Authentication

The AVEVA Integration Service Data API SDK supports two authentication methods: NTLM (Windows domain) and AVEVA Connect (token-based).

NTLM Authentication

NTLM uses your current Windows domain credentials; no tokens or passwords need to be handled explicitly.

• Requires the application to run on a domain-joined machine

• Uses the current user's Windows credentials automatically

• Compatible with Active Directory environments

• Best suited for on-premises or corporate-network deployments

Setup

var host = "https://your-ais-server/api/v1/datasources";

// NTLM is the default; no token needed

var client = DataApiClientFactory.CreateDataApiClient<EngineeringClient>(

host: host,

authType: AuthenticationType.NTLM

);

How it Works

Under the hood, the SDK configures HttpClientHandler with:

new HttpClientHandler

{

UseDefaultCredentials = true,

PreAuthenticate = true

};

The .NET runtime negotiates NTLM or Kerberos with the server — no extra code required.

App.config

<appSettings>

<add key="AuthenticationType" value="NTLM"/>

</appSettings>

Troubleshooting NTLM

AVEVA Connect Authentication

AVEVA Connect uses OAuth 2.0-style access tokens passed as Bearer headers.

• Token obtained from AVEVA Connect identity service

• Token sent as Authorization: Bearer <token> on every request

• Works in cloud and hybrid environments

• Tokens typically expire — implement refresh logic

Token Acquisition

Tokens are retrieved from the AVEVA Connect identity service using client credentials:

using System.Net.Http;

var tokenClient = new HttpClient();

var tokenRequest = new HttpRequestMessage(

HttpMethod.Post,

"https://your-connect-server/connect/token")

{

Content = new FormUrlEncodedContent(new[]

{

new KeyValuePair<string, string>("client_id", "your-client-id"),

new KeyValuePair<string, string>("client_secret", "your-client-secret"),

new KeyValuePair<string, string>("grant_type", "client_credentials"),

new KeyValuePair<string, string>("scope", "api")

})

};

var response = await tokenClient.SendAsync(tokenRequest);

var json = await response.Content.ReadAsStringAsync();

// Parse json to extract access_token

Create a Connect-Auth Client

var token = await GetAccessTokenFromConnect();

var client = DataApiClientFactory.CreateDataApiClient<EngineeringClient>(

host: host,

authType: AuthenticationType.Connect,

token: token

);

Verify Token Works

try

{

var sources = await client.GetDataSources("");

Console.WriteLine("Token is valid");

}

catch (Exception ex)

{

Console.WriteLine($"Token validation failed: {ex.Message}");

}

Troubleshooting Connect

Authentication Configuration

Select Authentication at Runtime

public class DataApiFactory

{

public static T CreateClient<T>(

string host,

string authType,

string token = null) where T : class

{

var authTypeEnum = authType == "Connect"

? AuthenticationType.Connect

: AuthenticationType.NTLM;

return DataApiClientFactory.CreateDataApiClient<T>(

host: host,

authType: authTypeEnum,

token: authType == "Connect" ? token : ""

);

}

}

Environment-Based Authentication

public IDataApiClient CreateDataApiClient(IConfiguration config)

{

var env = config["ASPNETCORE_ENVIRONMENT"];

var host = config["DataApi:Host"];

if (env == "Development")

{

return DataApiClientFactory.CreateDataApiClient<EngineeringClient>(

host, AuthenticationType.NTLM);

}

else

{

var token = config["DataApi:Token"]; // From secure storage

return DataApiClientFactory.CreateDataApiClient<EngineeringClient>(

host, AuthenticationType.Connect, token: token);

}

}

Secure Token Storage

Never hardcode tokens. Use one of:

• Azure Key Vault

  var tokenVault = new KeyVaultClient(/* credentials */);

  var token = await tokenVault.GetSecretAsync("ais-token");

• Secret Manager (Development)

  var token = userSecretsConfig["DataApi:Token"];

• Environment Variables

  var token = Environment.GetEnvironmentVariable("AIS_TOKEN");

• Configuration Service

  var token = await configService.GetSecretAsync("ais-token");

Token Management

Token Cache with Proactive Refresh

public class TokenManager

{

private string _cachedToken;

private DateTime _tokenExpiry;

public async Task<string> GetValidToken(bool forceRefresh = false)

{

// Refresh 5 minutes before expiry

if (!forceRefresh

&& _cachedToken != null

&& DateTime.UtcNow < _tokenExpiry.AddMinutes(-5))

{

return _cachedToken;

}

_cachedToken = await RetrieveNewTokenAsync();

_tokenExpiry = DateTime.UtcNow.AddHours(1); // Adjust per Connect config

return _cachedToken;

}

private async Task<string> RetrieveNewTokenAsync()

{

// Call your AVEVA Connect token endpoint here

throw new NotImplementedException();

}

}

Rotating Token Client

public class RotatingTokenClient

{

private readonly ISecureTokenStore _tokenStore;

private string _cachedToken;

private DateTime _tokenRefreshTime;

public async Task<string> GetCurrentToken()

{

if (DateTime.UtcNow > _tokenRefreshTime)

{

_cachedToken = await _tokenStore.GetTokenAsync("ais-token");

_tokenRefreshTime = DateTime.UtcNow.AddMinutes(55);

}

return _cachedToken;

}

}

Secure Token Store Interface

public interface ISecureTokenStore

{

Task<string> GetTokenAsync(string name);

Task SetTokenAsync(string name, string token);

}

Troubleshooting

NTLM Issues

Problem: 401 with NTLM

• Verify domain membership: whoami /all

• Check domain controller connectivity: ping <domain-controller>

• Confirm server accepts NTLM (some servers require Kerberos)

Problem: "Unable to complete NTLM handshake"

• List Kerberos tickets: klist

• Verify SPN configured on DataAPI server

• Check server and client clocks are synchronized (Kerberos requires ±5 min)

• Connect/Token Issues

Problem: "Invalid token" (401)

• Check token hasn't expired

• Verify token is a valid JWT

• Confirm token scope includes API access

• Request a new token from Connect service

Problem: Cannot reach Connect service

• Verify Connect service URL

• Test: Test-NetConnection -ComputerName <connect-host> -Port 443

• Verify firewall allows outbound HTTPS

• Check DNS resolution

General Issues

Problem: Authentication works locally but not in CI/production

• Confirm same auth method is configured

• For NTLM: ensure service account is domain-joined

• For Connect: ensure token is available in target environment

• Check firewall rules in target environment