> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md).

# Configure the reverse proxy

How the bundled reverse proxy routes requests, the two directives that matter, and how to point it at services on other hosts.

OpenIAM installs and configures a reverse proxy for you: **Apache `httpd` with the OpenIAM module, `mod_openiam`**. It is the single entry point users reach, it authenticates each request, and it routes what it allows through to the platform. For a single-node deployment the installation configures it completely and this page is reference — you need it when you move a component to another host, publish on a different address, or enable HTTPS.

## What this covers, and how long it takes

<table><thead><tr><th width="150.79998779296875"></th><th></th></tr></thead><tbody><tr><td><strong>You get</strong></td><td>A reverse proxy pointed at the right backends for your topology</td></tr><tr><td><strong>Time</strong></td><td>10 minutes</td></tr><tr><td><strong>Hosts</strong></td><td>The host running the proxy</td></tr><tr><td><strong>Downtime</strong></td><td>A few seconds while the proxy restarts</td></tr><tr><td><strong>Reversible</strong></td><td>Yes — it is one configuration file</td></tr></tbody></table>

## How a request travels

{% code overflow="wrap" %}

```
browser  ──▶  httpd  ──▶  interface router  ──▶  webconsole, idp, selfservice,
   80/443    mod_openiam        8080             selfservice-ext, reportviewer,
                                                 openiam-ui-static
                  │
                  └────────▶  enterprise service bus
                                    9080
```

{% endcode %}

Only the first hop is reachable from outside the host. **8080 is not a user-facing address** — nothing should be published on it and nothing should be firewalled open to it. Reaching it directly from the host is a diagnostic step, useful when you need to establish whether a problem is in the proxy or behind it.

## Before you start

* A deployment that passes [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md).
* `root`, or `sudo`, on the host running the proxy.
* If you are moving a component to another host, the address it will run on.

## Where the configuration lives

| Path                                    | Contains                                                                                                                                                          |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `/etc/httpd/conf.d/mod_openiam.conf`    | The active configuration                                                                                                                                          |
| `/usr/share/doc/mod_openiam*/conf.d/`   | Reference configurations, including the HTTPS variant                                                                                                             |
| `/var/log/httpd/mod_openiam_error_log`  | The proxy's errors — the first log to read when a page will not load                                                                                              |
| `/var/log/httpd/mod_openiam_access_log` | Every request the proxy handled                                                                                                                                   |
| `/etc/nginx/nginx.conf`                 | The interface router's configuration, generated at installation from the port settings in [*Settings*](/installation/settings.md). You should not need to edit it |

## The two directives that matter

Everything else in the file can usually be left alone. These two decide whether the platform works:

| Directive                  | Points at                  | Single-node value       |
| -------------------------- | -------------------------- | ----------------------- |
| `OPENIAM_ESBPath`          | The enterprise service bus | `http://localhost:9080` |
| `OPENIAM_ConfigureBackend` | The user interface tier    | `http://localhost:8080` |

**Change both if you move those components.** In a deployment where the interfaces and the service bus run on different hosts from the proxy, each must name the host actually running that component:

{% code overflow="wrap" %}

```apache
OPENIAM_ESBPath           http://<esb-host>:9080
OPENIAM_ConfigureBackend  http://<ui-host>:8080
```

{% endcode %}

`OPENIAM_ConfigureBackend` should match the **Application Servers** value you set on the content provider during first-time setup. If the two disagree, requests route inconsistently.

## Apply a change

{% code overflow="wrap" %}

```bash
systemctl restart httpd
```

{% endcode %}

**What you should see:** the service returns to active within a few seconds.

{% code overflow="wrap" %}

```bash
systemctl is-active httpd
```

{% endcode %}

## Verify it

{% code overflow="wrap" %}

```bash
curl -k -I -L http://127.0.0.1/idp/login
```

{% endcode %}

**Expected: `HTTP/1.1 200`.** This exercises the proxy and the identity provider behind it.

If that fails, the same request one hop in tells you which side the problem is on:

{% code overflow="wrap" %}

```bash
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/idp/login
```

{% endcode %}

**A `200` here but not through the proxy** puts the problem in the proxy configuration. **Neither answering** puts it in the interface services — go to [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md) step 4.

Then confirm the console through the proxy:

{% code overflow="wrap" %}

```bash
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/webconsole
```

{% endcode %}

## SELinux

The installation sets what the proxy needs — the `httpd_can_network_connect` boolean, and the port label for 8080. If you are working on a host where SELinux was configured after installation, or you have moved a backend to another host, confirm:

{% code overflow="wrap" %}

```bash
getsebool httpd_can_network_connect
```

{% endcode %}

**Expected: `on`.** If not:

{% code overflow="wrap" %}

```bash
setsebool -P httpd_can_network_connect 1
```

{% endcode %}

## If it goes wrong

| What you see                                             | What it means                                                           | What to do                                                                                                               |
| -------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `Service Not Available`                                  | The proxy cannot reach a backend                                        | Check `OPENIAM_ESBPath` and `OPENIAM_ConfigureBackend` point at running services, then check the SELinux boolean above   |
| A page loads but its assets do not                       | The interface tier is reachable and the static assets are not           | Confirm the UI services are running — [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md) step 4 |
| The proxy will not restart                               | A syntax error in the configuration                                     | `httpd -t` names the file and line                                                                                       |
| A path returns `404` through the proxy but works on 8080 | The rewrite or location for that path                                   | Check `/var/log/httpd/mod_openiam_error_log`                                                                             |
| Assets load as plain text, or the browser refuses them   | The interface router's configuration                                    | `nginx -t`, then `systemctl restart nginx`                                                                               |
| Requests reach the wrong interface                       | The content provider's domain pattern does not match the address in use | Check the content provider in the console against the address users type                                                 |

## What this procedure does not cover

Apache tuning, your organisation's own Apache configuration, and web application firewall rules. The directives here are the ones OpenIAM requires; everything else in the file is yours. Certificates are [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md).

## Related

* [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md) — the next step for anything beyond a first look
* [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md)
* [*Ports*](/installation/rpm/rpm-single-node/ports.md)

*Applies to OpenIAM 2026.8.1.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.