Configure WSO2IS to use 443 instead of 9443

[thedrhax14]

Description

Hello everyone,

I have managed recently to deploy a wso2is instance using docker image and put it behind reverse proxy for SSL offloading on EC2 instance. It practically works over port 443 as expected except for several internal APIs as far as I observed. One of those APIs is https://id.example.com:9443/scim2/Users?count=11&domain=PRIMARY&excludedAttributes=groups,roles&startIndex=1 which is for some reason still uses 9443. More precisely mostly any path that starts with /scim2. Here is my deployment.toml:

[server]
hostname = "id.example.com"
node_ip = "127.0.0.1"

[transport.https.properties]
proxyPort = 443
proxyHost = "id.example.com"

...

It appears to be valid and working since I am able to access and use most of wso2is instance using port 443. Any idea why 9443 is still used? I have tried to grep scim2 and 9443 in the container but couldn't tell clearly what file remains to be updated.

I also should mention I did find carbon.management.port in multiple files where scim2 related api paths are but couldn't tell how to change it correctly

Regards.

Steps to Reproduce

#Local Machine Setup

These steps describe how to reproduce the issue using a local environment (Mac/Windows/Linux) with Docker installed. No EC2 setup is required.

1. Pull the WSO2 Identity Server Docker Image

docker pull wso2/wso2is:7.2.0

2. Create a Local deployment.toml

Create a directory on your machine, for example:

mkdir wso2is-local
cd wso2is-local

Create a file named deployment.toml with the following content:

# /home/wso2carbon/wso2is-7.2.0/repository/conf/deployment.toml
# [server]
# hostname = "localhost"
# node_ip = "127.0.0.1"
# base_path = "https://$ref{server.hostname}:${carbon.management.port}"
[server]
hostname = "id.example.com"
node_ip = "127.0.0.1"
offset = 0
management_port = 80

[transport.https]
port = 80

[transport.https.properties]
proxyPort = 80
proxyHost = "id.example.com"

[super_admin]
username = "..."
password = "..."
create_admin_account = true

[user_store]
type = "database_unique_id"

[database.identity_db]
type = "h2"
url = "jdbc:h2:./repository/database/WSO2IDENTITY_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000"
username = "..."
password = "..."

[database.shared_db]
type = "h2"
url = "jdbc:h2:./repository/database/WSO2SHARED_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000"
username = "..."
password = "..."

[datasource.AgentIdentity]
id = "AgentIdentity"
url = "jdbc:h2:./repository/database/WSO2AGENTIDENTITY_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000"
username = "..."
password = "..."
driver = "org.h2.Driver"

[keystore.primary]
file_name = "wso2carbon.p12"
password = "wso2carbon"
type="PKCS12"

[truststore]
file_name="client-truststore.p12"
password="wso2carbon"
type="PKCS12"

[account_recovery.endpoint.auth]
hash= "..."

[identity.auth_framework.endpoint]
app_password= "..."

(The hostname can be anything, it just needs to be consistent.) In overall it is identical to the default deployment.toml except for [server], [transport.https] and [transport.https.properties]. Also, usage of port 80 is identical to 443 mostly. The point is that the port change should be reflected consistently everywhere else

3. Run the Container and Mount deployment.toml

Expose container port 6763, simulating SSL offloading through a reverse proxy.

docker run \
  --name wso2is \
  -p 80:6763 \
  -v $(pwd)/deployment.toml:/home/wso2carbon/wso2is-7.2.0/repository/conf/deployment.toml \
  wso2/wso2is:latest

This setup simulates:

• User accessing WSO2IS via port 80
• Reverse proxy (simulated) forwarding traffic into container port 6763

4. Access Management Console

Open the browser:

http://id.example.com/

(or modify your /etc/hosts (depending on your OS) to point it to 127.0.0.1)

5. Navigate Through the Console

Log in normally and use features across the dashboard (users, roles, applications).

Most endpoints work correctly through the configured proxy port 80.

6. Trigger a SCIM2 API Call

Use the UI or call the API directly:

http://id.example.com/scim2/Users?count=11&domain=PRIMARY&excludedAttributes=groups,roles&startIndex=1

7. Observe the Issue

Even though the server is accessed through 80, WSO2 IS internally still responds with URLs pointing to:

http://id.example.com:9443/scim2/Users...

Or attempts to call internal SCIM2 endpoints via port 9443, ignoring the configured:

[transport.https.properties]
proxyPort = 80
proxyHost = "id.example.com"

8. Inspect Container for References to 9443 (Optional)

Running a grep inside the container shows multiple references to:

• carbon.management.port
• 9443
• SCIM2 URL patterns inside XML/TOML files

But it is unclear which file is responsible for SCIM2 continuing to use 9443.

Example:

docker exec -it wso2is bash
grep -R "9443" /home/wso2carbon/wso2is-7.2.0/ -n
grep -R "scim2" /home/wso2carbon/wso2is-7.2.0/ -n

9. Result

Even with a valid deployment.toml, SCIM2 endpoints still use 9443 instead of the configured proxy port 80.
This behavior only affects certain internal API paths (mostly /scim2/*), while the rest of the product works correctly behind the reverse proxy.

Please select the area issue is related to

Identity Server Core

Version

7.2.0

Environment Details (with versions)

No response

Developer Checklist

• [Behavioural Change] Does this change introduce a behavioral change to the product?
•  ↳ Approved by team lead
•  ↳ Label impact/behavioral-change added
• [Migration Impact] Does this change have a migration impact?
•  ↳ Migration label added (e.g., 7.2.0-migration)
•  ↳ Migration issues created and linked
• [New Configuration] Does this change introduce a new configuration?
•  ↳ Label config added
•  ↳ Configuration is properly documented

[HasiniSama]

Hi @thedrhax14,

I have tested the reproduction steps and found different results depending on whether HTTP or HTTPS configuration is used. I used 8080, as my 443 and 80 are already taken.

1. HTTPS Setup - Bug NOT Reproducible

• deployment.toml:

[server]
hostname = "id.example.com"
node_ip = "127.0.0.1"
offset = 0

[transport.https.properties]
proxyPort = 8080
proxyHost = "id.example.com"

• Docker mapping:
  docker run -d --name wso2is -p 8080:9443 wso2/wso2is:7.2.0

• Result:
  SCIM2 endpoints correctly return URLs with the configured proxy port (:8080).

---

2. HTTP Setup - Bug Successfully Reproduced

• deployment.toml:

[server]
hostname = "id.example.com"
node_ip = "127.0.0.1"
offset = -3000  # HTTP port: 6763, HTTPS port: 6443

[transport.http.properties]  # ← HTTP configuration
proxyPort = 8080
proxyHost = "id.example.com"

• Docker mapping:
  docker run -d --name wso2is -p 8080:6763 wso2/wso2is:7.2.0

• Result:
  SCIM2 returns https://id.example.com:9443

[thedrhax14]

Thank you for assistance
Please see the answers regarding your questions you shared in discord:

1. Are you experiencing this issue with HTTP endpoints, HTTPS endpoints, or both?
   HTTP end point only

2. What is the offset value in your production setup? (I see references to -9000 in the Discord thread, 0 in the GitHub issue, and 6763 suggests -3000)
   The offset value is 0. I have updated the setup after to try default ports instead and forgot to update message on Discord and here. Also regarding 6763. I confused the first number of the port. The port I am using is actually 9763 i.e. default http port on WSO2IS.

[thedrhax14]

@HasiniSama upon additional testing I just noticed that it looks like it works as intended actually. Please, see the screenshot of browser logs. I am still not sure why browser recieves 302 from server and then tries 9443 which results in bad gateway.

This is my current deployment.toml

[server]
hostname = "id.example.com"
node_ip = "127.0.0.1"
offset = 0

[transport.http.properties]
proxyPort = 80

[transport.https.properties]
proxyPort = 443
proxyHost = "id.example.com"

[thedrhax14]

After hours or troubleshooting and research on how the reverse proxy server works and how wso2is internals also work I finally managed to make it use port 443 always. Long story short all traffic should come to WSO2 identity server as https even from reverse proxy to the wso2 server as well even if originally from the end user it is already https otherwise the server will send back 302 with redirect to default guaranteed https path which it assumes that the port is 9443. The process of putting the wso2is behind reverse proxy is pretty much straightforward when using nginx for example since there are docs with sample configs. However, with other reverse proxy servers and load balancers like traefik in my case it was very tricky also considering that I deployed it using coolify. Not sure about nginx, but traefik needs to be explicitly configured to accept any self-signed certificates which the docker image of wso2is comes with one.

I still believe there should be a way to make wso2is accept http as well if it is behind reverse proxy server. I am still not sure whether setting [transport.https.properties] proxyPort does anything on this regard or not.