Installation using a JSON

These installation instructions will create a secure-by-default initial configuration for the system. This includes a secure and encrypted https communication with the WebServer and the necessary Administration Profile needed to connect and continue configuration.

This page provides an example JSON which can be used to configure a Node.

The steps below continue directly from the steps here. Therefore, before working through this example, ensure that you have completed the previous instructions.

First, in the "inmation-config.yaml" file, add the following and save the changes:

startup:
    InitJsonFile: C:\<installation_folder>\inmation.root\bin\inmation-startup.json
The full path to the startup file must be defined in the yaml file.

Creating the JSON Startup File

  1. Create an "inmation-startup.json" file in the "bin" folder (C:\<installation_folder>\inmation.root\bin) and add the following:

    The order in which the items are created and updated is important. Please ensure that if the script is updated to configure additional objects that the objects are created/updated in order. 
    [
    {
        "type": "mass",
        "items": [
            {
                "operation": "UPDATE",
                "class": "NodeDelegate",
                "owner": "/Home",
                "basePath": "/",
                "ObjectName": "Home Delegate",
                "children": [
                    {
                        "operation": "UPSERT",
                        "class": "ProfileGroup",
                        "owner": "/Home",
                        "ObjectName": "Admin Group",
                        "children": [
                            {
                                "class": "Profile",
                                "owner": "/Home",
                                "ObjectName": "so-Home",
                                "AdministrativeGroup": "ADMIN",
                                "ProfileModelAccess": [
                                    "PRF_MDL_ACC_SCR",
                                    "PRF_MDL_ACC_DEL",
                                    "PRF_MDL_ACC_SYS",
                                    "PRF_MDL_ACC_EQU",
                                    "PRF_MDL_ACC_ACC",
                                    "PRF_MDL_ACC_IO"
                                ],
                                "ProfileUserAccess": [
                                    "USR_ACC_CTRL_DATA_WEB",
                                    "USR_ACC_CTRL_OPC_HDA",
                                    "USR_ACC_CTRL_OPC_DA",
                                    "USR_ACC_CTRL_OPC_AE",
                                    "USR_ACC_CTRL_OPC_UA"
                                ],
                                "children": [
                                    {
                                        "operation": "UPSERT",
                                        "class": "UserIdentifier",
                                        "owner": "/Home",
                                        "ObjectName": "User Identifier IWA",
                                        "AuthID": "<user_sid>" (1)
                                    }
                                ]
                            }
                        ]
                    }
                ]
            },
            {
                "operation": "UPDATE",
                "class": "Node",
                "owner": "/Home",
                "basePath": "/",
                "ObjectName": "Home",
	            "ProductKey": "",
                "children": [
                    {
                        "operation": "UPSERT",
                        "class": "WebServer",
                        "owner": "/Home",
                        "ObjectName": "Webserver",
                        "WebServerInsecureConnection.WebServerListenPort": 8008,
                        "WebServerInsecureConnection.WebServerConnectionEnabled": 0,
                        "WebServerProfile": "/Home Delegate/Admin Group/so-Home",
                        "WebServerSecureConnection.WebServerListenSslPort": 8009,
                        "WebServerStatic.WebServerStaticEnabled": true,
                        "WebServerSecuritySettings.WebServerAllowedOrigins.WebServerOrigin": { "https://<domain>.<tld>"}, (2)
                        "children": [
                            {
                                "operation": "UPSERT",
                                "class": "IwaSecurityProvider",
                                "owner": "/Home",
                                "ObjectName": "IWA Security Provider",
                                "ClaimMatching.UserIdClaim": "user_sid",
                                "ClaimMatching.UserNameClaim": "user_sam_name"
                            }
                        ]
                    }
                ]
            }
        ]
    }
]
    1 - See User Identifier Object Guide for how to find the user_sid for AuthID property configuration.
    2 - The "WebServerAllowedOrigins" property should be configured for your own system. The value of the property should be the domain name for the hosted WebStudio application. For example, if the WebStudio application is hosted at "https://mydomain.com", then the value of the property should be "https://mydomain.com". See WebServer Object Guide for more information.

    This simple example will create the Node as well as a corresponding Node Delegate object. It will also create Profile Group, Profile and User Identifier objects.

    A WebServer will also be created which can be used to connect to WebStudio and an IWA Security Provider object is configured for authentication purposes. Alternative authentication methods can be used - see the Alternative Authentication Options section below for details.

    In this example, the "AuthID" property for the User Identifier object should be configured to match your own system. The value of this property should be the Windows user security identifier, which can be found by running the whoami /user command in powershell.

  2. Save the changes to the "inmation-startup.json" file and then open a Powershell window as an administrator. In this window, navigate to the "bin" folder (C:\<installation_folder>\inmation.root\bin).

  3. Run the following:

    .\inmation.exe --install Node

    If the configuration files are not located in the same folder as the executable, then the following should be used instead, replacing the values in the angular brackets with the paths to the configuration file and the JSON startup file respectively:

    .\inmation.exe --install Node --cfg-file <path_to_config_file> --startup-init-json-file <path_to_json>

Alternative Authentication Options

In the example above, Integrated Windows Authentication is used. However, the system also supports OIDC and Built-In authentication methods. These methods require different configuration options in the JSON startup file.

OIDC Authentication

To use OIDC Authentication, an OIDC Security Provider object is required. For OIDC Authentication, replace the script in step 1 above with the following script.

[
    {
        "type": "mass",
        "items": [
            {
                "operation": "UPDATE",
                "class": "NodeDelegate",
                "owner": "/Home",
                "basePath": "/",
                "ObjectName": "Home Delegate",
                "children": [
                    {
                        "operation": "UPSERT",
                        "class": "ProfileGroup",
                        "owner": "/Home",
                        "ObjectName": "Admin Group",
                        "children": [
                            {
                                "class": "Profile",
                                "owner": "/Home",
                                "ObjectName": "so-Home",
                                "AdministrativeGroup": "ADMIN",
                                "ProfileModelAccess": [
                                    "PRF_MDL_ACC_SCR",
                                    "PRF_MDL_ACC_DEL",
                                    "PRF_MDL_ACC_SYS",
                                    "PRF_MDL_ACC_EQU",
                                    "PRF_MDL_ACC_ACC",
                                    "PRF_MDL_ACC_IO"
                                ],
                                "ProfileUserAccess": [
                                    "USR_ACC_CTRL_DATA_WEB",
                                    "USR_ACC_CTRL_OPC_HDA",
                                    "USR_ACC_CTRL_OPC_DA",
                                    "USR_ACC_CTRL_OPC_AE",
                                    "USR_ACC_CTRL_OPC_UA"
                                ],
                                "children": [
                                    {
                                        "operation": "UPSERT",
                                        "class": "UserIdentifier",
                                        "owner": "/Home",
                                        "ObjectName": "User Identifier OIDC",
                                        "AuthID": "<oid>" (1)
                                    }
                                ]
                            }
                        ]
                    }
                ]
            },
            {
                "operation": "UPDATE",
                "class": "Node",
                "owner": "/Home",
                "basePath": "/",
                "ObjectName": "Home",
                "children": [
                    {
                        "operation": "UPSERT",
                        "class": "WebServer",
                        "owner": "/Home",
                        "ObjectName": "Webserver",
                        "WebServerInsecureConnection.WebServerListenPort": 8008,
                        "WebServerInsecureConnection.WebServerConnectionEnabled": 0,
                        "WebServerProfile": "/Home Delegate/Admin Group/so-Home",
                        "WebServerSecureConnection.WebServerListenSslPort": 8009,
                        "WebServerStatic.WebServerStaticEnabled": true,
                        "WebServerSecuritySettings.WebServerAllowedOrigins.WebServerOrigin": { "https://<domain>.<tld>"}, (5)
			            "children": [
                            {
                                "operation": "UPSERT",
                                "class": "OidcSecurityProvider",
                                "owner": "/Home",
                                "ObjectName": "OIDC Security Provider",
                                "ClaimMatching.UserIdClaim": "oid",
                                "ClaimMatching.UserNameClaim": "upn",
                                "OidcConfiguration.OidcClientId": "<client_ID>", (2)
                                "OidcConfiguration.OidcConfigurationUrl": "<OIDC_provider_URL>", (3)
                                "OidcConfiguration.OidcRedirectBaseUrl": "<redirect_URL>" (4)
                            }
                        ]
                    }
                ]
            }
        ]
    }
]
1 - The oid for OIDC authentication is often a Microsoft Entra ID. See User Identifier Object Guide for more information.
2 - See OIDC Security Provider Object Guide for more information.
3 - See OIDC Security Provider Object Guide for more information.
4 - See OIDC Security Provider Object Guide for more information.
5 - The "WebServerAllowedOrigins" property should be configured for your own system. The value of the property should be the domain name for the hosted WebStudio application. For example, if the WebStudio application is hosted at "https://mydomain.com", then the value of the property should be "https://mydomain.com". See WebServer Object Guide for more information.
The "AuthID" for the User Identifier object in the example above should be configured for your own system. This value can be obtained from your selected authentication provider, for example Microsoft Entra ID.
The OIDC Configuration options should be configured for your own system. The "OidcClientId" is the identifier assigned to the application by the OIDC provider and the "OidcConfigurationUrl" is the URL of the OIDC provider login. The "OidcRedirectBaseUrl" is the URL to redirect the user to once authenticated.

Built-In Authentication

To use Built-In Authentication, a Built-In Security Provider object must be configured. In addition, credentials must be defined and enabled for the Profile. To install the Node with Built-In Authentication enabled, replace the script in step 1 above with the following:

[
    {
        "type": "mass",
        "items": [
            {
                "operation": "UPDATE",
                "class": "NodeDelegate",
                "owner": "/Home",
                "basePath": "/",
                "ObjectName": "Home Delegate",
                "children": [
                    {
                        "operation": "UPSERT",
                        "class": "ProfileGroup",
                        "owner": "/Home",
                        "ObjectName": "Admin Group",
                        "children": [
                            {
                                "class": "Profile",
                                "owner": "/Home",
                                "ObjectName": "so-Home",
                                "AdministrativeGroup": "ADMIN",
                                "InmationProfileCredentials.Available": true,
                                "InmationProfileCredentials.PasswordHashed": "<password>", (1)
                                "ProfileModelAccess": [
                                    "PRF_MDL_ACC_SCR",
                                    "PRF_MDL_ACC_DEL",
                                    "PRF_MDL_ACC_SYS",
                                    "PRF_MDL_ACC_EQU",
                                    "PRF_MDL_ACC_ACC",
                                    "PRF_MDL_ACC_IO"
                                ],
                                "ProfileUserAccess": [
                                    "USR_ACC_CTRL_DATA_WEB",
                                    "USR_ACC_CTRL_OPC_HDA",
                                    "USR_ACC_CTRL_OPC_DA",
                                    "USR_ACC_CTRL_OPC_AE",
                                    "USR_ACC_CTRL_OPC_UA"
                                ]
                            }
                        ]
                    }
                ]
            },
            {
                "operation": "UPDATE",
                "class": "Node",
                "owner": "/Home",
                "basePath": "/",
                "ObjectName": "Home",
                "children": [
                    {
                        "operation": "UPSERT",
                        "class": "WebServer",
                        "owner": "/Home",
                        "ObjectName": "Webserver",
                        "WebServerInsecureConnection.WebServerListenPort": 8008,
                        "WebServerInsecureConnection.WebServerConnectionEnabled": 0,
                        "WebServerProfile": "/Home Delegate/Admin Group/so-Home",
                        "WebServerSecureConnection.WebServerListenSslPort": 8009,
                        "WebServerStatic.WebServerStaticEnabled": true,
                        "WebServerSecuritySettings.WebServerAllowedOrigins.WebServerOrigin": { "https://<domain>.<tld>"} (2)
			            "children": [
                            {
                                "operation": "UPSERT",
                                "class": "BuiltInSecurityProvider",
                                "owner": "/Home",
                                "ObjectName": "Built-In Security Provider",
                                "ClaimMatching.UserIdClaim": "profile",
                                "ClaimMatching.UserNameClaim": "username"
                            }
                        ]
                    }
                ]
            }
        ]
    }
]
1 - Replace with your own choice of password that follows the system Password Policy.
2 - The "WebServerAllowedOrigins" property should be configured for your own system. The value of the property should be the domain name for the hosted WebStudio application. For example, if the WebStudio application is hosted at "https://mydomain.com", then the value of the property should be "https://mydomain.com". See WebServer Object Guide for more information.
The "PasswordHashed" property in the Profile object should be configured according to the Password Policy. It is important to note that anyone with access to this JSON file will be able to view/edit this field. This is not recommended in production environments.