Apache Syncope

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point. Tomcat's JVM and PostgreSQL run together, and an identity workload with many connectors benefits from the headroom.

For the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp from the people who use the console and the self-service portal. Put TLS in front of port 80 before you expose it publicly (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache Syncope by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create, and then Create.

Step 2 -Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-syncope-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name syncope \
  --image sac1647283583153:apache-syncope-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name syncope --port 80 --priority 1010

Step 3 -Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 -Confirm the services are running

On first boot, the VM generates its per-VM secrets and only then allows Syncope to start. Wait a couple of minutes after the first power-on before you expect the console.

systemctl is-active postgresql syncope nginx

All three report active.

Step 5 -Confirm the web applications answer

curl -s -o /dev/null -w 'console -> HTTP %{http_code}\n' http://127.0.0.1/syncope-console/
curl -s -o /dev/null -w 'enduser -> HTTP %{http_code}\n' http://127.0.0.1/syncope-enduser/
curl -s -o /dev/null -w 'rest api -> HTTP %{http_code}\n' http://127.0.0.1/syncope/rest/users/self

The two web applications return HTTP 302, which redirects to their login pages. The REST API returns HTTP 401 because it requires authentication. Both are healthy responses.

Step 6 -Retrieve your administrator password

Your VM generates a unique administrator password on first boot and writes it to a root-only file:

sudo grep -E '^SYNCOPE_(URL|ENDUSER_URL|ADMIN_USER|ADMIN_PASSWORD)' /root/syncope-credentials.txt

SYNCOPE_ADMIN_USER is admin and SYNCOPE_ADMIN_PASSWORD is the password. The same file also holds the self-service URL, the REST base URL and the PostgreSQL password.

Step 7 -Verify authentication against the REST API

Run the following commands to confirm that the published upstream default is refused and that your per-VM password is accepted:

PW=$(sudo grep '^SYNCOPE_ADMIN_PASSWORD=' /root/syncope-credentials.txt | cut -d= -f2-)
echo "upstream default admin/password -> HTTP $(curl -s -o /dev/null -w '%{http_code}' -u admin:password http://127.0.0.1/syncope/rest/users/self)"
echo "per-VM admin password -> HTTP $(curl -s -o /dev/null -w '%{http_code}' -u "admin:$PW" http://127.0.0.1/syncope/rest/users/self)"

The upstream default returns HTTP 401, and your per-VM password returns HTTP 200.

Step 8 -Sign in to the admin console

Open http://<vm-public-ip>/ in a browser. The root path redirects to the admin console. Sign in as admin with the password from Step 6.

After you sign in, the dashboard summarizes the deployment and the identity store.

Step 9 -Explore realms

Realms are the hierarchical containers that organize identities and scope administrative delegation. A fresh deployment has the root realm /, which you can view under Realms.

You can also read the realm tree over the REST API:

PW=$(sudo grep '^SYNCOPE_ADMIN_PASSWORD=' /root/syncope-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" -H 'Accept: application/json' http://127.0.0.1/syncope/rest/realms | jq -r '.result[] | "realm \(.fullPath) key=\(.key)"'

Step 10 -Create your first user

In the console, choose Realms, select the realm, open the USER tab and select the + button. Fill in the username, password and any attributes, and then save. The user appears in the list.

You can do the same over the REST API:

PW=$(sudo grep '^SYNCOPE_ADMIN_PASSWORD=' /root/syncope-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" -X POST -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Prefer: return-content' \
  -d '{"_class":"org.apache.syncope.common.lib.request.UserCR","realm":"/","username":"g.verdi","password":"Ch@ngeMe2026!","plainAttrs":[{"schema":"email","values":["g.verdi@example.com"]}]}' \
  http://127.0.0.1/syncope/rest/users | jq -r '.entity.username, .entity.key'

Step 11 -Review the bundled provisioning connectors

Syncope provisions identities into external systems through ConnId connector bundles. The image includes the standard set, ready to configure under Topology in the console.

PW=$(sudo grep '^SYNCOPE_ADMIN_PASSWORD=' /root/syncope-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" -H 'Accept: application/json' http://127.0.0.1/syncope/rest/connectors/bundles | jq -r '.[].bundleName' | sed 's/net.tirasa.connid.bundles.//' | sort -u

Step 12 - The self-service portal

End users manage their own profile, password and security question at http://<vm-public-ip>/syncope-enduser/. Self-registration and password reset are enabled by default. You control them from Configuration in the admin console.

curl -s -o /dev/null -w 'self service portal -> HTTP %{http_code}\n' http://127.0.0.1/syncope-enduser/

Enabling HTTPS

To serve Syncope over HTTPS, terminate TLS at nginx with a real domain that points at the VM's public IP. Install certbot and request a certificate, replacing the domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Syncope trusts the X-Forwarded-Proto header that nginx sets. Once the certificate is in place, the console and portal generate correct HTTPS links.

Backup and maintenance

All identity data lives in the PostgreSQL syncope database. Back it up with a standard dump:

sudo -u postgres pg_dump syncope | gzip > /var/backups/syncope-$(date +%F).sql.gz

Snapshot the VM's disk in Azure for a full point-in-time copy, and keep the OS patched with sudo apt update && sudo apt upgrade. Restart Syncope with sudo systemctl restart syncope.

Tomcat listens on 127.0.0.1:8080 only and is never exposed directly. All external traffic goes through nginx on port 80.

Application logs are under /var/log/syncope/:

sudo tail -n 20 /var/log/syncope/core.log

Support

SecureAnyCloud support is available 24/7 for this image. Contact us by email or chat for help with realm design, connector and resource configuration, provisioning and reconciliation tasks, workflow customization, TLS and backups.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Apache Syncope on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com