Known issues - AVEVA OMI 2023 R2 SP1 P01

Issue Number

Description

IMS 3686556

In some cases, logging in to the OMI Web Client fails if the user belongs to many groups in Active Directory (AD). This situation may lead to "token bloat," which occurs when the user access token has a large number of group memberships, thus causing the token to exceed the maximum size limit.

The OMI web client attaches the access token from Identity Manager for every web request after each successful user login. The access token includes all the roles, or Windows AD groups, to which the user belongs.

Workaround:

To reduce the network traffic and avoid login issues if the user has a large number of groups, filter the groups to which the user belongs and only include groups that are required by AVEVA software in the token. To filter the group, modify the appsettings.json file for the Identity Manager to include UserGroupFilters. The appsettings.json path is:
C:\Program Files (x86)\AVEVA\Platform Common Services\Management Server\appsettings.json

• Add required user group names to the UserGroupFilters section of the appsettings.json file. The UserGroupFilters option supports the use of the wildcard "*" at the end for the group name. In the example, RequiredUserGroup* allows RequiredUserGroupA, RequiredUserGroupB, etc.:
  

  "AppSetting": {

  "UserGroupFilters": [

  "RequiredUserGroup*"

  ],

• If you are using Entra ID (formerly called Azure Active Directory) and have a large number of user groups, you can use AzureAdGroupQueryOptions in addition to UserGroupFilters to improve performance. Like the UserGroupFilters option, the "*" wildcard can be used to match partial group names as shown in the following example.
  

  {

  "AzureAdGroupQueryOptions": {

  "Filters": [

  "GroupNamePrefix*",

  "GroupName"

  ]

  }

  }

Bug 3796387

In certain rare cases, the redundant AppEngines hosted on the backup platform node will show bad quality after the backup node is deployed. This error occurs as a result of a mismatch between the redundancy primitive IDs of the AppEngines.

Workaround:

Perform a redeploy of the redundant engines with the option Include redundant partner enabled. This will resolve the issue.