Changing The Port On A Linux Identity Server - Novell ACCESS MANAGER 3.1 SP2 - IDENTITY SERVER GUIDE 2010 Manual

net stop Tomcat5
net start Tomcat5

1.5.2 Changing the Port on a Linux Identity Server

On a Linux Identity Server, the Identity Server service (hosted on Tomcat) runs as a non-privileged
user on Linux and cannot therefore bind to ports below 1024. In order to allow requests to port 80/
443 while Tomcat is listening on 8080/8443, the preferred approach is to use iptables to perform a
port translation. Port translation allows the base URL of the Identity Server to be configured for port
443 and to listen on this port, and the iptables translates it to port 8443 when communicating with
Tomcat.
If you have disabled the SUSE Linux Enterprise Server (SLES) firewall and do not have any

other Access Manager components installed on the Identity Server, you can use a simple
iptables script to translate the ports. See
 If you have configured the SLES firewall or have installed other Access Manager components
on the Identity Server, you use a custom rule script that allows for multiple port translations.
See "Configuring iptables for Multiple Components" on page
These sections describe two solutions out of many possibilities. For more information about
iptables, see the following:
 "Iptable Tutorial 1.2.2" (http://iptables-tutorial.frozentux.net/iptables-tutorial.html)
"NAM Filters for iptables Commands" (http://www.novell.com/communities/node/4029/nam-

filters-iptables-commands)
A Simple Redirect Script
This simple solution works only if you are not using iptables to translate ports of other applications
or Access Manager components. For a solution that works with multiple components, see
"Configuring iptables for Multiple Components" on page
1 In the Administration Console, click Devices > Identity Server > Edit, and configure the base
URL with HTTPS as the protocol, and the TCP Port as 443.
2 Click OK, then update the Identity Server.
3 At a terminal window, log in as the
4 Create a file to hold the iptables rule and place it in the
For example,
/etc/init.d/AM_IDP_Redirect
CHMOD as appropriate.
An example of a redirect startup file for this purpose might be:
#!/bin/sh
# Copyright (c) 2010 Novell, Inc.
# All rights reserved.
#
#! /bin/sh
#! /etc/init.d/idp_8443_redirect
# ### BEGIN INIT INFO
# Provides: idp_8443_redirect
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 5
"A Simple Redirect Script" on page
39.
user.
root
/etc/init.d
. Ensure it has execute rights. You can use
37.
39.
directory.
Configuring an Identity Server 37