Authentication and Tokens

The MES Web API is intended to be used from a web application with user interaction such as the MES Web Portal or Work Tasks Enterprise Console. The user will be prompted to log in with their user credentials through AVEVA Identity Manager (AIM). Once the user is authenticated, the client application will have a bearer token that is passed to the MES middleware as part of the Web API header call. This is managed by the application as it knows it is registered with AIM. The MES middleware will then check to see if the user is a valid MES user and either allow or deny the call.

The MES middleware also has the ability to handle a call from another application without a known user. This service-to-service mechanism is similar to how the MES background maintenance tasks and the MES Application Server Objects interact with the MES middleware. With this approach, the service must still register with AIM.  An example is that a workflow is triggered from some external source and has an activity to call the MES Web API. This call will not have any user context and will still complete using the service-to-service flow.

For service-to-service, the MES middleware uses the default background user configured for the User ID for background tasks system attribute (configured in MES Client; attr_id 199 in the System_Attr table). The default entry for this system attribute is Default Background User. If the default background user is changed, make sure that the new user is a valid, active MES user (MES users are configured using MES Client). Note that MES Web API caches the default background user.So changing the default background user requires either restarting the MES middleware to make the change effective immediately or waiting for up to an hour for the middleware to be updated automatically with it.

Note the following about the MES Web API and AIM authentication tokens:

• The MES Web API is used with the MES Web Portal and Model Driven MES content through Work Tasks. Both use AIM tokens for user logins. Work Tasks also can use AIM tokens for service-to-service connections.
• If the System Management Server on which AIM runs is offline and an authentication token cannot be obtained or verified for an MES Web API call, a 500 error is returned.