> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/rpm/rpm-single-node/first-sign-in.md). # First sign-in Sign in for the first time, set the administrator password, and tell OpenIAM the address it is published on — for a single node, three nodes or Kubernetes. The deployment is running and verified. This page takes you through the short setup sequence the console runs on its first sign-in, which ends with a console you can work in. **It applies to all three deployment shapes.** Where an answer differs between a single node, three nodes and Kubernetes, the step says so. ## What this builds, and how long it takes
You getAn administrator account you control, and a platform that knows the address it is published on
Time15 minutes, including a five-minute wait at the end
HostsAny machine with a browser that can reach the deployment
DowntimeNone
ReversibleYes — everything here can be changed later in the console
## Before you start * The deployment verified — [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md) on RPM, or [*Verify a Kubernetes deployment*](/installation/kubernetes/verify.md) on Kubernetes. * **The initial administrator's username and password.** On RPM these are set during the installation and written to the install output; if you did not record them, they are in `/usr/local/openiam/init.log`. On Kubernetes they are issued with your deployment materials. * **The address you want users to type**, and DNS already pointing at the deployment. On a single node that is usually the host's DNS name; behind a load balancer, ingress or published name, it is that name. **Settle this before you start** — it is recorded here, and changing it later means editing the content provider. * **Whether users will reach that address over HTTPS.** The answer is recorded here too, and it changes the links the platform generates. ## Set these first {% code overflow="wrap" %} ```bash export OPENIAM_URL= ``` {% endcode %} *** ## Build it ### 1. Open the console {% code overflow="wrap" %} ``` https://$OPENIAM_URL/webconsole ``` {% endcode %} Use `http://` instead only if you have not yet put TLS in front of the deployment. **What you should see:** a sign-in page. Sign in with the initial administrator account. **Reach it on the address you intend to publish**, not on an IP address or a load balancer's own DNS name. The setup sequence pre-fills the next step from the address you arrived on. ### 2. Change the administrator password The new password is checked against the platform's password policy. **Record it in your password manager**, and treat the installation log as disclosed — see [*Troubleshoot*](/installation/rpm/rpm-single-node/troubleshoot.md). ### 3. Create the first content provider A content provider tells OpenIAM which address it answers on. The platform uses it to build links in emails and redirects, and to route requests to the right interface.
FieldWhat to enter
Content Provider NameA name for this address — for example default, or your host's name
Domain PatternThe address users type, without a scheme or a path. Pre-filled from the address you arrived on; confirm it is the name you want published. Two rules are enforced: each pattern belongs to one content provider only, and the pattern must end with the authentication cookie domain below
Authentication Cookie DomainThe domain the session cookie is issued for — the domain pattern itself, or a parent of it. sso.example.com and example.com are both valid for a pattern of sso.example.com; example.org is not, and the console rejects it
Application supports SSL?Yes if users reach the address over HTTPS, including when TLS is terminated at a load balancer or ingress and the platform itself serves HTTP behind it. No only while you are genuinely serving HTTP end to end. This answer decides whether generated links and redirects say https
Application ServersThe interface router the reverse proxy hands requests to. At least one is required — the platform will not serve a content provider that has none. The value depends on the shape; see the table below
**A port in the domain pattern is ignored** when the platform matches an incoming request, so `sso.example.com` and `sso.example.com:8443` behave the same way here. #### The Application Servers value, by shape
ShapeValue
RPM, single nodehttp://localhost:8080
RPM, three nodeshttp://localhost:8080. Every node runs both a reverse proxy and an interface router, so each node's proxy reaches the router beside it and no node depends on another for this hop
Kuberneteshttp://<deployment-name>-nginx:8080 — the interface router's service, using the deployment name you chose
**Keep this in step with the proxy's own configuration.** On RPM, the same host and port appear as `OPENIAM_ConfigureBackend` in `mod_openiam.conf` — see [*Configure the reverse proxy*](/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md). On Kubernetes the deployment sets the equivalent for you, as `openiam.ui.service.host` on the reverse-proxy release. If you change one, change the other. ### 4. Set your challenge questions These are used for self-service password recovery, and the console asks for them once. ### 5. Allow about five minutes The platform refreshes its caches after a content provider is created. Pages settle once the refresh completes. *** ## Verify it **Sign out and sign back in.** You should arrive at the console rather than the setup sequence. Then confirm the address is being used as you expect: {% code overflow="wrap" %} ```bash curl -s -o /dev/null -w '%{http_code}\n' https://$OPENIAM_URL/webconsole curl -s -o /dev/null -w '%{http_code}\n' https://$OPENIAM_URL/selfservice ``` {% endcode %} **Expected: `200`, or a `30x` redirect to the sign-in page, from both.** ## If it goes wrong | What you see | What it means | What to do | | ------------------------------------------------------------ | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | The setup sequence returns after you complete it | The cache refresh has not finished | Wait five minutes and sign in again | | The console loads but its assets do not | The interface tier is reachable and the static assets are not | [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md) step 3 | | Links in email point at `localhost` | The content provider's domain pattern is not the published address | Edit the content provider and set the address users type | | Generated links say `http` although users arrive over HTTPS | **Application supports SSL?** is `No` | Set it to `Yes`. It describes how users reach the address, not how the platform serves it internally | | The content provider will not save, citing the cookie domain | The domain pattern does not end with the authentication cookie domain | Make the cookie domain the pattern itself or a parent of it | | The content provider will not save, citing a required server | No Application Server is set | Add the value for your shape from the table in step 3 | | A different interface loads than the one you asked for | Two content providers claim the same domain pattern | Each pattern belongs to one content provider; remove the duplicate | | Sign-in is rejected | The account, its password or its status | For the initial administrator, check the value recorded at installation | | `Service Not Available` | The proxy cannot reach its backend | [*Configure the reverse proxy*](/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md) | ## What this procedure does not cover Connecting a managed system, defining roles and policy, and synchronising users are all done from here and are covered in the [Administration Guide](/administration-guide/admin.md). ## Related * [*Configure*](/installation/rpm/rpm-single-node/configure.md) — what to review now the console works * [*Deploy with Helm*](/installation/kubernetes/deploy-with-helm.md) — if you arrived from a Kubernetes deployment * [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md) — the next step for anything beyond a first look * [*Add a connector*](/installation/rpm/rpm-single-node/add-a-connector.md) * The [Administration Guide](/administration-guide/admin.md) — for what to configure once it runs *Applies to OpenIAM 2026.8.1.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/installation/rpm/rpm-single-node/first-sign-in.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.