Tomcat in SailPoint Installation

Tomcat

Configuring Tomcat correctly for IdentityIQ: memory, connectors and the datasource.

Quick answer

Tomcat hosts the IdentityIQ WAR. Configure JVM memory, the HTTP/HTTPS connectors, and the JDBC datasource, then deploy and start.

Key takeaways

Prerequisites for Tomcat
Step-by-step install path
Common pitfalls and fixes
Verification after install

Apache Tomcat is the reference application server for IdentityIQ, and configuring it correctly is central to a stable, performant deployment. IdentityIQ ships as the identityiq WAR that Tomcat hosts; the areas that matter are the JVM memory settings, the HTTP/HTTPS connectors, and the database datasource.

Prerequisites

A supported Tomcat version for your IdentityIQ release.
A supported JDK with JAVA_HOME set.
A reachable database and the JDBC driver.

Step by step

1. Install the supported Tomcat version under a dedicated service user.
2. Set JVM memory in setenv.sh/setenv.bat, size -Xms and -Xmx to the object volume, and tune GC as needed.
3. Configure connectors in server.xml, the HTTP connector and, for production, an HTTPS connector with your certificate.
4. Add the JDBC driver to Tomcat's lib and define the datasource IdentityIQ uses.
5. Deploy the WAR to webapps and start Tomcat.

Memory and performance

Heap sizing is the most impactful Tomcat setting. Too small and the JVM garbage-collects constantly or runs out of memory during heavy tasks; too large and GC pauses grow. Base the size on your identity and object volume, monitor GC behaviour, and separate UI nodes from task nodes so batch jobs and interactive traffic do not compete for the same heap.

Connectors and TLS

For anything beyond a lab, terminate TLS at Tomcat (or an upstream load balancer) so credentials are never sent in clear text. Configure the HTTPS connector with a valid certificate and disable weak protocols and ciphers.

Verify

Confirm Tomcat starts without errors in catalina.out, the IdentityIQ context loads, HTTPS serves with a valid certificate, and login works.

Common pitfalls

Default heap left unchanged, causing out-of-memory under load.
Missing or misplaced JDBC driver, so the datasource fails.
HTTP-only in production, exposing credentials.

Practice challenge

+0 XPStreak ×0

Question 1 of 3

What are the prerequisites for Tomcat?

Frequently asked questions

What does the term Tomcat refer to in SailPoint?

Apache Tomcat is the reference application server for IdentityIQ, and configuring it correctly is central to a stable, performant deployment.

What is the practical takeaway on Tomcat?

Base the size on your identity and object volume, monitor GC behaviour, and separate UI nodes from task nodes so batch jobs and interactive traffic do not compete for the same heap.

What is worth remembering about Tomcat in practice?

For anything beyond a lab, terminate TLS at Tomcat (or an upstream load balancer) so credentials are never sent in clear text.

What tends to go wrong with Tomcat?

Default heap left unchanged, causing out-of-memory under load. Missing or misplaced JDBC driver, so the datasource fails. HTTP-only in production, exposing credentials.

Want this with a live instructor and a lab tenant?

SailPoint Architect training →