Tomcat
Quick answer
Tomcat hosts the IdentityIQ WAR. Configure JVM memory, the HTTP/HTTPS connectors, and the JDBC datasource, then deploy and start.
Key takeaways
- Prerequisites for Tomcat
- Step-by-step install path
- Common pitfalls and fixes
- Verification after install
Apache Tomcat is the reference application server for IdentityIQ, and configuring it correctly is central to a stable, performant deployment. IdentityIQ ships as the identityiq WAR that Tomcat hosts; the areas that matter are the JVM memory settings, the HTTP/HTTPS connectors, and the database datasource.
Prerequisites
- A supported Tomcat version for your IdentityIQ release.
- A supported JDK with
JAVA_HOMEset. - A reachable database and the JDBC driver.
Step by step
- 1. Install the supported Tomcat version under a dedicated service user.
- 2. Set JVM memory in
setenv.sh/setenv.bat, size-Xmsand-Xmxto the object volume, and tune GC as needed. - 3. Configure connectors in
server.xml, the HTTP connector and, for production, an HTTPS connector with your certificate. - 4. Add the JDBC driver to Tomcat's lib and define the datasource IdentityIQ uses.
- 5. Deploy the WAR to
webappsand start Tomcat.
Memory and performance
Heap sizing is the most impactful Tomcat setting. Too small and the JVM garbage-collects constantly or runs out of memory during heavy tasks; too large and GC pauses grow. Base the size on your identity and object volume, monitor GC behaviour, and separate UI nodes from task nodes so batch jobs and interactive traffic do not compete for the same heap.
Connectors and TLS
For anything beyond a lab, terminate TLS at Tomcat (or an upstream load balancer) so credentials are never sent in clear text. Configure the HTTPS connector with a valid certificate and disable weak protocols and ciphers.
Verify
Confirm Tomcat starts without errors in catalina.out, the IdentityIQ context loads, HTTPS serves with a valid certificate, and login works.
Common pitfalls
- Default heap left unchanged, causing out-of-memory under load.
- Missing or misplaced JDBC driver, so the datasource fails.
- HTTP-only in production, exposing credentials.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What are the prerequisites for Tomcat?
- A. The application and app-server logs, which usually point to database, Java or permission issues.
- B. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
- C. Confirm the app server starts, the schema is present, and login works.
Show answer
B. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
How do you verify the install?
- A. The application and app-server logs, which usually point to database, Java or permission issues.
- B. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
- C. Confirm the app server starts, the schema is present, and login works.
Show answer
C. Confirm the app server starts, the schema is present, and login works.
Confirm the app server starts, the schema is present, and login works.
Where do you look first on failure?
- A. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
- B. Confirm the app server starts, the schema is present, and login works.
- C. The application and app-server logs, which usually point to database, Java or permission issues.
Show answer
C. The application and app-server logs, which usually point to database, Java or permission issues.
The application and app-server logs, which usually point to database, Java or permission issues.