Load balancer support

The AVEVA Web Client supports the use of a load balancer. The purpose of the load balancer is to:

• Provide a single controlled ingress point for all end-user web traffic across multiple customer networks.

• Improve system security by exposing only the Load Balancer FQDN to end users, thus avoiding exposure of internal IPs and system details.

• Block all direct access to backend machines and services.

Architecture

• Web Client, proxies, and related services are placed behind the load balancer.

• Backend systems are accessible only within the internal network.

• Cross-network and external access is permitted only through the Load Balancer.

This approach supports environments with:

• Multiple network zones.

• Strict segregation between secure and less secure networks.

Requirements

• System Platform 2023 R2 SP1 P04 onwards for OMI Web Client and System Platform 2026 onwards for InTouch Web Client.

• AVEVA Platform Common Services (PCS) version 8.2 or higher installed on the System Management Server (SMS) node. PCS 8.2.1 is included with System Platform 2023 R2 SP1 P04.

Configuration

Environment Setup

Set up the following three machines:

• Machine 1: IDE

• Machine 2: SMS

• Machine 3: NGINX (Load Balancer)

NGNIX config file:

Configure NGINX as the Load Balancer

1. Install NGINX on Machine 3.

2. Update the NGINX configuration file with the appropriate load-balancing settings.

3. Configure the backend servers (Machine 1 and Machine 2) in the upstream block.

4. Save the changes and reload the NGINX service.

Commands for ngnix operations:

Open Command prompt as admin and below command can be used

cd C:\nginx-1.29.1

start nginx :: start

nginx -t :: test config syntax

nginx -s reload :: reload config (no downtime)

nginx -s stop :: immediate stop

nginx -s quit :: graceful stop

To see a sample ngnix.config file follow link: Sample ngnix_configfile 1.txt file for reference

Please follow the steps mentioned in confluence page for NGNIX configuration.

PCS confluence page link: PCS V8.2 + NGINX Reverse Proxy Setup (with Forwarded Headers & Self-Signed SSL) - Platform Common Services - AVEVA RnD Confluence

Build Installation:

5. Install the same build on both Machine 1 and Machine 2.

6. Install App server and Licensing components on Machine1, configure normally and restart machine after build installation.

   

7. Install App server components with out GR and licensing components on Machine 2 , configure normally and restart machine after build installation.

   

SMS Machine Configuration (Machine 2)

8. Open Configurator and configure SMS by selecting “This Machine is the SMS”.

   

9. Configure the AVEVA Web Client Settings plugin by specifying the required website name. Then, add the Load Balancer FQDN in the ‘Additional AVEVA Web Client Host Alias’ field and complete the configuration.

   

10. Configure all remaining required plugins in Configurator.

11. Restart the machine and reconnect.

12. Remove the ForwardedHeaders entries from the following file:

    C:\Program Files (x86)\AVEVA\Platform Common Services\Management Server\appsettings.json

    

13. Add the ForwardedHeaders configuration, including ForwardLimit and KnownProxies, to the following file:

    C:\Program Files (x86)\AVEVA\Platform Common Services\Management Server\userappsettings.json

Example:

"ForwardedHeaders": {

"Enabled": true,

"ForwardLimit": 2,

"KnownProxies": [

"10.231.154.164",

"10.231.154.95"

]

},

14. Restart the AVEVA Identity Manager service from the Services.

    

IDE Machine Configuration (Machine 1)

15. Open Configurator and configure SMS by selecting the first option, then provide the FQDN of Machine 2.

    

16. Configure the AVEVA Web Client Settings plugin by specifying the required website name. Then, add the Load Balancer FQDN in the ‘Additional AVEVA Web Client Host Alias’ field and complete the configuration.

    

17. Configure all remaining required plugins in Configurator.

18. Restart the machine and reconnect.

19. Update the LoadBalancerUse key to true in the following file if it is currently set to false:

    C:\Program Files (x86)\Common Files\ArchestrA\Services\Proxyserver\appsettings.json

Example:

"LoadBalancerUse": true

20. Restart the vcp services from Task Manager if webviewengine is deployed.

    

21. Import package from \\dev\link\devtransfer\SwapnaPriya\security

22. Create instance of imported viewapp and deploy it.

Validate the Load Balancer Setup

23. Browse the load balancer URL and verify NGNIX is started properly or not in Machine1.

    https://<LoadBalancerFQDN>/

Example:

https://proxyserver1.indlab.dev.wonderware.com/

24. If you see any certificate issue, install certificate to local machine and place it in trustedrootcertificate location.

WebOMI testing with load balancer:

25. On the Machine1, browse the following URL to verify that the load balancer configuration is working correctly:

    https://<LoadBalancerFQDN>/<WebsiteName>/authenticate/.well-known/openid-configuration

The OpenID configuration response should be returned successfully through the load balancer URL. AIM machine address should not be visible in the response, load balancer machine address should be visible.

Example:

https://proxyserver1.indlab.dev.wonderware.com/avevaweb/authenticate/.well-known/openid-configuration

26. Browse the load balancer URL to verify the application. Data should be properly rendered.

Example:

https://proxyserver1.indlab.dev.wonderware.com/avevaweb/

Output should be displayed as below.

27. Validate by configuring different securities in IDE.

    • None

    • Group based

    • Azure AD

28. Refer documents Microsoft Entra ID authentication and Complete configuration in Microsoft Entra ID for Azure AD setup.

    • Aveva Connect

29. Refer documents Configure Federated Single Sign-On (SSO) with CONNECT and Complete configuration in CONNECT for AVEVA Connect configuration.

NOTE: If you are configuring AVEVA CONNECT, ensure that the load balancer URL is registered as an allowed callback URL in CONNECT.