Troubleshooting connection problems

The Federated Identity Provider plugin supports registering up to 100 System Management Servers (SMS) or Redundant SSO Servers (RSSO) with an CONNECT account. If you exceed this limit, the Configurator displays the following error message:

To continue with the registration process, complete the following steps. Detailed instructions are provided in the sections that follow.

1. Delete stale or unused application URLs from your CONNECT account.

   This step alone might resolve the limitation issue. If the issue persists, continue with the remaining steps.

2. Acquire an access token

3. Configure an application

4. Add URLs to an existing application

5. Add a new application

6. Register the System Management Server or Redundant SSO Server with CONNECT using Powershell

Delete stale or unused application URLs from CONNECT

7. Sign in to your CONNECT account.

   Note: You must be an administrator for the CONNECT account to perform this operation.

8. Select an application. The Edit Application slide-in pane opens.

9. Scroll to the listed Redirect URLs and Log out URLs.

10. Select the delete (trash can) icon next to the URL you want to remove and repeat this step for all stale or unused URLs in each application.

    

Acquire an access token

11. Open the browser and go to CONNECT.

12. Sign in with your user credentials, and if prompted, select the appropriate account.

13. From the left navigation pane, select Integrations.

    

14. Select Access tokens, and then select Create access token to create a new access token.

    

15. In Access Token Configuration, select Advanced.

16. Select Account access token option.

    Ensure that Roles includes On-Premise Identity Integration (AIM), and record the access token for use later in the registration process.

Configure an application

Link the redirect URLs and logout URLs with an application. Each application supports up to 100 redirect URLs and 100 logout URLs.

17. From the left navigation pane, select Integrations.

18. Select Applications.

    By default, the screen displays "FID_PCSSystemManagementServer" application. This application is automatically created by the Federated Identity Provider configurator plugin.

Add URLs to an existing application

19. If applications other than the default application are listed, select the appropriate application.

20. Verify the application Type is set to PCS On-Premises Identity Integration. If the application Type is not set to PCS On-Premises Identity Integration, ignore the application.

21. Scroll to the redirect URLs section and select Add redirect URL.

22. Add a Redirect URL in the following format: "https://{fqdn}/identitymanager/signin-avevaconnect" (where {fqdn} is your fully qualified domain name. i.e. mycomputer.mydomain.com)

23. Scroll to the Logout URLs section and select Add logout URL.

24. Add a Logout URL in the following format: "https://{fqdn}/identitymanager/signedout-callback-avevaconnect" (where {fqdn} is your fully qualified domain name. i.e. mycomputer.mydomain.com)

25. Record the Client ID for the application.

Add a new application

If the application "FID_PCSSystemManagementServer" is the only application, or if any other application has reached the limit of 100 redirect URLs and 100 logout URLs, then create a new application before adding in your redirect URLs and logout URLs.

26. Select Create application to create a new application for AIM integration.

27. Select the Type as PCS On-Premises Identity Integration.

28. Record the Client ID field. This is required later during the registration process.

29. Scroll to the redirect URLs section and select Add redirect URL.

30. Add a redirect URL in the following format: "https://{fqdn}/identitymanager/signin-avevaconnect" (where {fqdn} is your fully qualified domain name. i.e. mycomputer.mydomain.com)

31. Scroll through the logout URLs section and select Add logout URL.

32. Add a logout URL in the following format: "https://{fqdn}/identitymanager/signedout-callback-avevaconnect" (where {fqdn} is your fully qualified domain name. i.e. mycomputer.mydomain.com)

Register the System Management Server or Redundant SSO Server with CONNECT using Powershell

On the computer configured as the System Management Server (or RSSO), open Powershell as an administrator and run the following commands:

$AccessToken = ConvertTo-SecureString -String "********" -AsPlainText -Force Add-PcsAuthenticationProvider -name AvevaConnect -ClientID ******** -Endpoint https://signin.connect.aveva.com -ServicesEndpoint https://services..aveva.com/ -AccessToken $AccessToken