Troubleshooting connection problems

The Federated Identity Provider plugin supports registering up to 100 System Management Servers (SMS) or Redundant SSO Servers (RSSO) with an CONNECT account. If you exceed this limit, the Configurator displays the following error message:

To continue with the registration process, do these steps (detailed instructions follow).

1. Delete stale or unused application URLs from your CONNECT account. This step alone could resolve a limitation issue. If not, proceed with the following steps.

2. Acquire an access token.

3. Configure an application.

4. Add URLs to an existing application.

5. Add a new application.

6. Register the System Management Server or Redundant SSO Server with CONNECT via Powershell.

Delete stale or unused application URLs from CONNECT

7. Log into your CONNECT account.

   Note: You must be an administrator on your CONNECT account to perform this operation.

8. Select an application. The Edit Application slide-in pane appears.

9. Scroll down to the listed Redirect and Log out URLs.

10. Select the delete (trash can) icon to delete a URL.

    

11. Repeat step 4 for all stale or unused URLs for each application.

Acquire an access token

12. Open the browser and navigate to CONNECT.

13. Sign in with your user credentials, and if prompted, select the appropriate account.

14. Select Integrations from the left navigation pane.

    

15. Select Access tokens and then select Create access token to create a new access token.

    

16. For Access Token Configuration, select Advanced.

17. Select Account access token option.

    Ensure that the Roles include On-Premise Identity Integration (AIM) and record the access token.This is required later during the registration process.

Configure an application

Link the redirect URLs and logout URLs with an application. Each application can support 100 redirect URLs and 100 logout URLs.

18. Select Integrations from the left navigation pane.

19. Select Applications.

    By default, the screen displays the FID_PCSSystemManagementServer application. This application is automatically created by the Federated Identity Provider configurator plugin.

Add URLs to an existing application

20. If you have any other applications listed other than the default application, select the other application.

21. Confirm whether the application Type is set to PCS On-Premises Identity Integration.

    If the application Type is not set to PCS On-Premises Identity Integration, ignore the application as it was created for a different purpose.

22. Scroll through the redirect URLs and select Add redirect URL.

23. Add a redirect URL in the format https://{fqdn}/identitymanager/signin-avevaconnect (where {fqdn} is your fully qualified domain name, such as mycomputer.mydomain.com).

24. Scroll through the logout URLs and select Add logout URL.

25. Add a logout URL in the format https://{fqdn}/identitymanager/signedout-callback-avevaconnect (where {fqdn} is your fully qualified domain name, such as mycomputer.mydomain.com).

26. Record the Client ID for the application.

Add a new application

If the application FID_PCSSystemManagementServer is the only application, or if the other application has also reached the limit of 100 redirect URLs and 100 logout URLs, then create a new application before adding in your redirect and logout URLs.

27. Select Create application to create a new application for AIM integration.

28. Select the Type as PCS On-Premises Identity Integration.

29. Record the Client ID field. This is required later during the registration process.

30. Scroll through the redirect URLs and select Add redirect URL.

31. Add a redirect URL in the format https://{fqdn}/identitymanager/signin-avevaconnect (where {fqdn} is your fully qualified domain name, such as mycomputer.mydomain.com)..

32. Scroll through the logout URLs and select Add logout URL.

33. Add a logout URL in the format https://{fqdn}/identitymanager/signedout-callback-avevaconnect (where {fqdn} is your fully qualified domain name, such as mycomputer.mydomain.com)..

Register the System Management Server or Redundant SSO Server with CONNECT via Powershell

On the computer that is configured as the System Management Server (or RSSO), launch Powershell as an administrator and run the following commands:

$AccessToken = ConvertTo-SecureString -String "********" -AsPlainText -Force Add-PcsAuthenticationProvider -name AvevaConnect -ClientID ******** -Endpoint https://signin.connect.aveva.com -ServicesEndpoint https://services..aveva.com/ -AccessToken $AccessToken