> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/rpm/rpm-single-node/configure.md).

# Configure

The settings to review once the deployment is running, grouped by whether you must set them, should review them, or should leave them alone.

The deployment starts with a complete working configuration. This page covers what to review before it is used in earnest, grouped so you can see at a glance what needs a decision and what does not.

## What this covers, and how long it takes

<table><thead><tr><th width="137.99998474121094"></th><th></th></tr></thead><tbody><tr><td><strong>You get</strong></td><td>A deployment configured for your environment rather than left at defaults</td></tr><tr><td><strong>Time</strong></td><td>30–45 minutes</td></tr><tr><td><strong>Hosts</strong></td><td>The platform host</td></tr><tr><td><strong>Downtime</strong></td><td>Some changes need a service restart; each says so</td></tr><tr><td><strong>Reversible</strong></td><td>Yes — every change here is a configuration value</td></tr></tbody></table>

## Before you start

* [*First sign-in*](/installation/rpm/rpm-single-node/first-sign-in.md) completed — the administrator password is changed and the published address is set.
* Your organisation's mail server details, password policy and log retention requirements to hand.

## Where configuration lives

<table><thead><tr><th width="334">File</th><th>Contains</th></tr></thead><tbody><tr><td><code>/usr/local/openiam/env.conf</code></td><td>Deployment-level settings — hosts, ports, engine choices</td></tr><tr><td><code>/usr/local/openiam/conf/properties/</code></td><td>Service properties, generated during installation</td></tr></tbody></table>

Treat both as sensitive. They hold credentials for the deployment.

***

## Must set

### Secure the administrator account

The initial administrator password was changed during [*First sign-in*](/installation/rpm/rpm-single-node/first-sign-in.md). Now create named accounts for the people who will administer the platform, and stop using the shared initial account for day-to-day work.

The [Administration Guide](/administration-guide/admin.md) covers creating administrators and assigning them roles.

### Configure outbound mail

The platform sends notifications — password resets, approval requests, campaign reminders. Without a mail server configured, those are generated and never delivered.

Set your mail host, port, and credentials in the mail settings. See the [Administration Guide](/administration-guide/admin.md)'s notification configuration for the full set and how to send a test message.

### Confirm the published address

The platform builds links in email and in federation responses from the content provider's **Domain Pattern**, which you set during [*First sign-in*](/installation/rpm/rpm-single-node/first-sign-in.md).

Confirm it is the address users type — a load balancer name, a DNS alias, or the host's fully qualified name — rather than `localhost` or an individual host name behind a balancer. Changing it takes effect after the platform's cache refresh; no restart is needed.

If a load balancer or a published DNS name is introduced later, edit the content provider rather than the host configuration.

***

## Should review

### TLS for the user interfaces

The deployment starts on HTTP so you can confirm it works before certificates are involved. For anything beyond a first look, see [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md) — it covers both configuring the bundled proxy with your certificate and terminating TLS at your own load balancer.

### Session and password policy

The platform ships with a working default policy. Review it against your organisation's standard before users are onboarded — password complexity, expiry, lockout thresholds and session lifetime are all configurable in the console. See the [Administration Guide](/administration-guide/admin.md).

### Log retention and forwarding

The platform writes to `/usr/local/openiam/logs/`, and **the package configures rotation for you**: `/etc/logrotate.d/openiam` keeps five compressed generations, rotating daily or at 10 MB. Equivalent policies ship for the graph, storage and search tiers. Change the retention there if your organisation requires longer.

**Audit and log forwarding.** Service logs are ordinary files and suit any log shipper — Filebeat, Fluent Bit, rsyslog or your own agent. Exporting OpenIAM's *audit records* to a SIEM is a separate, richer path configured in the console, and is covered in the [Administration Guide](/administration-guide/admin.md).

### Search index retention

The platform ages out its provisioning and federation indexes on a schedule set at installation, so the search tier does not grow without limit. The controlling values are in [*Settings*](/installation/settings.md). Review them against your audit retention obligations before the deployment carries real data — this is a retention decision, not a tuning one.

### Monitoring

If you installed the bundled Prometheus and Grafana stack, the dashboards are available on the host and give you the platform and infrastructure views out of the box. The stack requires OpenSearch as the search tier, and Prometheus keeps 30 days of metrics by default.

The bundled stack listens on the platform host: Grafana on 3000, Prometheus on 9090, the node exporter on 9100. **Change Grafana's administrator password at first sign-in.** Prometheus binds to the loopback interface by default — to reach it from elsewhere, adjust `--web.listen-address` in `/etc/systemd/system/prometheus.service` and open the port.

If you use your own monitoring, point it at the same health endpoints the verification page uses — they are the most useful single signal per service:

{% code overflow="wrap" %}

```
http://localhost:<port>/<app>/actuator/health
http://localhost:9080/openiam-esb/actuator/health
```

{% endcode %}

### Backup

[*Back up and restore*](/installation/rpm/rpm-single-node/back-up-and-restore.md) lists everything that needs to be in scope — it is more than the database — and gives the procedures. Set this up before the deployment carries anything you would mind losing, and test a restore before you need one.

***

## Leave alone

These are set correctly by the installation and changing them without a specific reason creates work rather than value:

<table><thead><tr><th width="228.39999389648438">Setting group</th><th>Why</th></tr></thead><tbody><tr><td>Port assignments</td><td>All internal, and the proxy and router configurations are generated to match them. Change the externally visible address at your load balancer instead</td></tr><tr><td>Inter-service addresses and credentials</td><td>Generated during installation and held in the secret store</td></tr><tr><td>Schema names and database users</td><td>Created during installation and referenced throughout</td></tr><tr><td>Cluster host lists</td><td>For the three-node shape; the single-entry default is correct here</td></tr></tbody></table>

## Tuning

Heap sizes, connection pools, cache sizes and consumer counts are deliberately not in this page. The deployment starts with defaults suitable for getting running.

Cache refresh intervals, batch sizes, thread pools, consumer counts and rate limits — with their shipped defaults and the property file each one lives in — are on [Configuration tuning reference](/installation/tuning.md), along with [each service's memory limit](/installation/tuning.md#service-memory), which is what decides its heap. **Sizing for your expected load is not documented yet**; ask OpenIAM support.

## Verify it

After any change requiring a restart:

{% code overflow="wrap" %}

```bash
openiam-cli stop && openiam-cli start
```

{% endcode %}

then repeat the checks in [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md). Confirm the console is reachable at the external URL you configured, and send a test notification to confirm mail is working.

## If it goes wrong

| What you see                                             | What it means                                                       | What to do                                                                                                             |
| -------------------------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| A setting change has no effect                           | The service was not restarted, or the change belongs in the console | Console settings take effect after the cache refresh; `env.conf` settings need `openiam-cli stop && openiam-cli start` |
| Test email is not delivered                              | Mail host, port, credentials, or an outbound rule                   | Confirm the host can reach your mail server on the port before looking at OpenIAM                                      |
| Links in email use the wrong address                     | The content provider's domain pattern                               | [*First sign-in*](/installation/rpm/rpm-single-node/first-sign-in.md) step 3                                           |
| The platform will not restart after an `env.conf` change | A malformed value                                                   | Restore the previous value; the installation log records what it was set to                                            |

## What this procedure does not cover

Connecting a managed system, defining roles and policy, building workflows, and synchronising users. Those are the [Administration Guide](/administration-guide/admin.md)'s subject and are done from the console once this page is complete. Connector installation is [*Add a connector*](/installation/rpm/rpm-single-node/add-a-connector.md).

## Related

* [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md)
* [*Add a connector*](/installation/rpm/rpm-single-node/add-a-connector.md)
* [*Settings*](/installation/settings.md)
* The [Administration Guide](/administration-guide/admin.md) — policy, notifications, administrators

*Applies to OpenIAM 2026.8.1.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/installation/rpm/rpm-single-node/configure.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.