperationResultStatus.SUCCESS,
+                        pageBase.createStringResource("TaskOperationUtils.message.resumePerformed.success").getString());
             }
-        } catch (ObjectNotFoundException | SchemaException | SecurityViolationException | ExpressionEvaluationException | RuntimeException | CommunicationException | ConfigurationException e) {
-            result.recordFatalError(pageBase.createStringResource("TaskOperationUtils.message.resumePerformed.fatalError").getString(), e);
+        } catch (Throwable t) {
+            result.recordFatalError(pageBase.createStringResource("TaskOperationUtils.message.resumePerformed.fatalError").getString(), t);
         }
-
         return result;
     }
 
-    public static OperationResult runNowPerformed(TaskService taskService, List<String> oids, PageBase pageBase) {
-        Task opTask = pageBase.createSimpleTask(OPERATION_RUN_NOW_TASK);
+    /**
+     * Schedules the tasks for immediate execution.
+     *
+     * TODO should we distinguish between plain task and task tree roots here?
+     */
+    public static OperationResult runNowPerformed(List<String> oids, PageBase pageBase) {
+        Task opTask = pageBase.createSimpleTask(OPERATION_RUN_NOW_TASKS);
         OperationResult result = opTask.getResult();
+        TaskService taskService = pageBase.getTaskService();
+
         try {
             taskService.scheduleTasksNow(oids, opTask, result);
             result.computeStatus();
@@ -86,4 +145,17 @@ public static OperationResult runNowPerformed(TaskService taskService, List<Stri
         return result;
     }
 
+    @NotNull
+    private static List<TaskType> getPlainTasks(List<TaskType> selectedTasks) {
+        return selectedTasks.stream()
+                .filter(task -> !TaskTypeUtil.isManageableTreeRoot(task))
+                .collect(Collectors.toList());
+    }
+
+    @NotNull
+    private static List<TaskType> getTreeRoots(List<TaskType> selectedTasks) {
+        return selectedTasks.stream()
+                .filter(TaskTypeUtil::isManageableTreeRoot)
+                .collect(Collectors.toList());
+    }
 }
diff --git a/gui/admin-gui/src/main/resources/static/less/midpoint-theme.less b/gui/admin-gui/src/main/resources/static/less/midpoint-theme.less
index 28e9c8b8c11..212ae9568b3 100644
--- a/gui/admin-gui/src/main/resources/static/less/midpoint-theme.less
+++ b/gui/admin-gui/src/main/resources/static/less/midpoint-theme.less
@@ -1661,7 +1661,7 @@ th.composited-icon {
 
 .search-item {
   display: inline-block;
-  min-width: 270px;
+  //min-width: 270px;
   border-color: #ddd;
   border-radius: 3px;
   background-color: #f4f4f4;
diff --git a/infra/common/src/main/java/com/evolveum/midpoint/common/validator/LegacyValidator.java b/infra/common/src/main/java/com/evolveum/midpoint/common/validator/LegacyValidator.java
index 7bbab8b40f3..82996b2fb95 100644
--- a/infra/common/src/main/java/com/evolveum/midpoint/common/validator/LegacyValidator.java
+++ b/infra/common/src/main/java/com/evolveum/midpoint/common/validator/LegacyValidator.java
@@ -420,10 +420,9 @@ private EventResult validateObjectInternal(Element objectElement, OperationResul
             objectResult.recomputeStatus();
 
             return EventResult.cont();
-
         } catch (SchemaException ex) {
             if (verbose) {
-                ex.printStackTrace();
+                LOGGER.trace("Schema exception", ex);
             }
             if (handler != null) {
                 try {
@@ -439,7 +438,7 @@ private EventResult validateObjectInternal(Element objectElement, OperationResul
         } catch (RuntimeException ex) {
             validatorResult.recordFatalError("Couldn't parse object: " + ex.getMessage(), ex);
             if (verbose) {
-                ex.printStackTrace();
+                LOGGER.trace("Couldn't parse object", ex);
             }
             if (handler != null) {
                 try {
@@ -453,7 +452,6 @@ private EventResult validateObjectInternal(Element objectElement, OperationResul
             objectResult.recordFatalError(ex);
             return EventResult.skipObject(ex.getMessage());
         }
-
     }
 
     // this was made public to allow validation of pre-parsed non-prism documents
@@ -543,11 +541,6 @@ private void checkUri(Objectable object, String value, String propertyName, Oper
 
     }
 
-    void error(String message, Objectable object, OperationResult subResult) {
-        subResult.addContext(OperationResult.CONTEXT_OBJECT, object.toString());
-        subResult.recordFatalError(message);
-    }
-
     private void error(String message, Objectable object, String propertyName, OperationResult subResult) {
         subResult.addContext(OperationResult.CONTEXT_OBJECT, object.toString());
         subResult.addContext(OperationResult.CONTEXT_ITEM, propertyName);
diff --git a/infra/common/src/main/resources/ctx-common.xml b/infra/common/src/main/resources/ctx-common.xml
index 8a69a17c277..9b91004bfc6 100644
--- a/infra/common/src/main/resources/ctx-common.xml
+++ b/infra/common/src/main/resources/ctx-common.xml
@@ -44,6 +44,10 @@
         <property name="midpointConfiguration" ref="midpointConfiguration"/>
     </bean>
 
+    <!--
+    JAX-RS based, used by CXF for client side of the services (in test and also for cluster).
+    JAX-RS/CXF was replaced on server/service side in 4.2 and client code will be fixed later too.
+    -->
     <bean id="jaxbProvider" class="com.evolveum.midpoint.common.rest.MidpointXmlProvider"/>
     <bean id="yamlProvider" class="com.evolveum.midpoint.common.rest.MidpointYamlProvider"/>
     <bean id="jsonProvider" class="com.evolveum.midpoint.common.rest.MidpointJsonProvider"/>
diff --git a/infra/prism-api/src/main/java/com/evolveum/midpoint/prism/util/PrismAsserts.java b/infra/prism-api/src/main/java/com/evolveum/midpoint/prism/util/PrismAsserts.java
index a98d804f089..f63018d72e3 100644
--- a/infra/prism-api/src/main/java/com/evolveum/midpoint/prism/util/PrismAsserts.java
+++ b/infra/prism-api/src/main/java/com/evolveum/midpoint/prism/util/PrismAsserts.java
@@ -1185,9 +1185,6 @@ public static void assertPathEqualsExceptForPrefixes(String message, ItemPath ex
                 assertEquals(message + ": wrong NS in path segment #" + (i+1), qnameExpected.getNamespaceURI(), qnameActual.getNamespaceURI());
                 assertEquals(message + ": wrong local part in path segment #" + (i+1), qnameExpected.getLocalPart(), qnameActual.getLocalPart());
             } else {
-                if (!ItemPath.segmentsEquivalent(expectedSegment, actualSegment)) {
-                    System.out.println("hi");
-                }
                 assertTrue(message + ": wrong path segment #" + (i+1) + ": exp=" + expectedSegment + ", act=" + actualSegment, ItemPath.segmentsEquivalent(expectedSegment, actualSegment));
             }
         }
diff --git a/infra/prism-impl/src/main/java/com/evolveum/midpoint/prism/impl/PrismContainerValueImpl.java b/infra/prism-impl/src/main/java/com/evolveum/midpoint/prism/impl/PrismContainerValueImpl.java
index fa24ba53eea..119b3382390 100644
--- a/infra/prism-impl/src/main/java/com/evolveum/midpoint/prism/impl/PrismContainerValueImpl.java
+++ b/infra/prism-impl/src/main/java/com/evolveum/midpoint/prism/impl/PrismContainerValueImpl.java
@@ -1,54 +1,55 @@
 /*
- * Copyright (c) 2010-2020 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
  */
 package com.evolveum.midpoint.prism.impl;
 
+import static java.util.Collections.emptySet;
+import static java.util.Collections.singleton;
+
+import java.lang.reflect.Modifier;
+import java.util.*;
+import java.util.function.Consumer;
+import java.util.stream.Collectors;
+import javax.xml.namespace.QName;
+
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang.Validate;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
 import com.evolveum.midpoint.prism.*;
 import com.evolveum.midpoint.prism.delta.ItemDelta;
-import com.evolveum.midpoint.prism.equivalence.ParameterizedEquivalenceStrategy;
 import com.evolveum.midpoint.prism.equivalence.EquivalenceStrategy;
+import com.evolveum.midpoint.prism.equivalence.ParameterizedEquivalenceStrategy;
 import com.evolveum.midpoint.prism.impl.xnode.RootXNodeImpl;
 import com.evolveum.midpoint.prism.marshaller.JaxbDomHack;
-import com.evolveum.midpoint.prism.path.*;
+import com.evolveum.midpoint.prism.path.ItemName;
+import com.evolveum.midpoint.prism.path.ItemPath;
+import com.evolveum.midpoint.prism.path.ItemPathCollectionsUtil;
 import com.evolveum.midpoint.prism.xnode.XNode;
-import com.evolveum.midpoint.util.*;
+import com.evolveum.midpoint.util.DebugUtil;
+import com.evolveum.midpoint.util.MiscUtil;
+import com.evolveum.midpoint.util.PrettyPrinter;
+import com.evolveum.midpoint.util.QNameUtil;
 import com.evolveum.midpoint.util.annotation.Experimental;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.exception.SystemException;
-import com.evolveum.midpoint.util.logging.Trace;
-import com.evolveum.midpoint.util.logging.TraceManager;
-import org.apache.commons.collections4.CollectionUtils;
-import org.apache.commons.lang.StringUtils;
-import org.apache.commons.lang.Validate;
-import org.jetbrains.annotations.NotNull;
-import org.jetbrains.annotations.Nullable;
-
-import javax.xml.namespace.QName;
-import java.lang.reflect.Modifier;
-import java.util.*;
-import java.util.function.Consumer;
-import java.util.stream.Collectors;
-
-import static java.util.Collections.emptySet;
-import static java.util.Collections.singleton;
 
 /**
  * @author semancik
- *
  */
 public class PrismContainerValueImpl<C extends Containerable> extends PrismValueImpl implements PrismContainerValue<C> {
 
-    private static final Trace LOGGER = TraceManager.getTrace(PrismContainerValueImpl.class);
-
     // We use linked map because we need to maintain the order internally to provide consistent
     // output in DOM and other ordering-sensitive representations.
     // The QNames here should be qualified if at all possible. Unqualified names are kept here nevertheless
     // (in order to maintain the ordering) but they are maintained in a separate set to know they require a separate
     // handling.
-    protected final LinkedHashMap<QName, Item<?,?>> items = new LinkedHashMap<>();
+    protected final LinkedHashMap<QName, Item<?, ?>> items = new LinkedHashMap<>();
     protected final Set<String> unqualifiedItemNames = new HashSet<>();
 
     private Long id;
@@ -119,7 +120,7 @@ public PrismContext getPrismContextLocal() {
      * @return set of items that the property container contains.
      */
     @NotNull
-    public Collection<Item<?,?>> getItems() {
+    public Collection<Item<?, ?>> getItems() {
         if (isImmutable()) {
             return Collections.unmodifiableCollection(items.values());
         } else {
@@ -129,7 +130,7 @@ public Collection<Item<?,?>> getItems() {
 
     // avoid using because of performance penalty
     @SuppressWarnings("unchecked")
-    public <I extends Item<?,?>> List<I> getItems(Class<I> type) {
+    public <I extends Item<?, ?>> List<I> getItems(Class<I> type) {
         List<I> rv = new ArrayList<>();
         for (Item<?, ?> item : items.values()) {
             if (type.isAssignableFrom(item.getClass())) {
@@ -156,7 +157,7 @@ public int size() {
     @NotNull
     public Set<PrismProperty<?>> getProperties() {
         Set<PrismProperty<?>> properties = new HashSet<>();
-        for (Item<?,?> item : items.values()) {
+        for (Item<?, ?> item : items.values()) {
             if (item instanceof PrismProperty) {
                 properties.add((PrismProperty<?>) item);
             }
@@ -180,10 +181,10 @@ public PrismContainerable<C> getParent() {
             return null;
         }
         if (!(parent instanceof PrismContainerable)) {
-            throw new IllegalStateException("Expected that parent of "+ PrismContainerValue.class.getName()+" will be "+
-                    PrismContainerable.class.getName()+", but it is "+parent.getClass().getName());
+            throw new IllegalStateException("Expected that parent of " + PrismContainerValue.class.getName() + " will be " +
+                    PrismContainerable.class.getName() + ", but it is " + parent.getClass().getName());
         }
-        return (PrismContainerable<C>)parent;
+        return (PrismContainerable<C>) parent;
     }
 
     @SuppressWarnings("unchecked")
@@ -193,10 +194,10 @@ public PrismContainer<C> getContainer() {
             return null;
         }
         if (!(parent instanceof PrismContainer)) {
-            throw new IllegalStateException("Expected that parent of "+ PrismContainerValue.class.getName()+" will be "+
-                    PrismContainer.class.getName()+", but it is "+parent.getClass().getName());
+            throw new IllegalStateException("Expected that parent of " + PrismContainerValue.class.getName() + " will be " +
+                    PrismContainer.class.getName() + ", but it is " + parent.getClass().getName());
         }
-        return (PrismContainer<C>)super.getParent();
+        return (PrismContainer<C>) super.getParent();
     }
 
     @NotNull
@@ -305,7 +306,7 @@ private C asContainerableInternal(Class<C> clazz) {
         } catch (SystemException ex) {
             throw ex;
         } catch (Exception ex) {
-            throw new SystemException("Couldn't create jaxb object instance of '" + clazz + "': "+ex.getMessage(), ex);
+            throw new SystemException("Couldn't create jaxb object instance of '" + clazz + "': " + ex.getMessage(), ex);
         }
     }
 
@@ -314,7 +315,7 @@ public Collection<QName> getItemNames() {
         return new ArrayList<>(items.keySet());
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition> void add(Item<IV,ID> item) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition> void add(Item<IV, ID> item) throws SchemaException {
         add(item, true);
     }
 
@@ -324,11 +325,11 @@ public <IV extends PrismValue,ID extends ItemDefinition> void add(Item<IV,ID> it
      * @param item item to add.
      * @throws IllegalArgumentException an attempt to add value that already exists
      */
-    public <IV extends PrismValue,ID extends ItemDefinition> void add(Item<IV,ID> item, boolean checkUniqueness) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition> void add(Item<IV, ID> item, boolean checkUniqueness) throws SchemaException {
         checkMutable();
         ItemName itemName = item.getElementName();
         if (itemName == null) {
-            throw new IllegalArgumentException("Cannot add item without a name to value of container "+getParent());
+            throw new IllegalArgumentException("Cannot add item without a name to value of container " + getParent());
         }
         if (checkUniqueness && findItem(itemName, Item.class) != null) {
             throw new IllegalArgumentException("Item " + itemName + " is already present in " + this.getClass().getSimpleName());
@@ -339,16 +340,13 @@ public <IV extends PrismValue,ID extends ItemDefinition> void add(Item<IV,ID> it
             item.setPrismContext(prismContext);
         }
         if (getComplexTypeDefinition() != null && item.getDefinition() == null) {
-            item.applyDefinition((ID)determineItemDefinition(itemName, getComplexTypeDefinition()), false);
+            item.applyDefinition(determineItemDefinition(itemName, getComplexTypeDefinition()), false);
         }
         simpleAdd(item);
     }
 
     private <IV extends PrismValue, ID extends ItemDefinition> void simpleAdd(Item<IV, ID> item) {
         @NotNull ItemName itemName = item.getElementName();
-//        if (itemName.getLocalPart().equals("modelOperationContext")) {
-//            System.out.println("Hello!");
-//        }
         items.put(itemName, item);
         if (QNameUtil.isUnqualified(itemName)) {
             unqualifiedItemNames.add(itemName.getLocalPart());
@@ -359,7 +357,7 @@ private <IV extends PrismValue, ID extends ItemDefinition> void simpleAdd(Item<I
      * Merges the provided item into this item. The values are joined together.
      * Returns true if new item or value was added.
      */
-    public <IV extends PrismValue,ID extends ItemDefinition> boolean merge(Item<IV,ID> item) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition> boolean merge(Item<IV, ID> item) throws SchemaException {
         checkMutable();
         Item<IV, ID> existingItem = findItem(item.getElementName(), Item.class);
         if (existingItem == null) {
@@ -367,7 +365,7 @@ public <IV extends PrismValue,ID extends ItemDefinition> boolean merge(Item<IV,I
             return true;
         } else {
             boolean changed = false;
-            for (IV newVal: item.getValues()) {
+            for (IV newVal : item.getValues()) {
                 if (existingItem.add((IV) newVal.clone())) {
                     changed = true;
                 }
@@ -384,14 +382,14 @@ public <IV extends PrismValue,ID extends ItemDefinition> boolean merge(Item<IV,I
      * from this item.
      * Returns true if this item was changed.
      */
-    public <IV extends PrismValue,ID extends ItemDefinition> boolean subtract(Item<IV,ID> item) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition> boolean subtract(Item<IV, ID> item) throws SchemaException {
         checkMutable();
-        Item<IV,ID> existingItem = findItem(item.getElementName(), Item.class);
+        Item<IV, ID> existingItem = findItem(item.getElementName(), Item.class);
         if (existingItem == null) {
             return false;
         } else {
             boolean changed = false;
-            for (IV newVal: item.getValues()) {
+            for (IV newVal : item.getValues()) {
                 if (existingItem.remove(newVal)) {
                     changed = true;
                 }
@@ -405,7 +403,7 @@ public <IV extends PrismValue,ID extends ItemDefinition> boolean subtract(Item<I
      *
      * @param item item to add.
      */
-    public <IV extends PrismValue,ID extends ItemDefinition> void addReplaceExisting(Item<IV,ID> item) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition> void addReplaceExisting(Item<IV, ID> item) throws SchemaException {
         checkMutable();
         if (item == null) {
             return;
@@ -414,10 +412,10 @@ public <IV extends PrismValue,ID extends ItemDefinition> void addReplaceExisting
         add(item);
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition> void remove(@NotNull Item<IV,ID> item) {
+    public <IV extends PrismValue, ID extends ItemDefinition> void remove(@NotNull Item<IV, ID> item) {
         checkMutable();
 
-        Item<IV,ID> existingItem = findItem(item.getElementName(), Item.class);
+        Item<IV, ID> existingItem = findItem(item.getElementName(), Item.class);
         if (existingItem != null) {
             ItemName existingItemName = existingItem.getElementName();
             items.remove(existingItemName);
@@ -428,9 +426,9 @@ public <IV extends PrismValue,ID extends ItemDefinition> void remove(@NotNull It
 
     public void removeAll() {
         checkMutable();
-        Iterator<Item<?,?>> iterator = items.values().iterator();
+        Iterator<Item<?, ?>> iterator = items.values().iterator();
         while (iterator.hasNext()) {
-            Item<?,?> item = iterator.next();
+            Item<?, ?> item = iterator.next();
             item.setParent(null);
             iterator.remove();
         }
@@ -443,8 +441,8 @@ public void removeAll() {
      * @param itemsToAdd items to add
      * @throws IllegalArgumentException an attempt to add value that already exists
      */
-    public void addAll(Collection<? extends Item<?,?>> itemsToAdd) throws SchemaException {
-        for (Item<?,?> item : itemsToAdd) {
+    public void addAll(Collection<? extends Item<?, ?>> itemsToAdd) throws SchemaException {
+        for (Item<?, ?> item : itemsToAdd) {
             add(item);
         }
     }
@@ -454,14 +452,14 @@ public void addAll(Collection<? extends Item<?,?>> itemsToAdd) throws SchemaExce
      *
      * @param itemsToAdd items to add
      */
-    public void addAllReplaceExisting(Collection<? extends Item<?,?>> itemsToAdd) throws SchemaException {
+    public void addAllReplaceExisting(Collection<? extends Item<?, ?>> itemsToAdd) throws SchemaException {
         checkMutable();
-        for (Item<?,?> item : itemsToAdd) {
+        for (Item<?, ?> item : itemsToAdd) {
             addReplaceExisting(item);
         }
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition> void replace(Item<IV,ID> oldItem, Item<IV,ID> newItem) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition> void replace(Item<IV, ID> oldItem, Item<IV, ID> newItem) throws SchemaException {
         remove(oldItem);
         add(newItem);
     }
@@ -482,7 +480,7 @@ public boolean contains(ItemName itemName) {
 
     public static <C extends Containerable> boolean containsRealValue(Collection<PrismContainerValue<C>> cvalCollection,
             PrismContainerValue<C> cval) {
-        for (PrismContainerValue<C> colVal: cvalCollection) {
+        for (PrismContainerValue<C> colVal : cvalCollection) {
             if (colVal.equals(cval, EquivalenceStrategy.REAL_VALUE)) {
                 return true;
             }
@@ -497,11 +495,11 @@ public Object find(ItemPath path) {
         }
         Object first = path.first();
         if (!ItemPath.isName(first)) {
-            throw new IllegalArgumentException("Attempt to lookup item using a non-name path "+path+" in "+this);
+            throw new IllegalArgumentException("Attempt to lookup item using a non-name path " + path + " in " + this);
         }
         ItemName subName = ItemPath.toName(first);
         ItemPath rest = path.rest();
-        Item<?,?> subItem = findItem(subName);
+        Item<?, ?> subItem = findItem(subName);
         if (subItem == null) {
             return null;
         }
@@ -509,18 +507,18 @@ public Object find(ItemPath path) {
     }
 
     @Override
-    public <IV extends PrismValue,ID extends ItemDefinition> PartiallyResolvedItem<IV,ID> findPartial(ItemPath path) {
+    public <IV extends PrismValue, ID extends ItemDefinition> PartiallyResolvedItem<IV, ID> findPartial(ItemPath path) {
         if (path == null || path.isEmpty()) {
             // Incomplete path
             return null;
         }
         Object first = path.first();
         if (!ItemPath.isName(first)) {
-            throw new IllegalArgumentException("Attempt to lookup item using a non-name path "+path+" in "+this);
+            throw new IllegalArgumentException("Attempt to lookup item using a non-name path " + path + " in " + this);
         }
         ItemName subName = ItemPath.toName(first);
         ItemPath rest = path.rest();
-        Item<?,?> subItem = findItem(subName);
+        Item<?, ?> subItem = findItem(subName);
         if (subItem == null) {
             return null;
         }
@@ -556,9 +554,9 @@ public PrismReference findReference(QName elementName) {
 
     // todo optimize this some day
     public PrismReference findReferenceByCompositeObjectElementName(QName elementName) {
-        for (Item item: items.values()) {
+        for (Item item : items.values()) {
             if (item instanceof PrismReference) {
-                PrismReference ref = (PrismReference)item;
+                PrismReference ref = (PrismReference) item;
                 PrismReferenceDefinition refDef = ref.getDefinition();
                 if (refDef != null) {
                     if (elementName.equals(refDef.getCompositeObjectElementName())) {
@@ -570,25 +568,25 @@ public PrismReference findReferenceByCompositeObjectElementName(QName elementNam
         return null;
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findItem(ItemPath itemPath, Class<I> type) {
+    public <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I findItem(ItemPath itemPath, Class<I> type) {
         try {
             return findCreateItem(itemPath, type, null, false);
         } catch (SchemaException e) {
             // This should not happen
-            throw new SystemException("Internal Error: "+e.getMessage(),e);
+            throw new SystemException("Internal Error: " + e.getMessage(), e);
         }
     }
 
     @SuppressWarnings("unchecked")
-    <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findCreateItem(QName itemName, Class<I> type, ID itemDefinition, boolean create) throws SchemaException {
-        Item<IV,ID> item = findItemByQName(itemName);
+    <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I findCreateItem(QName itemName, Class<I> type, ID itemDefinition, boolean create) throws SchemaException {
+        Item<IV, ID> item = findItemByQName(itemName);
         if (item != null) {
             if (type.isAssignableFrom(item.getClass())) {
                 return (I) item;
             } else {
                 if (create) {
                     throw new IllegalStateException("The " + type.getSimpleName() + " cannot be created because "
-                            + item.getClass().getSimpleName() + " with the same name exists ("+item.getElementName()+")");
+                            + item.getClass().getSimpleName() + " with the same name exists (" + item.getElementName() + ")");
                 } else {
                     return null;
                 }
@@ -601,7 +599,7 @@ <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findC
         }
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findItem(ItemDefinition itemDefinition, Class<I> type) {
+    public <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I findItem(ItemDefinition itemDefinition, Class<I> type) {
         if (itemDefinition == null) {
             throw new IllegalArgumentException("No item definition");
         }
@@ -610,7 +608,7 @@ public <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>>
 
     public boolean containsItem(ItemPath path, boolean acceptEmptyItem) throws SchemaException {
         if (!path.startsWithName()) {
-            throw new IllegalArgumentException("Attempt to lookup item using a non-name path "+path+" in "+this);
+            throw new IllegalArgumentException("Attempt to lookup item using a non-name path " + path + " in " + this);
         }
         QName subName = path.firstToName();
         ItemPath rest = path.rest();
@@ -621,7 +619,7 @@ public boolean containsItem(ItemPath path, boolean acceptEmptyItem) throws Schem
             } else {
                 // Go deeper
                 if (item instanceof PrismContainer) {
-                    return ((PrismContainer<?>)item).containsItem(rest, acceptEmptyItem);
+                    return ((PrismContainer<?>) item).containsItem(rest, acceptEmptyItem);
                 } else {
                     return acceptEmptyItem || !item.isEmpty();
                 }
@@ -633,10 +631,10 @@ public boolean containsItem(ItemPath path, boolean acceptEmptyItem) throws Schem
 
     // Expects that "self" path is NOT present in propPath
     @SuppressWarnings("unchecked")
-    <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findCreateItem(ItemPath propPath, Class<I> type, ID itemDefinition, boolean create) throws SchemaException {
+    <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I findCreateItem(ItemPath propPath, Class<I> type, ID itemDefinition, boolean create) throws SchemaException {
         Object first = propPath.first();
         if (!ItemPath.isName(first)) {
-            throw new IllegalArgumentException("Attempt to lookup item using a non-name path "+propPath+" in "+this);
+            throw new IllegalArgumentException("Attempt to lookup item using a non-name path " + propPath + " in " + this);
         }
         ItemName subName = ItemPath.toName(first);
         ItemPath rest = propPath.rest();
@@ -644,11 +642,11 @@ <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findC
         if (item != null) {
             if (rest.isEmpty()) {
                 if (type.isAssignableFrom(item.getClass())) {
-                    return (I)item;
+                    return (I) item;
                 } else {
                     if (create) {
                         throw new SchemaException("The " + type.getSimpleName() + " cannot be created because "
-                                + item.getClass().getSimpleName() + " with the same name exists ("+item.getElementName()+")");
+                                + item.getClass().getSimpleName() + " with the same name exists (" + item.getElementName() + ")");
                     } else {
                         return null;
                     }
@@ -656,11 +654,11 @@ <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findC
             } else {
                 // Go deeper
                 if (item instanceof PrismContainer) {
-                    return ((PrismContainer<?>)item).findCreateItem(rest, type, itemDefinition, create);
+                    return ((PrismContainer<?>) item).findCreateItem(rest, type, itemDefinition, create);
                 } else {
                     if (create) {
                         throw new SchemaException("The " + type.getSimpleName() + " cannot be created because "
-                                + item.getClass().getSimpleName() + " with the same name exists ("+item.getElementName()+")");
+                                + item.getClass().getSimpleName() + " with the same name exists (" + item.getElementName() + ")");
                     } else {
                         // Return the item for non-container even if the path is non-empty
                         // FIXME: This is not the best solution but it is needed to be able to look inside properties
@@ -688,7 +686,7 @@ <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> I findC
         }
     }
 
-    private <IV extends PrismValue,ID extends ItemDefinition> Item<IV,ID> findItemByQName(QName subName) throws SchemaException {
+    private <IV extends PrismValue, ID extends ItemDefinition> Item<IV, ID> findItemByQName(QName subName) throws SchemaException {
         if (QNameUtil.isUnqualified(subName) || unqualifiedItemNames.contains(subName.getLocalPart())) {
             return findItemByQNameFullScan(subName);
         } else {
@@ -697,10 +695,10 @@ private <IV extends PrismValue,ID extends ItemDefinition> Item<IV,ID> findItemBy
         }
     }
 
-    private <IV extends PrismValue,ID extends ItemDefinition> Item<IV,ID> findItemByQNameFullScan(QName subName) throws SchemaException {
+    private <IV extends PrismValue, ID extends ItemDefinition> Item<IV, ID> findItemByQNameFullScan(QName subName) throws SchemaException {
 //        LOGGER.warn("Full scan while finding {} in {}", subName, this);
-        Item<IV,ID> matching = null;
-        for (Item<?,?> item : items.values()) {
+        Item<IV, ID> matching = null;
+        for (Item<?, ?> item : items.values()) {
             if (QNameUtil.match(subName, item.getElementName())) {
                 if (matching != null) {
                     String containerName = getParent() != null ? DebugUtil.formatElementName(getParent().getElementName()) : "";
@@ -713,7 +711,7 @@ private <IV extends PrismValue,ID extends ItemDefinition> Item<IV,ID> findItemBy
         return matching;
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition,I extends Item<IV,ID>> I createDetachedSubItem(QName name,
+    public <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I createDetachedSubItem(QName name,
             Class<I> type, ID itemDefinition, boolean immutable) throws SchemaException {
         I newItem = createDetachedNewItemInternal(name, type, itemDefinition);
         if (immutable) {
@@ -722,21 +720,21 @@ public <IV extends PrismValue,ID extends ItemDefinition,I extends Item<IV,ID>> I
         return newItem;
     }
 
-    private <IV extends PrismValue,ID extends ItemDefinition,I extends Item<IV,ID>> I createSubItem(QName name, Class<I> type, ID itemDefinition) throws SchemaException {
+    private <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I createSubItem(QName name, Class<I> type, ID itemDefinition) throws SchemaException {
         checkMutable();
         I newItem = createDetachedNewItemInternal(name, type, itemDefinition);
         add(newItem);
         return newItem;
     }
 
-    private <IV extends PrismValue,ID extends ItemDefinition,I extends Item<IV,ID>> I createDetachedNewItemInternal(QName name, Class<I> type,
+    private <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I createDetachedNewItemInternal(QName name, Class<I> type,
             ID itemDefinition) throws SchemaException {
         I newItem;
         if (itemDefinition == null) {
             ComplexTypeDefinition ctd = getComplexTypeDefinition();
             itemDefinition = determineItemDefinition(name, ctd);
             if (ctd != null && itemDefinition == null) {
-                throw new SchemaException("No definition for item "+name+" in "+getParent());
+                throw new SchemaException("No definition for item " + name + " in " + getParent());
             }
         }
 
@@ -748,19 +746,19 @@ private <IV extends PrismValue,ID extends ItemDefinition,I extends Item<IV,ID>>
                 newItem = (I) itemDefinition.instantiate(computed);
             }
             if (newItem instanceof PrismObject) {
-                throw new IllegalStateException("PrismObject instantiated as a subItem in "+this+" from definition "+itemDefinition);
+                throw new IllegalStateException("PrismObject instantiated as a subItem in " + this + " from definition " + itemDefinition);
             }
         } else {
             newItem = ItemImpl.createNewDefinitionlessItem(name, type, prismContext);
             if (newItem instanceof PrismObject) {
-                throw new IllegalStateException("PrismObject instantiated as a subItem in "+this+" as definitionless instance of class "+type);
+                throw new IllegalStateException("PrismObject instantiated as a subItem in " + this + " as definitionless instance of class " + type);
             }
         }
         if (type.isAssignableFrom(newItem.getClass())) {
             return newItem;
         } else {
             throw new IllegalStateException("The " + type.getSimpleName() + " cannot be created because the item should be of type "
-                    + newItem.getClass().getSimpleName() + " (item: "+newItem.getElementName()+")");
+                    + newItem.getClass().getSimpleName() + " (item: " + newItem.getElementName() + ")");
         }
     }
 
@@ -772,26 +770,18 @@ public PrismReference findOrCreateReference(QName referenceName) throws SchemaEx
         return findCreateItem(referenceName, PrismReference.class, null, true);
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition> Item<IV,ID> findOrCreateItem(QName containerName) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition> Item<IV, ID> findOrCreateItem(QName containerName) throws SchemaException {
         return findCreateItem(containerName, Item.class, null, true);
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition,I extends Item<IV,ID>> I findOrCreateItem(QName containerName, Class<I> type) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I findOrCreateItem(QName containerName, Class<I> type) throws SchemaException {
         return findCreateItem(containerName, type, null, true);
     }
 
-    public <IV extends PrismValue,ID extends ItemDefinition,I extends Item<IV,ID>> I findOrCreateItem(ItemPath path, Class<I> type, ID definition) throws SchemaException {
+    public <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> I findOrCreateItem(ItemPath path, Class<I> type, ID definition) throws SchemaException {
         return findCreateItem(path, type, definition, true);
     }
 
-//    public <X> PrismProperty<X> findOrCreateProperty(QName propertyQName) throws SchemaException {
-//        PrismProperty<X> property = findItem(ItemName.fromQName(propertyQName), PrismProperty.class);
-//        if (property != null) {
-//            return property;
-//        }
-//        return createProperty(propertyQName);
-//    }
-
     public <X> PrismProperty<X> findOrCreateProperty(ItemPath propertyPath) throws SchemaException {
         return findOrCreateItem(propertyPath, PrismProperty.class, null);
     }
@@ -811,7 +801,7 @@ public <X> PrismProperty<X> createProperty(QName propertyName) throws SchemaExce
             // container has definition, but there is no property definition. This is either runtime schema
             // or an error
             if (getParent() != null && getDefinition() != null && !getDefinition().isRuntimeSchema()) {        // TODO clean this up
-                throw new IllegalArgumentException("No definition for property "+propertyName+" in "+complexTypeDefinition);
+                throw new IllegalArgumentException("No definition for property " + propertyName + " in " + complexTypeDefinition);
             }
         }
         PrismProperty<X> property;
@@ -843,16 +833,16 @@ public void removeReference(ItemPath path) {
     }
 
     // Expects that "self" path is NOT present in propPath
-    <I extends Item<?,?>> void removeItem(ItemPath itemPath, Class<I> itemType) {
+    <I extends Item<?, ?>> void removeItem(ItemPath itemPath, Class<I> itemType) {
         checkMutable();
         if (!itemPath.startsWithName()) {
-            throw new IllegalArgumentException("Attempt to remove item using a non-name path "+itemPath+" in "+this);
+            throw new IllegalArgumentException("Attempt to remove item using a non-name path " + itemPath + " in " + this);
         }
         QName subName = itemPath.firstToName();
         ItemPath rest = itemPath.rest();
-        Iterator<Item<?,?>> itemsIterator = items.values().iterator();
+        Iterator<Item<?, ?>> itemsIterator = items.values().iterator();
         while (itemsIterator.hasNext()) {
-            Item<?,?> item = itemsIterator.next();
+            Item<?, ?> item = itemsIterator.next();
             ItemName itemName = item.getElementName();
             if (subName.equals(itemName)) {
                 if (!rest.isEmpty() && item instanceof PrismContainer) {
@@ -863,8 +853,8 @@ <I extends Item<?,?>> void removeItem(ItemPath itemPath, Class<I> itemType) {
                         itemsIterator.remove();
                         removeFromUnqualifiedIfNeeded(itemName);
                     } else {
-                           throw new IllegalArgumentException("Attempt to remove item "+subName+" from "+this+
-                                   " of type "+itemType+" while the existing item is of incompatible type "+item.getClass());
+                        throw new IllegalArgumentException("Attempt to remove item " + subName + " from " + this +
+                                " of type " + itemType + " while the existing item is of incompatible type " + item.getClass());
                     }
                 }
             }
@@ -911,7 +901,7 @@ public void recompute(PrismContext prismContext) {
     @Override
     public void accept(Visitor visitor) {
         super.accept(visitor);
-        for (Item<?,?> item : new ArrayList<>(items.values())) {     // to allow modifying item list via the acceptor
+        for (Item<?, ?> item : new ArrayList<>(items.values())) {     // to allow modifying item list via the acceptor
             item.accept(visitor);
         }
     }
@@ -928,11 +918,11 @@ public void accept(Visitor visitor, ItemPath path, boolean recursive) {
         } else {
             Object first = path.first();
             if (!ItemPath.isName(first)) {
-                throw new IllegalArgumentException("Attempt to lookup item using a non-name path "+path+" in "+this);
+                throw new IllegalArgumentException("Attempt to lookup item using a non-name path " + path + " in " + this);
             }
             QName subName = ItemPath.toName(first);
             ItemPath rest = path.rest();
-            for (Item<?,?> item : items.values()) {            // todo unqualified names!
+            for (Item<?, ?> item : items.values()) {            // todo unqualified names!
                 if (subName.equals(item.getElementName())) {
                     item.accept(visitor, rest, recursive);
                 }
@@ -950,7 +940,7 @@ public void acceptParentVisitor(Visitor visitor) {
     }
 
     public boolean hasCompleteDefinition() {
-        for (Item<?,?> item : getItems()) {
+        for (Item<?, ?> item : getItems()) {
             if (!item.hasCompleteDefinition()) {
                 return false;
             }
@@ -966,7 +956,7 @@ public boolean representsSameValue(PrismValue other, boolean lax) {
     @SuppressWarnings("Duplicates")
     private boolean representsSameValue(PrismContainerValue<C> other, boolean lax) {
         if (lax && getParent() != null) {
-            PrismContainerDefinition definition = getDefinition();
+            PrismContainerDefinition<?> definition = getDefinition();
             if (definition != null) {
                 if (definition.isSingleValue()) {
                     // There is only one value, therefore it always represents the same thing
@@ -975,7 +965,7 @@ private boolean representsSameValue(PrismContainerValue<C> other, boolean lax) {
             }
         }
         if (lax && other.getParent() != null) {
-            PrismContainerDefinition definition = other.getDefinition();
+            PrismContainerDefinition<?> definition = other.getDefinition();
             if (definition != null) {
                 if (definition.isSingleValue()) {
                     // There is only one value, therefore it always represents the same thing
@@ -990,9 +980,9 @@ private boolean representsSameValue(PrismContainerValue<C> other, boolean lax) {
     public void diffMatchingRepresentation(PrismValue otherValue,
             Collection<? extends ItemDelta> deltas, ParameterizedEquivalenceStrategy strategy) {
         if (otherValue instanceof PrismContainerValue) {
-            diffRepresentation((PrismContainerValue)otherValue, deltas, strategy);
+            diffRepresentation((PrismContainerValue) otherValue, deltas, strategy);
         } else {
-            throw new IllegalStateException("Comparing incompatible values "+this+" - "+otherValue);
+            throw new IllegalStateException("Comparing incompatible values " + this + " - " + otherValue);
         }
     }
 
@@ -1013,7 +1003,7 @@ public boolean addRawElement(Object element) throws SchemaException {
             throw new UnsupportedOperationException("Definition-less containers are not supported any more.");
         } else {
             // We have definition here, we can parse it right now
-            Item<?,?> subitem = parseRawElement(element, definition);
+            Item<?, ?> subitem = parseRawElement(element, definition);
             return merge(subitem);
         }
     }
@@ -1025,7 +1015,7 @@ public boolean deleteRawElement(Object element) throws SchemaException {
             throw new UnsupportedOperationException("Definition-less containers are not supported any more.");
         } else {
             // We have definition here, we can parse it right now
-            Item<?,?> subitem = parseRawElement(element, definition);
+            Item<?, ?> subitem = parseRawElement(element, definition);
             return subtract(subitem);
         }
     }
@@ -1035,7 +1025,7 @@ public boolean removeRawElement(Object element) {
         throw new UnsupportedOperationException("Definition-less containers are not supported any more.");
     }
 
-    private <IV extends PrismValue,ID extends ItemDefinition> Item<IV,ID> parseRawElement(Object element, PrismContainerDefinition<C> definition) throws SchemaException {
+    private <IV extends PrismValue, ID extends ItemDefinition> Item<IV, ID> parseRawElement(Object element, PrismContainerDefinition<C> definition) throws SchemaException {
         JaxbDomHack jaxbDomHack = ((PrismContextImpl) definition.getPrismContext()).getJaxbDomHack();
         return jaxbDomHack.parseRawElement(element, definition);
     }
@@ -1043,7 +1033,7 @@ private <IV extends PrismValue,ID extends ItemDefinition> Item<IV,ID> parseRawEl
     private void diffItems(PrismContainerValue<C> thisValue, PrismContainerValue<C> other,
             Collection<? extends ItemDelta> deltas, ParameterizedEquivalenceStrategy strategy) {
 
-        for (Item<?,?> thisItem: thisValue.getItems()) {
+        for (Item<?, ?> thisItem : thisValue.getItems()) {
             Item otherItem = other.findItem(thisItem.getElementName());
             if (!strategy.isConsideringOperationalData()) {
                 ItemDefinition itemDef = thisItem.getDefinition();
@@ -1059,7 +1049,7 @@ private void diffItems(PrismContainerValue<C> thisValue, PrismContainerValue<C>
             ((ItemImpl) thisItem).diffInternal(otherItem, deltas, false, strategy);
         }
 
-        for (Item otherItem: other.getItems()) {
+        for (Item otherItem : other.getItems()) {
             Item thisItem = thisValue.findItem(otherItem.getElementName());
             if (thisItem != null) {
                 // Already processed in previous loop
@@ -1079,7 +1069,7 @@ private void diffItems(PrismContainerValue<C> thisValue, PrismContainerValue<C>
             ItemDelta itemDelta = otherItem.createDelta();
             itemDelta.addValuesToAdd(otherItem.getClonedValues());
             if (!itemDelta.isEmpty()) {
-                ((Collection)deltas).add(itemDelta);
+                ((Collection) deltas).add(itemDelta);
             }
         }
     }
@@ -1094,14 +1084,14 @@ private boolean isOperationalOnly(Item item, ItemDefinition itemDef) {
         if (!(item instanceof PrismContainer)) {
             return false;
         }
-        PrismContainer<?> container = (PrismContainer)item;
-        for (PrismContainerValue<?> cval: container.getValues()) {
+        PrismContainer<?> container = (PrismContainer) item;
+        for (PrismContainerValue<?> cval : container.getValues()) {
             if (cval != null) {
                 Collection<Item<?, ?>> subitems = cval.getItems();
-                for (Item<?, ?> subitem: subitems) {
+                for (Item<?, ?> subitem : subitems) {
                     ItemDefinition subItemDef = subitem.getDefinition();
                     if (subItemDef == null && itemDef != null) {
-                        subItemDef = ((PrismContainerDefinition)itemDef).findItemDefinition(subitem.getElementName());
+                        subItemDef = ((PrismContainerDefinition) itemDef).findItemDefinition(subitem.getElementName());
                     }
                     if (subItemDef == null) {
                         return false;
@@ -1124,9 +1114,9 @@ public PrismContainerDefinition<C> getDefinition() {
     public void applyDefinition(ItemDefinition definition, boolean force) throws SchemaException {
         checkMutable();
         if (!(definition instanceof PrismContainerDefinition)) {
-            throw new IllegalArgumentException("Cannot apply "+definition+" to container " + this);
+            throw new IllegalArgumentException("Cannot apply " + definition + " to container " + this);
         }
-        applyDefinition((PrismContainerDefinition<C>)definition, force);
+        applyDefinition((PrismContainerDefinition<C>) definition, force);
     }
 
     public void applyDefinition(@NotNull PrismContainerDefinition<C> containerDef, boolean force) throws SchemaException {
@@ -1235,7 +1225,7 @@ public void revive(PrismContext prismContext) throws SchemaException {
             this.prismContext = prismContext;
         }
         super.revive(prismContext);
-        for (Item<?,?> item: items.values()) {
+        for (Item<?, ?> item : items.values()) {
             item.revive(prismContext);
         }
     }
@@ -1266,19 +1256,19 @@ public void normalize() {
     public void checkConsistenceInternal(Itemable rootItem, boolean requireDefinitions, boolean prohibitRaw, ConsistencyCheckScope scope) {
         ItemPath myPath = getPath();
         if (getDefinition() == null) {
-            throw new IllegalStateException("Definition-less container value " + this +" ("+myPath+" in "+rootItem+")");
+            throw new IllegalStateException("Definition-less container value " + this + " (" + myPath + " in " + rootItem + ")");
         }
-        for (Item<?,?> item: items.values()) {
+        for (Item<?, ?> item : items.values()) {
             if (scope.isThorough()) {
                 if (item == null) {
-                    throw new IllegalStateException("Null item in container value "+this+" ("+myPath+" in "+rootItem+")");
+                    throw new IllegalStateException("Null item in container value " + this + " (" + myPath + " in " + rootItem + ")");
                 }
                 if (item.getParent() == null) {
-                    throw new IllegalStateException("No parent for item "+item+" in container value "+this+" ("+myPath+" in "+rootItem+")");
+                    throw new IllegalStateException("No parent for item " + item + " in container value " + this + " (" + myPath + " in " + rootItem + ")");
                 }
                 if (item.getParent() != this) {
-                    throw new IllegalStateException("Wrong parent for item "+item+" in container value "+this+" ("+myPath+" in "+rootItem+"), " +
-                            "bad parent: "+ item.getParent());
+                    throw new IllegalStateException("Wrong parent for item " + item + " in container value " + this + " (" + myPath + " in " + rootItem + "), " +
+                            "bad parent: " + item.getParent());
                 }
             }
             item.checkConsistenceInternal(rootItem, requireDefinitions, prohibitRaw, scope);
@@ -1290,8 +1280,8 @@ public void assertDefinitions(String sourceDescription) throws SchemaException {
     }
 
     public void assertDefinitions(boolean tolerateRaw, String sourceDescription) throws SchemaException {
-        for (Item<?,?> item: getItems()) {
-            item.assertDefinitions(tolerateRaw, "value("+getId()+") in "+sourceDescription);
+        for (Item<?, ?> item : getItems()) {
+            item.assertDefinitions(tolerateRaw, "value(" + getId() + ") in " + sourceDescription);
         }
     }
 
@@ -1319,8 +1309,8 @@ protected void copyValues(CloneStrategy strategy, PrismContainerValueImpl<C> clo
         if (strategy == CloneStrategy.LITERAL) {
             clone.id = this.id;
         }
-        for (Item<?,?> item : this.items.values()) {
-            Item<?,?> clonedItem = item.cloneComplex(strategy);
+        for (Item<?, ?> item : this.items.values()) {
+            Item<?, ?> clonedItem = item.cloneComplex(strategy);
             clonedItem.setParent(clone);
             clone.simpleAdd(clonedItem);
         }
@@ -1336,12 +1326,12 @@ void deepCloneDefinition(boolean ultraDeep, PrismContainerDefinition<C> clonedCo
                 replaceComplexTypeDefinition(complexTypeDefinition.deepClone(ultraDeep ? null : new HashMap<>(), new HashMap<>(), postCloneAction));        // OK?
             }
         }
-        for (Item<?,?> item: items.values()) {
+        for (Item<?, ?> item : items.values()) {
             deepCloneDefinitionItem(item, ultraDeep, clonedContainerDef, postCloneAction);
         }
     }
 
-    private <IV extends PrismValue,ID extends ItemDefinition, I extends Item<IV,ID>> void deepCloneDefinitionItem(I item, boolean ultraDeep, PrismContainerDefinition<C> clonedContainerDef, Consumer<ItemDefinition> postCloneAction) {
+    private <IV extends PrismValue, ID extends ItemDefinition, I extends Item<IV, ID>> void deepCloneDefinitionItem(I item, boolean ultraDeep, PrismContainerDefinition<C> clonedContainerDef, Consumer<ItemDefinition> postCloneAction) {
         PrismContainerDefinition<C> oldContainerDef = getDefinition();
         ItemName itemName = item.getElementName();
         ID oldItemDefFromContainer = oldContainerDef.findLocalItemDefinition(itemName);
@@ -1380,7 +1370,7 @@ private boolean equals(PrismContainerValue<?> other, ParameterizedEquivalenceStr
     }
 
     private boolean equalsItems(PrismContainerValue<C> other, ParameterizedEquivalenceStrategy strategy) {
-        Collection<? extends ItemDelta<?,?>> deltas = new ArrayList<>();
+        Collection<? extends ItemDelta<?, ?>> deltas = new ArrayList<>();
         diffItems(this, other, deltas, strategy);
         return deltas.isEmpty();
     }
@@ -1441,7 +1431,7 @@ public String debugDump(int indent) {
             debugDumpIdentifiers(sb);
         }
         appendOriginDump(sb);
-        Collection<Item<?,?>> items = getItems();
+        Collection<Item<?, ?>> items = getItems();
         if (items.isEmpty()) {
             if (wasIndent) {
                 sb.append("\n");
@@ -1449,12 +1439,12 @@ public String debugDump(int indent) {
             DebugUtil.indentDebugDump(sb, indent + 1);
             sb.append("(no items)");
         } else {
-            Iterator<Item<?,?>> i = getItems().iterator();
+            Iterator<Item<?, ?>> i = getItems().iterator();
             if (wasIndent && i.hasNext()) {
                 sb.append("\n");
             }
             while (i.hasNext()) {
-                Item<?,?> item = i.next();
+                Item<?, ?> item = i.next();
                 sb.append(item.debugDump(indent + 1));
                 if (i.hasNext()) {
                     sb.append("\n");
@@ -1474,7 +1464,7 @@ protected void detailedDebugDumpStart(StringBuilder sb) {
 
     @Override
     public String toHumanReadableString() {
-        return "id="+id+": "+items.size()+" items";
+        return "id=" + id + ": " + items.size() + " items";
     }
 
     @Override
@@ -1498,7 +1488,6 @@ void replaceComplexTypeDefinition(ComplexTypeDefinition complexTypeDefinition) {
         this.complexTypeDefinition = complexTypeDefinition;
     }
 
-
     private ComplexTypeDefinition determineComplexTypeDefinition() {
         PrismContainerable<C> parent = getParent();
         ComplexTypeDefinition parentCTD = parent != null && parent.getDefinition() != null ?
@@ -1561,6 +1550,7 @@ public <T> T getRealValue() {
 
     /**
      * Returns a single-valued container (with a single-valued definition) holding just this value.
+     *
      * @param itemName Item name for newly-created container.
      */
     public PrismContainer<C> asSingleValuedContainer(@NotNull QName itemName) throws SchemaException {
@@ -1616,7 +1606,7 @@ public static <C extends Containerable> Collection<C> asContainerables(Collectio
     public void setOriginTypeRecursive(final OriginType originType) {
         accept((visitable) -> {
             if (visitable instanceof PrismValue) {
-                ((PrismValue)visitable).setOriginType(originType);
+                ((PrismValue) visitable).setOriginType(originType);
             }
         });
     }
@@ -1628,7 +1618,7 @@ public void keepPaths(List<? extends ItemPath> keep) throws SchemaException {
             Item<?, ?> item = findItemByQName(itemName);
             ItemPath itemPath = item.getPath().removeIds();
             if (!ItemPathCollectionsUtil.containsSuperpathOrEquivalent(keep, itemPath)
-                && !ItemPathCollectionsUtil.containsSubpathOrEquivalent(keep, itemPath)) {
+                    && !ItemPathCollectionsUtil.containsSubpathOrEquivalent(keep, itemPath)) {
                 removeItem(ItemName.fromQName(itemName), Item.class);
             } else {
                 if (item instanceof PrismContainer) {
diff --git a/infra/schema/src/main/java/com/evolveum/midpoint/schema/DeltaConvertor.java b/infra/schema/src/main/java/com/evolveum/midpoint/schema/DeltaConvertor.java
index ec59c71e7a3..d226e2807c5 100644
--- a/infra/schema/src/main/java/com/evolveum/midpoint/schema/DeltaConvertor.java
+++ b/infra/schema/src/main/java/com/evolveum/midpoint/schema/DeltaConvertor.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2015 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
@@ -9,40 +9,30 @@
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
-
-import javax.xml.bind.JAXBException;
 import javax.xml.namespace.QName;
 
-import com.evolveum.midpoint.prism.*;
-import com.evolveum.midpoint.prism.path.ItemPath;
-import com.evolveum.midpoint.prism.xnode.XNode;
-import com.evolveum.midpoint.schema.internals.InternalsConfig;
-import com.evolveum.prism.xml.ns._public.types_3.PolyStringType;
 import org.apache.commons.lang.Validate;
+import org.jetbrains.annotations.NotNull;
 
+import com.evolveum.midpoint.prism.*;
 import com.evolveum.midpoint.prism.delta.ChangeType;
 import com.evolveum.midpoint.prism.delta.ItemDelta;
 import com.evolveum.midpoint.prism.delta.ObjectDelta;
 import com.evolveum.midpoint.prism.impl.util.RawTypeUtil;
+import com.evolveum.midpoint.prism.path.ItemPath;
+import com.evolveum.midpoint.prism.xnode.XNode;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
+import com.evolveum.midpoint.schema.internals.InternalsConfig;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.exception.SystemException;
 import com.evolveum.midpoint.xml.ns._public.common.api_types_3.ObjectDeltaListType;
 import com.evolveum.midpoint.xml.ns._public.common.api_types_3.ObjectModificationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectDeltaOperationType;
-import com.evolveum.prism.xml.ns._public.types_3.ChangeTypeType;
-import com.evolveum.prism.xml.ns._public.types_3.ItemDeltaType;
-import com.evolveum.prism.xml.ns._public.types_3.ItemPathType;
-import com.evolveum.prism.xml.ns._public.types_3.ModificationTypeType;
-import com.evolveum.prism.xml.ns._public.types_3.ObjectDeltaType;
-import com.evolveum.prism.xml.ns._public.types_3.ObjectType;
-import com.evolveum.prism.xml.ns._public.types_3.RawType;
-import org.jetbrains.annotations.NotNull;
+import com.evolveum.prism.xml.ns._public.types_3.*;
 
 /**
  * @author semancik
- *
  */
 public class DeltaConvertor {
 
@@ -53,7 +43,7 @@ public static <T extends Objectable> ObjectDelta<T> createObjectDelta(ObjectModi
         Validate.notNull(prismContext, "No prismContext in DeltaConvertor.createObjectDelta call");
         PrismObjectDefinition<T> objectDefinition = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(type);
         if (objectDefinition == null) {
-            throw new SchemaException("No object definition for class "+type);
+            throw new SchemaException("No object definition for class " + type);
         }
         return createObjectDelta(objectModification, objectDefinition);
     }
@@ -85,8 +75,6 @@ public static <T extends Objectable> ObjectDelta<T> createObjectDelta(ObjectDelt
             ObjectDelta<T> objectDelta = prismContext.deltaFactory().object().create(type, ChangeType.ADD);
             objectDelta.setOid(objectDeltaType.getOid());
             ObjectType objectToAddElement = objectDeltaType.getObjectToAdd();
-//            PrismObject<T> objectToAdd = prismContext.getXnodeProcessor().parseObject(objectToAddElement.getXnode());
-//            PrismObject<T> objectToAdd = prismContext.getJaxbDomHack().parseObjectFromJaxb(objectToAddElement);
             if (objectToAddElement != null) {
                 objectDelta.setObjectToAdd(objectToAddElement.asPrismObject());
             }
@@ -95,8 +83,8 @@ public static <T extends Objectable> ObjectDelta<T> createObjectDelta(ObjectDelt
             ObjectDelta<T> objectDelta = prismContext.deltaFactory().object().create(type, ChangeType.MODIFY);
             objectDelta.setOid(objectDeltaType.getOid());
             for (ItemDeltaType propMod : objectDeltaType.getItemDelta()) {
-                ItemDelta itemDelta = createItemDelta(propMod, objDef, allowRawValues);
-                if (itemDelta != null){
+                ItemDelta<?, ?> itemDelta = createItemDelta(propMod, objDef, allowRawValues);
+                if (itemDelta != null) {
                     objectDelta.addModification(itemDelta);
                 }
             }
@@ -106,12 +94,11 @@ public static <T extends Objectable> ObjectDelta<T> createObjectDelta(ObjectDelt
             objectDelta.setOid(objectDeltaType.getOid());
             return objectDelta;
         } else {
-            throw new SchemaException("Unknown change type "+objectDeltaType.getChangeType());
+            throw new SchemaException("Unknown change type " + objectDeltaType.getChangeType());
         }
 
     }
 
-
     public static <T extends Objectable> ObjectDelta<T> createObjectDelta(ObjectDeltaType objectDeltaType,
             PrismContext prismContext) throws SchemaException {
         return createObjectDelta(objectDeltaType, prismContext, false);
@@ -119,8 +106,8 @@ public static <T extends Objectable> ObjectDelta<T> createObjectDelta(ObjectDelt
     }
 
     public static ObjectDeltaOperation createObjectDeltaOperation(ObjectDeltaOperationType objectDeltaOperationType,
-                                                                          PrismContext prismContext) throws SchemaException {
-        ObjectDeltaOperation retval = new ObjectDeltaOperation(createObjectDelta(objectDeltaOperationType.getObjectDelta(), prismContext));
+            PrismContext prismContext) throws SchemaException {
+        ObjectDeltaOperation<?> retval = new ObjectDeltaOperation<>(createObjectDelta(objectDeltaOperationType.getObjectDelta(), prismContext));
         if (objectDeltaOperationType.getExecutionResult() != null) {
             retval.setExecutionResult(OperationResult.createOperationResult(objectDeltaOperationType.getExecutionResult()));
         }
@@ -134,26 +121,29 @@ public static ObjectDeltaOperation createObjectDeltaOperation(ObjectDeltaOperati
         return retval;
     }
 
-    public static <T extends Objectable> Collection<? extends ItemDelta> toModifications(ObjectModificationType objectModification,
-            Class<T> type, PrismContext prismContext) throws SchemaException {
+    public static <T extends Objectable> Collection<? extends ItemDelta<?, ?>> toModifications(
+            ObjectModificationType objectModification, Class<T> type, PrismContext prismContext)
+            throws SchemaException {
         Validate.notNull(prismContext, "No prismContext in DeltaConvertor.toModifications call");
         PrismObjectDefinition<T> objectDefinition = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(type);
         if (objectDefinition == null) {
-            throw new SchemaException("No object definition for class "+type);
+            throw new SchemaException("No object definition for class " + type);
         }
         return toModifications(objectModification, objectDefinition);
     }
 
-    public static <T extends Objectable> Collection<? extends ItemDelta> toModifications(ObjectModificationType objectModification,
-            PrismObjectDefinition<T> objDef) throws SchemaException {
+    public static <T extends Objectable> Collection<? extends ItemDelta<?, ?>> toModifications(
+            ObjectModificationType objectModification, PrismObjectDefinition<T> objDef)
+            throws SchemaException {
         return toModifications(objectModification.getItemDelta(), objDef);
     }
 
-    public static <T extends Objectable> Collection<? extends ItemDelta> toModifications(Collection<ItemDeltaType> itemDeltaTypes,
-            PrismObjectDefinition<T> objDef) throws SchemaException {
-        Collection<ItemDelta> modifications = new ArrayList<>();
+    public static <T extends Objectable> Collection<? extends ItemDelta<?, ?>> toModifications(
+            Collection<ItemDeltaType> itemDeltaTypes, PrismObjectDefinition<T> objDef)
+            throws SchemaException {
+        Collection<ItemDelta<?, ?>> modifications = new ArrayList<>();
         for (ItemDeltaType propMod : itemDeltaTypes) {
-            ItemDelta itemDelta = createItemDelta(propMod, objDef);
+            ItemDelta<?, ?> itemDelta = createItemDelta(propMod, objDef);
             modifications.add(itemDelta);
         }
         return modifications;
@@ -169,7 +159,7 @@ public static <T extends Objectable> ObjectModificationType toObjectModification
         ObjectModificationType modType = new ObjectModificationType();
         modType.setOid(delta.getOid());
         List<ItemDeltaType> propModTypes = modType.getItemDelta();
-        for (ItemDelta<?,?> propDelta : delta.getModifications()) {
+        for (ItemDelta<?, ?> propDelta : delta.getModifications()) {
             Collection<ItemDeltaType> propPropModTypes;
             try {
                 propPropModTypes = toItemDeltaTypes(propDelta);
@@ -205,7 +195,7 @@ public static ObjectDeltaType toObjectDeltaType(ObjectDelta<? extends ObjectType
         } else if (objectDelta.getChangeType() == ChangeType.MODIFY) {
             ObjectModificationType modType = new ObjectModificationType();
             modType.setOid(objectDelta.getOid());
-            for (ItemDelta<?,?> propDelta : objectDelta.getModifications()) {
+            for (ItemDelta<?, ?> propDelta : objectDelta.getModifications()) {
                 Collection<ItemDeltaType> propPropModTypes;
                 try {
                     propPropModTypes = toItemDeltaTypes(propDelta, options);
@@ -217,7 +207,7 @@ public static ObjectDeltaType toObjectDeltaType(ObjectDelta<? extends ObjectType
         } else if (objectDelta.getChangeType() == ChangeType.DELETE) {
             // Nothing to do
         } else {
-            throw new SystemException("Unknown changeType "+objectDelta.getChangeType());
+            throw new SystemException("Unknown changeType " + objectDelta.getChangeType());
         }
         return objectDeltaType;
     }
@@ -233,7 +223,6 @@ public static String toObjectDeltaTypeXml(ObjectDelta<? extends ObjectType> delt
                 .serializeRealValue(objectDeltaType, SchemaConstants.T_OBJECT_DELTA);
     }
 
-
     public static ObjectDeltaOperationType toObjectDeltaOperationType(ObjectDeltaOperation objectDeltaOperation) throws SchemaException {
         return toObjectDeltaOperationType(objectDeltaOperation, null);
     }
@@ -246,7 +235,7 @@ public static ObjectDeltaOperationType toObjectDeltaOperationType(ObjectDeltaOpe
 
     public static void toObjectDeltaOperationType(ObjectDeltaOperation delta, ObjectDeltaOperationType odo, DeltaConversionOptions options) throws SchemaException {
         odo.setObjectDelta(DeltaConvertor.toObjectDeltaType(delta.getObjectDelta(), options));
-        if (delta.getExecutionResult() != null){
+        if (delta.getExecutionResult() != null) {
             odo.setExecutionResult(delta.getExecutionResult().createOperationResultType());
         }
         if (delta.getObjectName() != null) {
@@ -268,14 +257,14 @@ private static ChangeTypeType convertChangeType(ChangeType changeType) {
         if (changeType == ChangeType.DELETE) {
             return ChangeTypeType.DELETE;
         }
-        throw new SystemException("Unknown changetype "+changeType);
+        throw new SystemException("Unknown changetype " + changeType);
     }
 
     /**
      * Creates delta from PropertyModificationType (XML). The values inside the PropertyModificationType are converted to java.
      * That's the reason this method needs schema and objectType (to locate the appropriate definitions).
      */
-    public static <IV extends PrismValue,ID extends ItemDefinition> ItemDelta<IV,ID> createItemDelta(ItemDeltaType propMod,
+    public static <IV extends PrismValue, ID extends ItemDefinition> ItemDelta<IV, ID> createItemDelta(ItemDeltaType propMod,
             Class<? extends Containerable> objectType, PrismContext prismContext) throws SchemaException {
         Validate.notNull(prismContext, "No prismContext in DeltaConvertor.createItemDelta call");
         PrismContainerDefinition<? extends Containerable> objectDefinition = prismContext.getSchemaRegistry().
@@ -283,8 +272,8 @@ public static <IV extends PrismValue,ID extends ItemDefinition> ItemDelta<IV,ID>
         return createItemDelta(propMod, objectDefinition);
     }
 
-    public static <IV extends PrismValue,ID extends ItemDefinition> ItemDelta<IV,ID> createItemDelta(ItemDeltaType propMod, PrismContainerDefinition<?> pcDef, boolean allowRawValues) throws
-    SchemaException {
+    public static <IV extends PrismValue, ID extends ItemDefinition> ItemDelta<IV, ID> createItemDelta(ItemDeltaType propMod, PrismContainerDefinition<?> pcDef, boolean allowRawValues) throws
+            SchemaException {
         ItemPathType parentPathType = propMod.getPath();
         ItemPath parentPath;
         if (parentPathType != null) {
@@ -300,8 +289,8 @@ public static <IV extends PrismValue,ID extends ItemDefinition> ItemDelta<IV,ID>
         PrismContainerDefinition containerDef = null;
         if (containingPcd == null) {
             containerDef = pcDef.findContainerDefinition(parentPath.allUpToLastName());
-            if (containerDef == null){
-                if (allowRawValues){
+            if (containerDef == null) {
+                if (allowRawValues) {
                     return null;
                 }
                 throw new SchemaException("No definition for " + parentPath.allUpToLastName().lastName() + " (while creating delta for " + pcDef + ")");
@@ -309,7 +298,7 @@ public static <IV extends PrismValue,ID extends ItemDefinition> ItemDelta<IV,ID>
         }
         QName elementName = parentPath.lastName();
         Item item = RawTypeUtil.getParsedItem(containingPcd, propMod.getValue(), elementName, containerDef);//propMod.getValue().getParsedValue(containingPcd);
-        ItemDelta<IV,ID> itemDelta = item.createDelta(parentPath);
+        ItemDelta<IV, ID> itemDelta = item.createDelta(parentPath);
         if (propMod.getModificationType() == ModificationTypeType.ADD) {
             itemDelta.addValuesToAdd(PrismValueCollectionsUtil.resetParentCollection(PrismValueCollectionsUtil.cloneCollection(item.getValues())));
         } else if (propMod.getModificationType() == ModificationTypeType.DELETE) {
@@ -327,7 +316,7 @@ public static <IV extends PrismValue,ID extends ItemDefinition> ItemDelta<IV,ID>
 
     }
 
-    public static <IV extends PrismValue,ID extends ItemDefinition> ItemDelta<IV,ID> createItemDelta(ItemDeltaType propMod, PrismContainerDefinition<?> pcDef) throws
+    public static <IV extends PrismValue, ID extends ItemDefinition> ItemDelta<IV, ID> createItemDelta(ItemDeltaType propMod, PrismContainerDefinition<?> pcDef) throws
             SchemaException {
         return createItemDelta(propMod, pcDef, false);
     }
@@ -414,7 +403,7 @@ private static void addOldValues(ItemDelta delta, ItemDeltaType mod, Collection<
         }
     }
 
-    private static XNode toXNode(ItemDelta delta, @NotNull PrismValue value, DeltaConversionOptions options) throws SchemaException{
+    private static XNode toXNode(ItemDelta delta, @NotNull PrismValue value, DeltaConversionOptions options) throws SchemaException {
         return delta.getPrismContext().xnodeSerializer()
                 .definition(delta.getDefinition())
                 .options(DeltaConversionOptions.isSerializeReferenceNames(options) ?
diff --git a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java
index 0f3b473f2c6..6dd1ec62da2 100644
--- a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java
+++ b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/ObjectTypeUtil.java
@@ -20,6 +20,7 @@
 import com.evolveum.midpoint.util.LocalizableMessage;
 import com.evolveum.midpoint.util.LocalizableMessageBuilder;
 import com.evolveum.midpoint.util.QNameUtil;
+import com.evolveum.midpoint.util.annotation.Experimental;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
@@ -279,6 +280,28 @@ public static ObjectReferenceType createObjectRef(ObjectType object, PrismContex
         return createObjectRef(object, prismContext.getDefaultRelation());
     }
 
+    /**
+     * Creates a very basic (OID-only) reference for a given object. Useful e.g. to create references
+     * to be used in search filters.
+     */
+    @Experimental
+    public static ObjectReferenceType createOidOnlyObjectRef(ObjectType object) {
+        return createObjectRef(object != null ? object.getOid() : null);
+    }
+
+    /**
+     * @return OID-only object ref. Useful for search filters.
+     */
+    public static ObjectReferenceType createObjectRef(String oid) {
+        if (oid == null) {
+            return null;
+        } else {
+            ObjectReferenceType ref = new ObjectReferenceType();
+            ref.setOid(oid);
+            return ref;
+        }
+    }
+
     public static ObjectReferenceType createObjectRef(ObjectType objectType, QName relation) {
         if (objectType == null) {
             return null;
@@ -941,4 +964,10 @@ public static void setExtensionPropertyRealValues(PrismContext prismContext, Pri
             extension.addReplaceExisting(property);
         }
     }
+
+    public static List<String> getOids(List<? extends Objectable> objectables) {
+        return objectables.stream()
+                .map(Objectable::getOid)
+                .collect(Collectors.toList());
+    }
 }
diff --git a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/SecurityPolicyUtil.java b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/SecurityPolicyUtil.java
index 2f25cd0608f..301af1f3d56 100644
--- a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/SecurityPolicyUtil.java
+++ b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/SecurityPolicyUtil.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2019 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
@@ -29,22 +29,26 @@ public class SecurityPolicyUtil {
     public static final String REST_SEQUENCE_NAME = "rest-default";
     public static final String ACTUATOR_SEQUENCE_NAME = "actuator-default";
     public static final String PASSWORD_RESET_SEQUENCE_NAME = "password-reset-default";
-    private static final List<String> IGNORED_LOCAL_PATH;
+
+    private static final List<String> DEFAULT_IGNORED_LOCAL_PATH;
+
+    /** Constant representing no custom ignored local paths (can be null or empty collection). */
+    public static final List<String> NO_CUSTOM_IGNORED_LOCAL_PATH = null;
 
     static {
         List<String> list = new ArrayList<>();
         list.add("/actuator");
         list.add("/actuator/health");
-        IGNORED_LOCAL_PATH = Collections.unmodifiableList(list);
+        DEFAULT_IGNORED_LOCAL_PATH = Collections.unmodifiableList(list);
     }
 
     public static AbstractAuthenticationPolicyType getAuthenticationPolicy(
             String authPolicyName, SecurityPolicyType securityPolicy) throws SchemaException {
 
-        MailAuthenticationPolicyType mailAuthPolicy = getMailAuthenticationPolicy(
-                authPolicyName, securityPolicy);
-        SmsAuthenticationPolicyType smsAuthPolicy = getSmsAuthenticationPolicy(
-                authPolicyName, securityPolicy);
+        MailAuthenticationPolicyType mailAuthPolicy =
+                getMailAuthenticationPolicy(authPolicyName, securityPolicy);
+        SmsAuthenticationPolicyType smsAuthPolicy =
+                getSmsAuthenticationPolicy(authPolicyName, securityPolicy);
         return checkAndGetAuthPolicyConsistence(mailAuthPolicy, smsAuthPolicy);
 
     }
@@ -165,7 +169,8 @@ public static List<AuthenticationSequenceModuleType> getSortedModules(Authentica
     }
 
     public static AuthenticationsPolicyType createDefaultAuthenticationPolicy(
-            SchemaRegistry schemaRegistry) throws SchemaException {
+            List<String> customIgnoredLocalPaths, SchemaRegistry schemaRegistry)
+            throws SchemaException {
 
         PrismObjectDefinition<SecurityPolicyType> secPolicyDef =
                 schemaRegistry.findObjectDefinitionByCompileTimeClass(SecurityPolicyType.class);
@@ -183,8 +188,10 @@ public static AuthenticationsPolicyType createDefaultAuthenticationPolicy(
         authenticationPolicy.sequence(createRestSequence());
         authenticationPolicy.sequence(createActuatorSequence());
         authenticationPolicy.sequence(createPasswordResetSequence());
-        for (String ignoredPath : IGNORED_LOCAL_PATH) {
-            authenticationPolicy.ignoredLocalPath(ignoredPath);
+        if (customIgnoredLocalPaths == null || customIgnoredLocalPaths.isEmpty()) {
+            DEFAULT_IGNORED_LOCAL_PATH.forEach(authenticationPolicy::ignoredLocalPath);
+        } else {
+            customIgnoredLocalPaths.forEach(authenticationPolicy::ignoredLocalPath);
         }
         secPolicy.asObjectable().setAuthentication(authenticationPolicy);
         return secPolicy.asObjectable().getAuthentication();
diff --git a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/TaskTypeUtil.java b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/TaskTypeUtil.java
index 60760a1852f..bdcac6302a3 100644
--- a/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/TaskTypeUtil.java
+++ b/infra/schema/src/main/java/com/evolveum/midpoint/schema/util/TaskTypeUtil.java
@@ -152,4 +152,8 @@ private static boolean hasBuckets(TaskType taskType) {
     private static boolean isCoordinatedWorker(TaskType taskType) {
         return taskType.getWorkManagement() != null && TaskKindType.WORKER == taskType.getWorkManagement().getTaskKind();
     }
+
+    public static boolean isManageableTreeRoot(TaskType taskType) {
+        return isCoordinator(taskType) || isPartitionedMaster(taskType);
+    }
 }
diff --git a/infra/schema/src/main/resources/xml/ns/public/model/scripting/scripting-3.xsd b/infra/schema/src/main/resources/xml/ns/public/model/scripting/scripting-3.xsd
index f6df097f055..149f742d587 100644
--- a/infra/schema/src/main/resources/xml/ns/public/model/scripting/scripting-3.xsd
+++ b/infra/schema/src/main/resources/xml/ns/public/model/scripting/scripting-3.xsd
@@ -1052,6 +1052,7 @@
                         <xsd:annotation>
                             <xsd:documentation>
                                 Filter matching assignments to be deleted.
+                                Expressions are supported here, but only as an experimental feature.
                             </xsd:documentation>
                         </xsd:annotation>
                     </xsd:element>
diff --git a/infra/util/src/main/java/com/evolveum/midpoint/util/logging/LoggingUtils.java b/infra/util/src/main/java/com/evolveum/midpoint/util/logging/LoggingUtils.java
index bb08f397ccf..9b03562a601 100644
--- a/infra/util/src/main/java/com/evolveum/midpoint/util/logging/LoggingUtils.java
+++ b/infra/util/src/main/java/com/evolveum/midpoint/util/logging/LoggingUtils.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2013 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
@@ -13,11 +13,6 @@
 import ch.qos.logback.classic.Level;
 import org.apache.commons.lang.Validate;
 
-/**
- *
- * @author lazyman
- *
- */
 public class LoggingUtils {
 
     /**
@@ -34,6 +29,13 @@ public static void logUnexpectedException(final Trace LOGGER, String message, Th
         logExceptionInternal(Level.ERROR, Level.ERROR, LOGGER, message, ex, objects);
     }
 
+    /**
+     * When logging unexpected exception, we always want to see the stack trace (so everything is logged on ERROR level)
+     */
+    public static void logUnexpectedException(final Trace LOGGER, Throwable ex) {
+        logExceptionInternal(Level.ERROR, Level.ERROR, LOGGER, "Unexpected exception", ex);
+    }
+
     /**
      * Non-critical exceptions (warnings, with details as debug)
      */
@@ -52,8 +54,7 @@ private static void logExceptionInternal(Level first, Level second, final Trace
         Validate.notNull(LOGGER, "Logger can't be null.");
         Validate.notNull(ex, "Exception can't be null.");
 
-        List<Object> args = new ArrayList<>();
-        args.addAll(Arrays.asList(objects));
+        List<Object> args = new ArrayList<>(Arrays.asList(objects));
         args.add(ex.getMessage() + " (" + ex.getClass() + ")");
 
         if (!first.equals(second)) {
@@ -84,27 +85,26 @@ private static void log(Trace logger, Level level, String message, Object[] argu
     public static void logStackTrace(final Trace LOGGER, String message) {
         if (LOGGER.isTraceEnabled()) {
             if (message != null) {
-                LOGGER.trace(message+":\n{}", dumpStackTrace(LoggingUtils.class));
+                LOGGER.trace(message + ":\n{}", dumpStackTrace(LoggingUtils.class));
             } else {
                 LOGGER.trace("{}", dumpStackTrace(LoggingUtils.class));
             }
         }
     }
 
-    public static String dumpStackTrace(Class... classesToSkip) {
+    public static String dumpStackTrace(Class<?>... classesToSkip) {
         StackTraceElement[] fullStack = Thread.currentThread().getStackTrace();
-        String immediateClass = null;
-        String immediateMethod = null;
         boolean firstFrameLogged = false;
         StringBuilder sb = new StringBuilder();
-        OUTER: for (StackTraceElement stackElement: fullStack) {
+        OUTER:
+        for (StackTraceElement stackElement : fullStack) {
             if (!firstFrameLogged) {
                 if (stackElement.getClassName().equals(Thread.class.getName())) {
                     // skip call to thread.getStackTrace();
                     continue;
                 }
                 if (classesToSkip != null) {
-                    for (Class classToSkip: classesToSkip) {
+                    for (Class<?> classToSkip : classesToSkip) {
                         if (stackElement.getClassName().equals(classToSkip.getName())) {
                             continue OUTER;
                         }
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/projector/policy/scriptExecutor/SynchronousScriptExecutor.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/projector/policy/scriptExecutor/SynchronousScriptExecutor.java
index 7d77e4f693a..b8e48ea466f 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/projector/policy/scriptExecutor/SynchronousScriptExecutor.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/projector/policy/scriptExecutor/SynchronousScriptExecutor.java
@@ -12,9 +12,10 @@
 
 import com.evolveum.midpoint.util.exception.*;
 
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
+
 import org.jetbrains.annotations.NotNull;
 
-import com.evolveum.midpoint.model.api.context.EvaluatedPolicyRule;
 import com.evolveum.midpoint.model.api.context.ModelContext;
 import com.evolveum.midpoint.schema.constants.ExpressionConstants;
 import com.evolveum.midpoint.schema.expression.VariablesMap;
@@ -22,7 +23,6 @@
 import com.evolveum.midpoint.util.logging.LoggingUtils;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
-import com.evolveum.midpoint.xml.ns._public.common.common_3.ScriptExecutionPolicyActionType;
 import com.evolveum.midpoint.xml.ns._public.model.scripting_3.ExecuteScriptType;
 import com.evolveum.midpoint.xml.ns._public.model.scripting_3.ValueListType;
 
@@ -80,6 +80,7 @@ private VariablesMap createInitialVariables() {
         VariablesMap rv = new VariablesMap();
         actx.putIntoVariables(rv);
         rv.put(ExpressionConstants.VAR_MODEL_CONTEXT, actx.context, ModelContext.class);
+        rv.put(ExpressionConstants.VAR_FOCUS, actx.focusContext.getObjectAny(), ObjectType.class);
         return rv;
     }
 }
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignExecutor.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignExecutor.java
index 11a9f9de440..3703d92710f 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignExecutor.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignExecutor.java
@@ -14,6 +14,7 @@
 import javax.annotation.PostConstruct;
 import javax.xml.namespace.QName;
 
+import com.evolveum.midpoint.model.api.PipelineItem;
 import com.evolveum.midpoint.model.api.ScriptExecutionException;
 import com.evolveum.midpoint.model.impl.scripting.ExecutionContext;
 import com.evolveum.midpoint.model.impl.scripting.PipelineData;
@@ -196,7 +197,8 @@ private Collection<AssignmentType> constructionsToAssignments(Collection<Constru
     }
 
     @Override
-    protected ObjectDelta<? extends ObjectType> createDelta(AssignmentHolderType object, AssignParameters parameters) throws SchemaException {
+    protected ObjectDelta<? extends ObjectType> createDelta(AssignmentHolderType object, PipelineItem item,
+            AssignParameters parameters, ExecutionContext context, OperationResult result) throws SchemaException {
 
         List<AssignmentType> assignmentsToAdd = new ArrayList<>();
         assignmentsToAdd.addAll(targetsToAssignments(parameters.targetRefs));
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignmentOperationsExecutor.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignmentOperationsExecutor.java
index 472fe46f004..4fa0de48597 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignmentOperationsExecutor.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/AssignmentOperationsExecutor.java
@@ -12,6 +12,7 @@
 import java.util.stream.Collectors;
 import javax.xml.namespace.QName;
 
+import com.evolveum.midpoint.model.api.PipelineItem;
 import com.evolveum.midpoint.util.exception.*;
 
 import com.evolveum.midpoint.model.api.ModelExecuteOptions;
@@ -54,7 +55,7 @@ public PipelineData execute(ActionExpressionType action, PipelineData input, Exe
         if (checkParameters(parameters, context)) {
             iterateOverObjects(input, context, globalResult,
                     (object, item, result) ->
-                            apply(object.asObjectable(), parameters, context, result),
+                            apply(object.asObjectable(), item, parameters, context, result),
                     (object, exception) ->
                             context.println("Failed to modify " + object + drySuffix(parameters.dryRun) + exceptionSuffix(exception))
             );
@@ -69,14 +70,19 @@ abstract P parseParameters(ActionExpressionType action, PipelineData input, Exec
             OperationResult result) throws SchemaException, ScriptExecutionException, ObjectNotFoundException,
             SecurityViolationException, CommunicationException, ConfigurationException, ExpressionEvaluationException;
 
-    private void apply(AssignmentHolderType object, P parameters, ExecutionContext context, OperationResult result)
-            throws SchemaException, ScriptExecutionException {
-        ObjectDelta<? extends ObjectType> delta = createDelta(object, parameters);
-        operationsHelper.applyDelta(delta, parameters.options, parameters.dryRun, context, result);
-        context.println("Modified " + object + optionsSuffix(parameters.options, parameters.dryRun));
+    private void apply(AssignmentHolderType object, PipelineItem item, P parameters, ExecutionContext context, OperationResult result)
+            throws SchemaException, ScriptExecutionException, ObjectNotFoundException, SecurityViolationException,
+            CommunicationException, ConfigurationException, ExpressionEvaluationException {
+        ObjectDelta<? extends ObjectType> delta = createDelta(object, item, parameters, context, result);
+        if (!delta.isEmpty()) {
+            operationsHelper.applyDelta(delta, parameters.options, parameters.dryRun, context, result);
+            context.println("Modified " + object + optionsSuffix(parameters.options, parameters.dryRun));
+        }
     }
 
-    abstract ObjectDelta<? extends ObjectType> createDelta(AssignmentHolderType object, P parameters) throws SchemaException;
+    abstract ObjectDelta<? extends ObjectType> createDelta(AssignmentHolderType object, PipelineItem item, P parameters,
+            ExecutionContext context, OperationResult result) throws SchemaException, ConfigurationException,
+            ObjectNotFoundException, CommunicationException, SecurityViolationException, ExpressionEvaluationException;
 
     @Override
     protected Class<AssignmentHolderType> getObjectType() {
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/BaseActionExecutor.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/BaseActionExecutor.java
index 52ed5efa412..7ab123a5414 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/BaseActionExecutor.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/BaseActionExecutor.java
@@ -17,8 +17,13 @@
 import com.evolveum.midpoint.provisioning.api.ProvisioningService;
 
 import com.evolveum.midpoint.repo.api.RepositoryService;
+import com.evolveum.midpoint.repo.common.expression.ExpressionFactory;
+import com.evolveum.midpoint.repo.common.expression.ExpressionUtil;
+import com.evolveum.midpoint.repo.common.expression.ExpressionVariables;
 import com.evolveum.midpoint.schema.RelationRegistry;
 import com.evolveum.midpoint.schema.SchemaHelper;
+import com.evolveum.midpoint.schema.constants.ExpressionConstants;
+import com.evolveum.midpoint.schema.expression.VariablesMap;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.security.api.AuthorizationConstants;
 import com.evolveum.midpoint.security.api.SecurityContextManager;
@@ -35,6 +40,8 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 
+import static com.evolveum.midpoint.model.impl.scripting.VariablesUtil.cloneIfNecessary;
+
 /**
  * Superclass for all action executors.
  */
@@ -45,6 +52,7 @@ public abstract class BaseActionExecutor implements ActionExecutor {
     @Autowired protected ScriptingExpressionEvaluator scriptingExpressionEvaluator;
     @Autowired protected PrismContext prismContext;
     @Autowired protected OperationsHelper operationsHelper;
+    @Autowired protected ExpressionFactory expressionFactory;
     @Autowired protected ExpressionHelper expressionHelper;
     @Autowired protected ProvisioningService provisioningService;
     @Autowired protected ModelService modelService;
@@ -150,4 +158,22 @@ String getDescription(PrismValue value) {
     }
 
     abstract String getActionName();
+
+    /**
+     * Creates variables for script evaluation based on some externally-supplied variables,
+     * plus some generic ones (prism context, actor).
+     */
+    @NotNull
+    protected ExpressionVariables createVariables(VariablesMap externalVariables) {
+        ExpressionVariables variables = new ExpressionVariables();
+
+        variables.put(ExpressionConstants.VAR_PRISM_CONTEXT, prismContext, PrismContext.class);
+        ExpressionUtil.addActorVariable(variables, securityContextManager, prismContext);
+
+        //noinspection unchecked
+        externalVariables.forEach((k, v) -> variables.put(k, cloneIfNecessary(k, v)));
+        variables.registerAliasesFrom(externalVariables);
+
+        return variables;
+    }
 }
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/ExecuteScriptExecutor.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/ExecuteScriptExecutor.java
index 02099e65990..5ad716b7adc 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/ExecuteScriptExecutor.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/ExecuteScriptExecutor.java
@@ -273,18 +273,14 @@ private ItemDefinition<?> getItemDefinitionFromTypeName(QName typeName) throws S
     private <I> Object executeScript(ScriptExpression scriptExpression, TypedValue<I> inputTypedValue,
             VariablesMap externalVariables, ExecutionContext context, OperationResult result)
             throws ExpressionEvaluationException, ObjectNotFoundException, SchemaException, CommunicationException, ConfigurationException, SecurityViolationException {
-        ExpressionVariables variables = new ExpressionVariables();
+        ExpressionVariables variables = createVariables(externalVariables);
+
         variables.put(ExpressionConstants.VAR_INPUT, inputTypedValue);
-        variables.put(ExpressionConstants.VAR_PRISM_CONTEXT, prismContext, PrismContext.class);
-        ExpressionUtil.addActorVariable(variables, securityContextManager, prismContext);
-        //noinspection unchecked
-        externalVariables.forEach((k, v) -> variables.put(k, cloneIfNecessary(k, v)));
-        variables.registerAliasesFrom(externalVariables);
 
         LensContext<?> lensContext = getLensContext(externalVariables);
         List<?> rv = ModelImplUtils.evaluateScript(scriptExpression, lensContext, variables, true, "in '"+NAME+"' action", context.getTask(), result);
 
-        if (rv == null || rv.size() == 0) {
+        if (rv.isEmpty()) {
             return null;
         } else if (rv.size() == 1) {
             return rv.get(0);
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/UnassignExecutor.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/UnassignExecutor.java
index e2fe55519dd..a39324d77b8 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/UnassignExecutor.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/scripting/actions/UnassignExecutor.java
@@ -13,13 +13,18 @@
 import javax.annotation.PostConstruct;
 import javax.xml.namespace.QName;
 
+import com.evolveum.midpoint.model.api.PipelineItem;
 import com.evolveum.midpoint.model.api.ScriptExecutionException;
 import com.evolveum.midpoint.model.impl.scripting.ExecutionContext;
 import com.evolveum.midpoint.model.impl.scripting.PipelineData;
 
 import com.evolveum.midpoint.prism.query.ObjectFilter;
 import com.evolveum.midpoint.prism.util.CloneUtil;
+import com.evolveum.midpoint.repo.common.expression.ExpressionUtil;
+import com.evolveum.midpoint.repo.common.expression.ExpressionVariables;
+import com.evolveum.midpoint.schema.constants.ExpressionConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
+import com.evolveum.midpoint.schema.util.MiscSchemaUtil;
 import com.evolveum.midpoint.util.exception.*;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
@@ -29,6 +34,7 @@
 import com.evolveum.midpoint.xml.ns._public.model.scripting_3.UnassignActionExpressionType;
 import com.evolveum.prism.xml.ns._public.query_3.SearchFilterType;
 
+import org.jetbrains.annotations.Nullable;
 import org.springframework.stereotype.Component;
 
 import com.evolveum.midpoint.prism.delta.ObjectDelta;
@@ -95,12 +101,16 @@ boolean checkParameters(UnassignParameters parameters, ExecutionContext context)
     }
 
     @Override
-    protected ObjectDelta<? extends ObjectType> createDelta(AssignmentHolderType object, UnassignParameters parameters)
-            throws SchemaException {
+    protected ObjectDelta<? extends ObjectType> createDelta(AssignmentHolderType object, PipelineItem item,
+            UnassignParameters parameters, ExecutionContext context, OperationResult result) throws SchemaException,
+            ConfigurationException, ObjectNotFoundException, CommunicationException, SecurityViolationException,
+            ExpressionEvaluationException {
+
+        ObjectFilter resolvedFilter = resolveFilter(object, item, parameters, context, result);
 
         List<AssignmentType> assignmentsToDelete = new ArrayList<>();
         for (AssignmentType existingAssignment : object.getAssignment()) {
-            if (matches(existingAssignment, parameters)) {
+            if (matches(existingAssignment, parameters, resolvedFilter)) {
                 assignmentsToDelete.add(existingAssignment);
             }
         }
@@ -111,8 +121,29 @@ protected ObjectDelta<? extends ObjectType> createDelta(AssignmentHolderType obj
                 .asObjectDelta(object.getOid());
     }
 
+    @Nullable
+    private ObjectFilter resolveFilter(AssignmentHolderType object, PipelineItem item, UnassignParameters parameters,
+            ExecutionContext context, OperationResult result) throws SchemaException, ObjectNotFoundException,
+            ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
+        if (parameters.staticFilter != null) {
+            return ExpressionUtil.evaluateFilterExpressions(
+                    parameters.staticFilter, createVariables(object, item), MiscSchemaUtil.getExpressionProfile(),
+                    expressionFactory, prismContext,
+                    "expression evaluation in unassign filter for " + object, context.getTask(), result);
+        } else {
+            return null;
+        }
+    }
+
+    private ExpressionVariables createVariables(AssignmentHolderType input, PipelineItem item) {
+        ExpressionVariables variables = createVariables(item.getVariables());
+        variables.put(ExpressionConstants.VAR_INPUT, input, AssignmentHolderType.class);
+        return variables;
+    }
+
     @SuppressWarnings("SimplifiableIfStatement")
-    private boolean matches(AssignmentType existingAssignment, UnassignParameters parameters) throws SchemaException {
+    private boolean matches(AssignmentType existingAssignment, UnassignParameters parameters, ObjectFilter resolvedFilter)
+            throws SchemaException {
         ObjectReferenceType targetRef = existingAssignment.getTargetRef();
         if (targetRef != null && matchesOid(targetRef.getOid(), parameters.dynamicRoleRefs)
                 && matchesRelation(targetRef.getRelation(), parameters.dynamicRelations)) {
@@ -123,8 +154,7 @@ && matchesRelation(targetRef.getRelation(), parameters.dynamicRelations)) {
                 && matchesOid(construction.getResourceRef().getOid(), parameters.dynamicResourceRefs)) {
             return true;
         }
-        return parameters.staticFilter != null
-                && parameters.staticFilter.match(existingAssignment.asPrismContainerValue(), matchingRuleRegistry);
+        return resolvedFilter != null && resolvedFilter.match(existingAssignment.asPrismContainerValue(), matchingRuleRegistry);
     }
 
     private boolean matchesOid(String existingOid, Collection<ObjectReferenceType> refsToUnassign) {
diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/util/ModelImplUtils.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/util/ModelImplUtils.java
index 9e4daa3cdaa..db1d6fef3f6 100644
--- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/util/ModelImplUtils.java
+++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/util/ModelImplUtils.java
@@ -765,6 +765,7 @@ private static PrismReferenceValue getAuditTarget(ObjectDelta<? extends ObjectTy
         return targetRef;
     }
 
+    @NotNull
     public static <V extends PrismValue, F extends ObjectType> List<V> evaluateScript(
                 ScriptExpression scriptExpression, LensContext<F> lensContext, ExpressionVariables variables, boolean useNew, String shortDesc, Task task, OperationResult parentResult) throws ExpressionEvaluationException, ObjectNotFoundException, SchemaException, CommunicationException, ConfigurationException, SecurityViolationException {
 
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestLinkedObjects.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestLinkedObjects.java
index 1c3173f71ce..325a4d9905b 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestLinkedObjects.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestLinkedObjects.java
@@ -43,6 +43,7 @@ public class TestLinkedObjects extends AbstractEmptyModelIntegrationTest {
     private static final File HW_TOKENS_DIR = new File("src/test/resources/linked/hw-tokens");
     private static final File GUMMI_DIR = new File("src/test/resources/linked/gummi");
     private static final File PROJECTS_DIR = new File("src/test/resources/linked/projects");
+    private static final File ORGS_DIR = new File("src/test/resources/linked/orgs");
 
     private static final File SYSTEM_CONFIGURATION_FILE = new File(TEST_DIR, "system-configuration.xml");
 
@@ -91,6 +92,10 @@ public class TestLinkedObjects extends AbstractEmptyModelIntegrationTest {
     private static final TestResource<ArchetypeType> ARCHETYPE_PROJECT_GROUPS = new TestResource<>(PROJECTS_DIR, "archetype-project-groups.xml", "a85bddc9-4ff0-475f-8ccc-17f9038d4ce1");
     // endregion
 
+    // region Orgs scenario
+    private static final TestResource<ArchetypeType> ARCHETYPE_DELETION_SAFE_ORG = new TestResource<>(ORGS_DIR, "archetype-deletion-safe-org.xml", "b8a973e0-f645-490b-a2ac-b69bd4103bf8");
+    // endregion
+
     @Override
     public void initSystem(Task initTask, OperationResult initResult) throws Exception {
         super.initSystem(initTask, initResult);
@@ -130,6 +135,10 @@ public void initSystem(Task initTask, OperationResult initResult) throws Excepti
         addObject(ARCHETYPE_PROJECT_USERS, initTask, initResult);
         addObject(ARCHETYPE_PROJECT_GROUPS, initTask, initResult);
 
+        // Initialization for Orgs scenario
+
+        addObject(ARCHETYPE_DELETION_SAFE_ORG, initTask, initResult);
+
 //        predefinedTestMethodTracing = PredefinedTestMethodTracing.MODEL_LOGGING;
     }
 
@@ -175,9 +184,6 @@ private void assertHwToken(TestResource<ServiceType> token, String desc, String
 
     @Test
     public void test000SanityForGummi() throws Exception {
-        Task task = getTestTask();
-        OperationResult result = task.getResult();
-
         assertUser(USER_CAVIN.oid, "after init")
                 .assertOrganizationalUnits()
                 .display();
@@ -728,4 +734,47 @@ public void test720DeleteProject() throws Exception {
         assertNoObjectByName(OrgType.class, "ariane5_users", task, result);
         assertNoObjectByName(OrgType.class, "ariane5_groups", task, result);
     }
+
+    /**
+     * Deletes org and checks if it's unassigned from its former members.
+     */
+    @Test
+    public void test800DeleteOrg() throws Exception {
+        given();
+        Task task = getTestTask();
+        OperationResult result = task.getResult();
+
+        OrgType root = new OrgType(prismContext)
+                .name("root")
+                .beginAssignment()
+                    .targetRef(ARCHETYPE_DELETION_SAFE_ORG.oid, ArchetypeType.COMPLEX_TYPE)
+                .end();
+        addObject(root.asPrismObject(), task, result);
+
+        OrgType child = new OrgType(prismContext)
+                .name("child")
+                .beginAssignment()
+                    .targetRef(root.getOid(), OrgType.COMPLEX_TYPE)
+                .end();
+        addObject(child.asPrismObject(), task, result);
+
+        UserType user = new UserType(prismContext)
+                .name("user")
+                .beginAssignment()
+                    .targetRef(root.getOid(), OrgType.COMPLEX_TYPE)
+                .end();
+        addObject(user.asPrismObject(), task, result);
+
+        when();
+        deleteObject(OrgType.class, root.getOid(), task, result);
+
+        then();
+        assertSuccess(result); // in fact this is HANDLED_ERROR because of missing parent org
+
+        assertOrgAfter(child.getOid())
+                .assertAssignments(0);
+
+        assertUserAfter(user.getOid())
+                .assertAssignments(0);
+    }
 }
diff --git a/model/model-intest/src/test/resources/linked/orgs/archetype-deletion-safe-org.xml b/model/model-intest/src/test/resources/linked/orgs/archetype-deletion-safe-org.xml
new file mode 100644
index 00000000000..ae621d31a45
--- /dev/null
+++ b/model/model-intest/src/test/resources/linked/orgs/archetype-deletion-safe-org.xml
@@ -0,0 +1,16 @@
+<!--
+  ~ Copyright (c) 2020 Evolveum and contributors
+  ~
+  ~ This work is dual-licensed under the Apache License 2.0
+  ~ and European Union Public License. See LICENSE file for details.
+  -->
+
+<archetype xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+           oid="b8a973e0-f645-490b-a2ac-b69bd4103bf8">
+    <name>deletion-safe-org</name>
+    <documentation>
+        Marks an organization that is "deletion-safe". If such an organization is deleted, all its
+        members (e.g. users or child organizations) are updated so that the now-invalid assignments
+        are removed.
+    </documentation>
+</archetype>
diff --git a/model/model-intest/src/test/resources/linked/system-configuration.xml b/model/model-intest/src/test/resources/linked/system-configuration.xml
index 1ef3949ddce..0c113175b90 100644
--- a/model/model-intest/src/test/resources/linked/system-configuration.xml
+++ b/model/model-intest/src/test/resources/linked/system-configuration.xml
@@ -17,7 +17,8 @@
 
 <systemConfiguration oid="00000000-0000-0000-0000-000000000001"
                      xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-                     xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3">
+                     xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3"
+                     xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
     <name>SystemConfiguration</name>
 
     <!-- HW tokens scenario -->
@@ -102,4 +103,46 @@
         </policyActions>
     </globalPolicyRule>
 
+    <!-- Orgs scenario -->
+
+    <!-- This role is here because of assignments not being applied on object deletion. -->
+    <globalPolicyRule>
+        <focusSelector>
+            <type>OrgType</type>
+            <archetypeRef oid="b8a973e0-f645-490b-a2ac-b69bd4103bf8"/> <!-- deletion-safe-org -->
+        </focusSelector>
+        <name>unassign-children-on-org-deletion</name>
+        <documentation>
+            Unassigns members when an org is deleted.
+        </documentation>
+        <policyConstraints>
+            <modification>
+                <operation>delete</operation>
+            </modification>
+        </policyConstraints>
+        <policyActions>
+            <scriptExecution>
+                <object>
+                    <linkSource/>
+                </object>
+                <executeScript>
+                    <s:unassign>
+                        <s:filter>
+                            <q:ref>
+                                <q:path>targetRef</q:path>
+                                <expression>
+                                    <script>
+                                        <code>import com.evolveum.midpoint.schema.util.ObjectTypeUtil
+
+                                        ObjectTypeUtil.createObjectRef(focus.oid)
+                                        </code>
+                                    </script>
+                                </expression>
+                            </q:ref>
+                        </s:filter>
+                    </s:unassign>
+                </executeScript>
+            </scriptExecution>
+        </policyActions>
+    </globalPolicyRule>
 </systemConfiguration>
diff --git a/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will-legacy.xml b/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will-legacy.xml
index e44509947c1..673e1c71df8 100644
--- a/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will-legacy.xml
+++ b/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will-legacy.xml
@@ -21,7 +21,21 @@
         <s:type>unassign</s:type>
         <s:parameter>
             <s:name>role</s:name>
-            <c:value xsi:type="xsd:string">12345678-d34d-b33f-f00d-555555556666</c:value>
+            <s:action>
+                <s:type>execute-script</s:type>
+                <s:parameter>
+                    <s:name>script</s:name>
+                    <c:value xsi:type="c:ScriptExpressionEvaluatorType">
+                        <c:code>
+                            '12345678-d34d-b33f-f00d-555555556666'
+                        </c:code>
+                    </c:value>
+                </s:parameter>
+                <s:parameter>
+                    <s:name>forWholeInput</s:name>
+                    <c:value>true</c:value>
+                </s:parameter>
+            </s:action>
         </s:parameter>
         <s:parameter>
             <s:name>relation</s:name>
diff --git a/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will.xml b/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will.xml
index e9d567e16e6..8dd215158c2 100644
--- a/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will.xml
+++ b/model/model-intest/src/test/resources/scripting/unassign-pirate-manager-and-owner-from-will.xml
@@ -20,7 +20,19 @@
             <q:or>
                 <q:ref>
                     <q:path>targetRef</q:path>
-                    <q:value oid="12345678-d34d-b33f-f00d-555555556666" relation="manager"/>
+                    <expression>
+                        <script>
+                            <code>
+                                import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectReferenceType
+                                import javax.xml.namespace.QName
+
+                                ref = new ObjectReferenceType()
+                                ref.oid = '12345678-d34d-b33f-f00d-555555556666'
+                                ref.relation = new QName('manager')
+                                ref
+                            </code>
+                        </script>
+                    </expression>
                 </q:ref>
                 <q:ref>
                     <q:path>targetRef</q:path>
diff --git a/model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/ModelRestController.java b/model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/ModelRestController.java
index 34cab2b8a1a..eb48a1fe513 100644
--- a/model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/ModelRestController.java
+++ b/model/rest-impl/src/main/java/com/evolveum/midpoint/rest/impl/ModelRestController.java
@@ -291,7 +291,7 @@ public ResponseEntity<?> getSelf() {
             result.recordSuccessIfUnknown();
         } catch (SecurityViolationException | ObjectNotFoundException | SchemaException |
                 CommunicationException | ConfigurationException | ExpressionEvaluationException e) {
-            e.printStackTrace();
+            LoggingUtils.logUnexpectedException(logger, e);
             response = status(HttpStatus.INTERNAL_SERVER_ERROR).body(e.getMessage());
         }
 
@@ -495,7 +495,7 @@ public ResponseEntity<?> modifyObjectPatch(
         ResponseEntity<?> response;
         try {
             ModelExecuteOptions modelExecuteOptions = ModelExecuteOptions.fromRestOptions(options, prismContext);
-            Collection<? extends ItemDelta> modifications = DeltaConvertor.toModifications(modificationType, clazz, prismContext);
+            Collection<? extends ItemDelta<?, ?>> modifications = DeltaConvertor.toModifications(modificationType, clazz, prismContext);
             model.modifyObject(clazz, oid, modifications, modelExecuteOptions, task, result);
             response = createResponse(HttpStatus.NO_CONTENT, result);
         } catch (Exception ex) {
diff --git a/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/type/PrefixedStringType.java b/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/type/PrefixedStringType.java
index 085b4c8040e..47a3f15f225 100644
--- a/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/type/PrefixedStringType.java
+++ b/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/type/PrefixedStringType.java
@@ -1,11 +1,16 @@
 /*
- * Copyright (c) 2010-2019 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
  */
 package com.evolveum.midpoint.repo.sql.type;
 
+import java.io.Serializable;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
 import org.hibernate.HibernateException;
 import org.hibernate.dialect.Oracle10gDialect;
 import org.hibernate.engine.spi.SessionFactoryImplementor;
@@ -13,14 +18,6 @@
 import org.hibernate.type.StringType;
 import org.hibernate.usertype.UserType;
 
-import java.io.Serializable;
-import java.sql.PreparedStatement;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-
-/**
- * @author lazyman
- */
 public class PrefixedStringType implements UserType {
 
     public static final String NAME = "PrefixedStringType";
@@ -32,7 +29,7 @@ public Object assemble(Serializable cached, Object owner) throws HibernateExcept
 
     @Override
     public int[] sqlTypes() {
-        return new int[]{StringType.INSTANCE.sqlType()};
+        return new int[] { StringType.INSTANCE.sqlType() };
     }
 
     @Override
@@ -76,7 +73,6 @@ public void nullSafeSet(PreparedStatement st, Object value, int index, SharedSes
 
     private boolean isOracle(SharedSessionContractImplementor session) {
         SessionFactoryImplementor factory = session.getFactory();
-        //System.out.println("]]] " + Oracle10gDialect.class.isAssignableFrom(factory.getDialect().getClass()));
         return Oracle10gDialect.class.isAssignableFrom(factory.getDialect().getClass());
     }
 
diff --git a/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/util/ClassMapper.java b/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/util/ClassMapper.java
index 621a1c85d0d..fbb31579625 100644
--- a/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/util/ClassMapper.java
+++ b/repo/repo-sql-impl/src/main/java/com/evolveum/midpoint/repo/sql/util/ClassMapper.java
@@ -1,31 +1,27 @@
 /*
- * Copyright (c) 2010-2013 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
  */
-
 package com.evolveum.midpoint.repo.sql.util;
 
+import java.util.*;
+import javax.xml.namespace.QName;
+
+import org.apache.commons.collections4.MultiValuedMap;
+import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
+import org.jetbrains.annotations.Contract;
+
 import com.evolveum.midpoint.repo.sql.data.common.RObject;
 import com.evolveum.midpoint.repo.sql.data.common.other.RObjectType;
 import com.evolveum.midpoint.schema.constants.ObjectTypes;
 import com.evolveum.midpoint.util.QNameUtil;
+import com.evolveum.midpoint.util.logging.LoggingUtils;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
 
-import org.apache.commons.collections4.MultiValuedMap;
-import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
-import org.jetbrains.annotations.Contract;
-
-import javax.xml.namespace.QName;
-
-import java.util.*;
-
-/**
- * @author lazyman
- */
 public final class ClassMapper {
 
     private static final Trace LOGGER = TraceManager.getTrace(ClassMapper.class);
@@ -80,7 +76,7 @@ private ClassMapper() {
         try {
             computeDescendants();
         } catch (Throwable t) {
-            t.printStackTrace();
+            LoggingUtils.logUnexpectedException(LOGGER, t);
             throw t;
         }
     }
@@ -97,7 +93,7 @@ private static void computeDescendants() {
     private static Collection<RObjectType> getAncestors(RObjectType type) {
         Set<RObjectType> rv = new HashSet<>();
         Class<? extends ObjectType> jaxbClass = type.getJaxbClass();
-        for (;;) {
+        for (; ; ) {
             RObjectType rType = RObjectType.getByJaxbTypeIfExists(jaxbClass);
             if (rType != null) {
                 // this check is because of auxiliary classes like AbstractAccessCertificationDefinitionType
diff --git a/repo/task-quartz-impl/src/main/java/com/evolveum/midpoint/task/quartzimpl/work/workers/WorkersManager.java b/repo/task-quartz-impl/src/main/java/com/evolveum/midpoint/task/quartzimpl/work/workers/WorkersManager.java
index 5c19534d947..b4f777f2ce4 100644
--- a/repo/task-quartz-impl/src/main/java/com/evolveum/midpoint/task/quartzimpl/work/workers/WorkersManager.java
+++ b/repo/task-quartz-impl/src/main/java/com/evolveum/midpoint/task/quartzimpl/work/workers/WorkersManager.java
@@ -1,12 +1,23 @@
 /*
- * Copyright (c) 2010-2018 Evolveum and contributors
+ * Copyright (C) 2010-2020 Evolveum and contributors
  *
  * This work is dual-licensed under the Apache License 2.0
  * and European Union Public License. See LICENSE file for details.
  */
-
 package com.evolveum.midpoint.task.quartzimpl.work.workers;
 
+import static java.util.Collections.singletonList;
+import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
+
+import java.util.Objects;
+import java.util.*;
+import java.util.stream.Collectors;
+
+import org.apache.commons.collections4.MultiValuedMap;
+import org.apache.commons.collections4.multimap.ArrayListValuedHashMap;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
 import com.evolveum.midpoint.prism.PrismContainer;
 import com.evolveum.midpoint.prism.PrismContext;
 import com.evolveum.midpoint.prism.PrismObject;
@@ -21,31 +32,18 @@
 import com.evolveum.midpoint.schema.result.OperationResultStatus;
 import com.evolveum.midpoint.task.api.*;
 import com.evolveum.midpoint.util.MiscUtil;
-import com.evolveum.midpoint.util.template.StringSubstitutorUtil;
 import com.evolveum.midpoint.util.exception.ObjectAlreadyExistsException;
 import com.evolveum.midpoint.util.exception.ObjectNotFoundException;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.util.logging.Trace;
 import com.evolveum.midpoint.util.logging.TraceManager;
+import com.evolveum.midpoint.util.template.StringSubstitutorUtil;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
 import com.evolveum.prism.xml.ns._public.types_3.ItemDeltaType;
 import com.evolveum.prism.xml.ns._public.types_3.PolyStringType;
-import org.apache.commons.collections4.MultiValuedMap;
-import org.apache.commons.collections4.multimap.ArrayListValuedHashMap;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.stereotype.Component;
-
-import java.util.Objects;
-import java.util.*;
-import java.util.stream.Collectors;
-
-import static java.util.Collections.singletonList;
-import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
 
 /**
  * Manages worker tasks.
- *
- * @author mederly
  */
 @Component
 public class WorkersManager {
@@ -192,8 +190,9 @@ private int closeExecutingWorkers(List<Task> currentWorkers, OperationResult res
         return count;
     }
 
-    class MovedClosed {
+    static class MovedClosed {
         int moved, closed;
+
         MovedClosed(int moved, int closed) {
             this.moved = moved;
             this.closed = closed;
@@ -241,12 +240,18 @@ private int createWorkers(Task coordinatorTask, MultiValuedMap<String, WorkerKey
             throw new IllegalStateException("Null executionStatus of " + coordinatorTask);
         }
         switch (coordinatorTask.getExecutionStatus()) {
-            case WAITING: workerExecutionStatus = TaskExecutionStatusType.RUNNABLE; break;
+            case WAITING:
+                workerExecutionStatus = TaskExecutionStatusType.RUNNABLE;
+                break;
             case SUSPENDED:
             case RUNNABLE:
-                workerExecutionStatus = TaskExecutionStatusType.SUSPENDED; break;
-            case CLOSED: workerExecutionStatus = TaskExecutionStatusType.CLOSED; break;             // not very useful
-            default: throw new IllegalStateException("Unsupported executionStatus of " + coordinatorTask + ": " + coordinatorTask.getExecutionStatus());
+                workerExecutionStatus = TaskExecutionStatusType.SUSPENDED;
+                break;
+            case CLOSED:
+                workerExecutionStatus = TaskExecutionStatusType.CLOSED;
+                break;             // not very useful
+            default:
+                throw new IllegalStateException("Unsupported executionStatus of " + coordinatorTask + ": " + coordinatorTask.getExecutionStatus());
         }
 
         int count = 0;
@@ -287,7 +292,7 @@ private int createWorkers(Task coordinatorTask, MultiValuedMap<String, WorkerKey
     }
 
     private void applyDeltas(TaskType worker, List<ItemDeltaType> deltas) throws SchemaException {
-        Collection<? extends ItemDelta> itemDeltas = DeltaConvertor.toModifications(deltas, worker.asPrismObject().getDefinition());
+        Collection<? extends ItemDelta<?, ?>> itemDeltas = DeltaConvertor.toModifications(deltas, worker.asPrismObject().getDefinition());
         ItemDeltaCollectionsUtil.applyTo(itemDeltas, worker.asPrismContainerValue());
     }
 
@@ -301,7 +306,7 @@ private void moveWorker(Task worker, WorkerKey shouldBe, OperationResult result)
         taskManager.modifyTask(worker.getOid(), itemDeltas, result);
     }
 
-    class WorkerKey {
+    static class WorkerKey {
         final String group;
         final String name;
         final boolean scavenger;
@@ -312,16 +317,15 @@ class WorkerKey {
             this.scavenger = scavenger;
         }
 
-        WorkerKey(Task worker) {    // objects created by this constructor should be used only for matching and comparisons
+        /** Objects created by this constructor should be used only for matching and comparisons. */
+        WorkerKey(Task worker) {
             this(worker.getExecutionGroup(), PolyString.getOrig(worker.getName()), isScavenger(worker));
         }
 
         @Override
         public boolean equals(Object o) {
-            if (this == o)
-                return true;
-            if (!(o instanceof WorkerKey))
-                return false;
+            if (this == o) { return true; }
+            if (!(o instanceof WorkerKey)) { return false; }
             WorkerKey workerKey = (WorkerKey) o;
             return Objects.equals(group, workerKey.group) &&
                     Objects.equals(name, workerKey.name);