The installation of Soffid 3 and Soffid 4 is the same, although the examples are in Soffid 4, you can do the same for Soffid 3.
Depending on your platform, you can download the MSI, RPM or DEB version. [](https://bookstack.soffid.com/uploads/images/gallery/2026-01/mNhMnCNu8vX38LgY-image.png) As soon as the *install-x.y.z.sh* file is in your computer, copy the file into a path of your server. ### Installing IAM Console #### Windows Open the installation file. It will create the operating system level service and will start it. After some seconds, the installation wizard will be up and running in port 8080. #### Linux We recommend to install the package like: ```shell sudo dpkg -i '/your-path/Soffid Console-Debian_Ubuntu Installer-4.0.20.deb' ``` You can ckeck the IAM Console service status: ```shell systemctl status soffid-iamconsole.service ``` #### Configuration Then, open the web browser pointing to [http://localhost:8080](http://localhost:8080) The wizard will ask for the following information: - **Host name:** enter the name that will be used by end-users to access to the console. To use the fully qualified domain name is suggested. A virtual service name can be used as well. Mind that the web server will work even when you put a wrong host names. This host name will be used in email notifications that contain a link to the console. - **User name**: Enter the name of a user with permissions to create tables and indexes in the selected database. - **Password**: Enter the database user password. - **Database type**: select the right database engine: Maria DB, MySQL, PostgreSQL, MS SQL Server or Oracle. - **Database URL**: complete the database URL. The default template use to be good enough, but you can use advanced features depending on the selected database driver: - Maria DB and MySQL: [https://mariadb.com/kb/en/about-mariadb-connector-j/](https://mariadb.com/kb/en/about-mariadb-connector-j/) - PostgreSQL: [https://jdbc.postgresql.org/documentation/80/connect.html](https://jdbc.postgresql.org/documentation/80/connect.html) - MS SqlServer: [https://docs.microsoft.com/es-es/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver15](https://docs.microsoft.com/es-es/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver15) - Oracle: [https://docs.oracle.com/cd/B28359\_01/java.111/b31224/urls.htm#BEIJFHHB](https://docs.oracle.com/cd/B28359_01/java.111/b31224/urls.htm#BEIJFHHB) The next step, allows you to enter the name and password for the initial Soffid user. You must enter: - **Login name**: by default it's admin, but you can use any other naming convention. To change it is good security practice. - **First name**: Your first name. - **Last name**: Your last name. - **Password**: Enter the initial password to use. Write it twice and don't forget it. ## Manual Configuration ### Configuring service startup If you are using the RPM, DEB or MSI installers, the service is automatically configured to start up with the computer. If you are using the .tar.gz file, you must enable it manually. Execute these commands as root to start Soffid IAM console service on boot: ```shell ln -fs /opt/soffid/iam-console-3/bin/catalina.sh /etc/init.d/soffid-iamconsole ln -fs /etc/init.d/soffid-iamconsole /etc/rc2.d/S98soffid-iamconsole ln -fs /etc/init.d/soffid-iamconsole /etc/rc3.d/S98soffid-iamconsole ln -fs /etc/init.d/soffid-iamconsole /etc/rc2.d/K10soffid-iamconsole ln -fs /etc/init.d/soffid-iamconsole /etc/rc3.d/K10soffid-iamconsole ``` If something is not running as expected, please check the log at: ```shell root@localhost:~# cd /opt/soffid/iam-console-4/logs root@localhost:/opt/soffid/iam-console-4/logs# less soffid.YEAR-MONTH-DAY.log ```Now you can connect IAM Console [http://localhost:8080/soffid](http://%3Cnode-ip%3E%3Cpublish-port%3E/) The first thing you must do is to configure database parameters and admin user. When the console is created, the password for user admin will be valid for 24 hours.
# Installing Sync server Guide to install Synchronization server on your own server ## Prerequisites Soffid IAM sync server requires the following requirements: - Windows or Linux (Ubuntu is the most commonly used) - Java JDK 11 for Soffid 3, Java JDK 17 for Soffid 4 - 8GB RAM - > 10GB disk space - [Soffid console installed](https://bookstack.soffid.com/books/installation/page/installing-iam-console "Installing IAM Console") ## Video tutorial ### Windows ### Linux ## Installation ### Download You can download Soffid 3 and Soffid 4 components from our website [Soffid Download Opensource](https://download.soffid.com/download/ "Soffid Download Opensource") or [Soffid Download Enterprise](https://download.soffid.com/download/enterprise/ "Soffid Download Enterprise"). Click on *Soffid Sync Server* and download the latest version for your OS. [](https://bookstack.soffid.com/uploads/images/gallery/2026-01/bHTXb3rvjmhle1vE-image.png) As soon as the *install-x.y.z.sh* file is in your computer, copy the file into a path of your server. ### Installing Sync Server #### Windows Open the installation file. It will install the software and will execute the installation wizard. The installation wizard will ask if it is the first sync server or not. #### Linux ``` sudo dpkg -i '/your-path/Soffid Sync Server-Debian_Ubuntu Installer-4.0.0-beta-2.deb' ``` The installation wizard will ask if it is the first sync server or not. #### Installing the first sync server ##### Automatic wizard If you answer Y to the first question, the wizard will ask for the following information: - **Database URL**: Use the same URL used to install the console. - **Database use**r: The user name to connect to the database. It was used during the console installation - **Database password**: The database user password - **Host name**: Enter the fully qualified domain name of the host. IP addresses are not accepted. - **Port to listen**: Enter a TCP port number. The sync server will receive connections from the console or other sync servers through this port. The suggested value is 1760. After checking the database status, the wizard will register the sync server and will create a new certification authority, as well as a digital certificate for the brand new sync server. ##### Manual wizard If the wizar is not launched automatically, you should launch it manually. To do that, you must follow the next steps: 1. Stop syncserver service: `systemctl stop soffid-iamsync.service` 2. Delete previous configuration: `rm /opt/soffid/iam-sync/conf/*` 3. Launch wizard: `/opt/soffid/iam-sync/bin/configure` 4. Start synserver service: `systemctl start soffid-iamsync.service` ##### The wizard will request about the database configuration: ``` ...... Is this the first sync server in the network (y/n)? y Database URL (jdbc:....): jdbc:mariadb://localhost/soffid Database user: ADMIN_USER Password: xxxxx This server host name [soffid.my.lab]: localhost Port to listen to [1760]: 1760 .... ``` #### Installing the next sync servers If you answer N to the first question, the wizard will ask for the following information: - **Cloud service**: You can install an on-premise sync server connected to a cloud instance. In this case, the communication stack works in a slightly different way. If this is the case, enter Y. If you are connecting to an on-premise Soffid deployment, enter N. - **Server URL**: Enter the URL for the first sync server. - **Tenant name**: Enter the tenant name. If the sync server is not intended to work with a single tenant, enter master. - **User name**: Enter an administrator user name. - **Password**: Enter the administrator password. - **Host name**: Enter the fully qualified domain name of the host. IP addresses are not accepted. - **Port to listen**: Enter a TCP port number. The sync server will receive connections from the console or other sync servers through this port. The suggested value is 1760. The wizard will connect to the sync server and create a sync server connection request. The administrator must open the "My tasks" page and approve the request. Once the request is approved, the wizard will finish. #### Running synchronization server in root mode Sometimes it is necessary to run the sync server in root mode to solve a problem. To do this it is necessary to edit the service, modify some data and finally restart the service. ```shell sudo systemctl edit --full soffid-iamsync ``` ```shell User=root group=root protectSystem=false ``` ```shell sudo systemctl restart soffid-iamsync ``` ## Manual Configuration ### Manual service configuration If you are using the RPM, DEB or MSI installers, the service is automatically configured to start up with the computer. If you are using the .tar.gz file, you must enable it manually. Execute these commands as root to start Soffid IAM sync server service on boot: ```shell `ln -fs /opt/soffid/iam-sync/bin/soffid-sync /etc/init.d/soffid-syncln -fs /etc/init.d/soffid-sync /etc/rc1.d/K01soffid-syncln -fs /etc/init.d/soffid-sync /etc/rc2.d/S06soffid-syncln -fs /etc/init.d/soffid-sync /etc/rc3.d/S06soffid-syncln -fs /etc/init.d/soffid-sync /etc/rc4.d/S06soffid-syncln -fs /etc/init.d/soffid-sync /etc/rc5.d/S06soffid-syncln -fs /etc/init.d/soffid-sync /etc/rc6.d/K01soffid-sync` ``` Note that if you are running Centos, Redhat7 o version higher than Ubuntu 16.04, you should enable the service in systemctl ``` sudo systemctl enable soffid-sync ``` Once you have installed and configured Soffid Sync Server as a service, you could manage it with the following operations ``` service soffid-sync status service soffid-sync restart service soffid-sync start service soffid-sync stop ``` ### First synchronisation server configuration It is not recommended to install the first sync server on the same host where the database is installed. To configure the server, please execute the following commands: On Linux: ```shell /opt/soffid/iam-sync/bin/configure -main -hostname [hostname] -port 760 -dbuser [soffid] -dbpass [pass] -dburl [jdbc:mysql://localhost:3306/soffid] ``` On Windows: ```shell %ProgramFiles%\soffid\iam-sync\bin\configure -main -hostname [hostname] -port 760 -dbuser [soffid] -dbpass [pass] -dburl [jdbc:mysql://localhost:3306/soffid] ``` User and password must be the ones created during the installation process. The hostname value must be a FQDN (fully qualified domain name), for instance, "myhost.mydomain.com" or in a test environment "syncserver.soffid.lab" Mind the configuration wizard will refuse to register the sync server if this is not really the first sync server. If you really want to register this sync server as the first one, you must open the [Synchronization servers](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/synchronization-servers "Synchronization servers") page and remove any already registered sync server. [](https://bookstack.soffid.com/uploads/images/gallery/2026-01/0x18JNc4F60YOQ6o-image.png) ### Next servers configuration In order to configure the next server syncservers, a two step process is required: first, a normal user installs and configure the sync server software; next, a Soffid administrator allows the sync server to join the sync servers network. To perform the next step, you do not need to enter the database credentials. Instead, the primary sync server URL and a Soffid console user name and password are required. For instance, you can execute: On Linux: ```shell `/opt/soffid/iam-sync/bin/configure -hostname [hostname] -user [user] -pass [pass] -server [https://yourserver:760] -tenant [master]` ``` On Windows: ```shell `%ProgramFiles%\soffid\iam-sync\bin\configure -hostname [hostname] -user [user] -pass [pass] -server [https://yourserver:760] -tenant [master]` ``` After executing the command, an approval task will appear in Soffid console. The administrator can take ownership of the task and approve or reject it. After approving the server creation, the server will be configured as a proxy sync server (without database access). The administrator can open the sync servers configuration page to change the sync server role at any time. ### Configure a synchronization server proxy without approval in UI If you want to bypass the appoval process, there is a configuration setting that allows it: - Open console and click on *Start →* *Soffid Configuration → Soffid Parameters*: - Click on *Add New* and, then, write the parameter **soffid.server.register**, set the value to ***direct*** and *Confirm changes*. - Execute the configuration of a synchronization server proxy as follows: On Linux: ``` /opt/soffid/iam-sync/bin/configure -hostname hostname -user usuario -pass pass -server https://Now you can connect to the IAM console [http://localhost:8080/soffid](http://%3Cnode-ip%3E%3Cpublish-port%3E/) and chek if Console and Syncserver are connected.
# Configure TLS for IAM Console ## Introduction The TLS protection of Soffid IAM Console is applied through the configuration of the Apache TomEE embedded in the installation. This solution is running under java technology therefore we need a jks file (Java Key Store) or a PKCS#12 file with the information of your certificate. Once you have the Console installed and your certificate in jks format you can follow this steps to configure it the first time or for an update. Mind that sometimes, the network encryption algorithm is named SSL, in fact, the configuration file still displays the word SSL. However, SSL protocol is now outdated, and TLSv1.2 is used instead. ## Load a PKCS#12 (.PFX) file There are many standard ways to store and transfer private keys and certificates, but the most common one is the PKCS#12 format. Its main advantage is that it contains, in a single file, both the private key and the public certificate. To transform the .PFX file to a java key store (.JKS), and can use the next command (you have to adapt it to your system): ```shell keytool -v -importkeystore -srckeystoreIf we have a key and certificate (key, crt), the step to perform the conversion is:
``` openssl pkcs12 -inkey keyfile.key -in certificate.crt -out name_to_export -export keytool -v -importkeystore -srckeystore name_to_export -srcstoretype PKCS12 -destkeystore /opt/soffid/iam-console-4/conf/new_certificate_name.jks -deststoretype JKS -destkeypass password -srcstorepass password -deststorepass password ``` ## Configuration The configuration file to modify is the following one:/opt/soffid/iam-console-4/conf/server.xml
It can contain one or more connectors. Uncomment or add the following one, that enables the TLS configuration:Attribute | Comment |
|---|---|
| **port** | You can choose the standard 443 or another custom port |
| **protocols** (inside SSLHostConfig tag) **sslEnabledProtocols** (inside Connector tag) | You can configure the protocols allowed. For intance, protocols="TLSv1.3" or sslEnabledProtocols="TLSv1.3" |
| **certificateKeystoreFile** | The source by default starts from /opt/soffid/iam-console-4/ (the installation directory) |
| **certificateKeystorePassword** | The password used to encrypt the jks file |
| **certificateKeyAlias** | The alias to identify your key and certificate |
If you have some configuration error, you can search for more information in the Console log (the current day log): /opt/soffid/iam-console-4/logs/soffid-YYYY-MM-DD.log
##### Example server.xml This example only allows protocols TLSv1.3 ```XML ............