Start and run Web Client (on-premise)

When Operations Control connected experience is enabled in the Configurator, you will be prompted to authenticate with AVEVA Identity Manager, when the Web Client is launched for the first time. You have to use your AVEVA ID and password to sign in. In the subsequent launches of Web Client, you will be authenticated with Single Sign-On (SSO). If you have already signed in the AVEVA Identity Manager while launching the other AVEVA applications like Application Manager, and WindowMaker, and if you have valid entitlements and permissions, you will be signed in using SSO. Note that SSO between desktop applications and Web Client will work only when desktop applications use the system browser to authenticate. SSO is browser specific. That is, if you had entered the credentials in one browser for example Google Chrome, and if you open the Web Client in another browser for example Microsoft Edge, or if you open Web Client in incognito mode, then you will have to enter the credentials again.

Note: If you are upgrading from System Platform 2023 to System Platform 2023 R2, and if you have already configured AVEVA Identity Manager in System Platform 2023, then post-upgrade you must reconfigure user authentication by switching to windows authentication and then to user authentication to make Web Client work in Operations Control connected experience. That is, you have to first select Windows Authentication under Industrial Graphics Server > Authentication Settings and click Configure. Then, again select User Authentication under Industrial Graphics Server > Authentication Settings and click Configure.

Work with Web Client (on premise) in Operations Control connected experience:

1. To enable the Web Client in Operations Control connected experience, in the left pane of the Configurator, under Industrial Graphics Server > Authentication Settings, select User Authentication and then click Configure.

2. Launch the Web Client in a browser.

   If you are launching Web Client for the first time on this node and no other Operations Control product was launched and authenticated on the same node before, then you are prompted to authenticate with AVEVA Identity Manager on a web browser or embedded browser (based on the choice that you have made while configuring Authentication tab in System Management Server of the Configurator). If you have already launched and authenticated Web Client on this node or launched and authenticated any other Operations Control product on the same node before, then you will be authenticated using Single Sign-On. For more information refer to Authenticate using AVEVA Identity Manager section.

3. Enter your email address that is registered with an CONNECT account to sign in to AVEVA Identity Manager and the respective password.

   On successful authentication and valid entitlement, the Web Client runs. You will not have to enter the credentials on subsequent logins as it signs in using Single Sign-On (SSO).

   Note: If the credentials are not correct then you will be prompted with an error message. Contact your administrator for the credentials and enter the correct credentials again.

Scenarios for Invalid Entitlements

This section describes the different scenarios that could occur if the entitlement is not valid.

• If you do not have access to entitlement, WindowViewer will launch in Demo mode.

  Note: Demo mode will be offered, if application has 64 tags or less configured. Demo mode will not be offered if application has more than 64 tags configured.

• If current authentication is unsuccessful, but if you have successfully authenticated and logged in at least one time on that node previously, WindowViewer will launch in Read-Only mode. Read-Only mode will continue to run until that locally stored expiration date passes. When the expiration date has passed, application will run in Demo mode.

• If you launch the WindowViewer and cancel authentication, and there is a login timeout, WindowViewer will start in Demo mode or Read-Only mode.

• If you try to authenticate and only receive a valid AVEVA Identity Manager token, and is disconnected from CONNECT, then on-premise functionality will work and Cloud access will fail. You need to login to regain cloud access.

• If you attempt to authenticate, and do not receive a valid AVEVA Identity Manager token, and is disconnected from AVEVA Identity Manager, WindowViewer will start in Demo mode and Read-Only mode.

• When WindowViewer is running successfully, a check is made for valid AVEVA Identity Manager and CONNECT refresh tokens.If only a valid AVEVA Identity Manager token is received, and AVEVA Identity Manager is disconnected from CONNECT, on-premise functionality will work, but cloud access will fail.

• If disconnected from AVEVA Identity Manager, WindowViewer will start in Demo mode or Read-Only mode.

Unsupported Functionalities

The following features are not supported by Web Client:

• Windows authentication is not supported in Operations Control connected experience.

• Share functionality is not supported in Operations Control connected experience.

• The Web Client does not support redundant single sign on functionality in any licensing mode.

Licensing and Entitlements for Web Client in Operations Control connected experience

If you switch from other licensing mode to Operations Control connected experience, you have to reconfigure the Authentication settings.

In Operations Control connected experience when InTouchView Application checkbox is enabled, to launch the Web Client you need to have entitlement to a Supervisory subscription in your account. Once you start the web server, if you modify the InTouchView Application checkbox then you have to restart the CONNECT Industrial Graphics Web Server.