ITAA Server AdminManual
ITAA Server AdminManual
Administrator Manual
aveva.com
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved.
No part of this documentation shall be reproduced, stored in a retrieval system, or transmitted by any means,
electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of AVEVA.
No liability is assumed with respect to the use of the information contained herein.
Although precaution has been taken in the preparation of this documentation, AVEVA assumes no responsibility
for errors or omissions. The information in this documentation is subject to change without notice and does not
represent a commitment on the part of AVEVA. The software described in this documentation is furnished under
a license agreement. This software may be used or copied only in accordance with the terms of such license
agreement.
ArchestrA, Avantis, Citect, DYNSIM, eDNA, EYESIM, InBatch, InduSoft, InStep, IntelaTrac, InTouch, OASyS,
PIPEPHASE, PRiSM, PRO/II, PROVISION, ROMeo, SIM4ME, SimCentral, SimSci, Skelta, SmartGlance, Spiral
Software, WindowMaker, WindowViewer, and Wonderware are trademarks of AVEVA and/or its subsidiaries. An
extensive listing of AVEVA trademarks can be found at: https://sw.aveva.com/legal. All other brands may be
trademarks of their respective owners.
Publication date: Wednesday, May 4, 2022
Contact Information
AVEVA Group plc
High Cross
Madingley Road
Cambridge
CB3 0HB. UK
https://sw.aveva.com/
For information on how to contact sales and customer training, see https://sw.aveva.com/contact.
For information on how to contact technical support, see https://sw.aveva.com/support.
To access the AVEVA Knowledge and Support center, visit https://softwaresupport.aveva.com.
Contents
Welcome .............................................................................................................. 5
Documentation Conventions .................................................................................................................5
Technical Support .................................................................................................................................6
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 3
Security ................................................................................................................................................... 25
Logging .................................................................................................................................................... 26
Advanced (For Administrator Use Only) ................................................................................................. 26
InTouch Access Anywhere Web Component ........................................................................................ 26
Installation with InTouch Access Anywhere Server ................................................................................... 26
Modifying the InTouch Access Anywhere Interface................................................................................... 27
Modifying the Name of the Connection..................................................................................................... 27
Secure Connections............................................................................................................................. 27
Secured WebSocket Communication to Remote Desktops ....................................................................... 28
Secured WebSocket Connection Using InTouch Access Anywhere Secure Gateway ................................ 29
Benefit of Using a Trusted Certificate ........................................................................................................ 29
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 4
Welcome
Use AVEVA InTouch Access Anywhere™ to access InTouch applications hosted on Remote Desktop Servers with
HTML5-compatible web browsers. Follow the instructions in this book to begin using InTouch Access Anywhere.
This manual assumes knowledge of the following:
InTouch
Enabling and configuring Remote Desktop Services (RDS) on Windows operating systems
Firewall configuration
Web server administration
Important terminology used in this book includes the following:
RDP - Remote Desktop Protocol. A remote display protocol developed by Microsoft. RDP is a standard
component of Microsoft Windows.
RDP Host - a Windows system that can be remotely accessed using Microsoft RDP, such as a Remote
Desktop Server (RDS Session Host) or Windows workstation with remote access enabled.
RDS - Remote Desktop Services, which includes the Remote Desktop Protocol (RDP).
HTML5 - a new update to the HTML specification. Extends HTML with new features and functionality for
communication, display, etc.
WebSocket - a bi-directional, full-duplex communication mechanism introduced in the HTML5 specification.
SSL - Secure Sockets Layer. A cryptographic protocol that provides communications security over the
Internet.
Documentation Conventions
This documentation uses the following conventions:
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 5
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Welcome
Technical Support
Technical Support offers a variety of support options to answer any questions on products and their
implementation.
Before you contact Technical Support, refer to the relevant section(s) in this documentation for a possible
solution to the problem. If you need to contact technical support for help, have the following information ready:
The type and version of the operating system you are using.
The type and version of browser you are using.
Details of how to recreate the problem.
The exact wording of the error messages you saw.
Any relevant output listing from the Log Viewer or any other diagnostic applications.
Details of what you did to try to solve the problem(s) and your results.
The Technical Support case number assigned to your problem if this is an ongoing problem.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 6
Chapter 1
Overview
Architecture
The following diagram illustrates how the different components of InTouch Access Anywhere work together.
The InTouch Access Anywhere server (WebSocket server) is installed on the same Remote Desktop Services
host where InTouch WindowViewer runs applications. The server includes a collection of web resources
(HTML files, CSS, JavaScript, images, etc.).
The Authentication Server is installed on the safe side of the firewall and authenticates InTouch Access
Anywhere users before granting them access to InTouch applications.
The InTouch Access Anywhere Secure Gateway is an optional server installed separately on a computer in a
DMZ to access InTouch applications protected by a firewall.
Note: You can use a VPN connection instead of InTouch Access Anywhere Secure Gateway.
This is the recommended architecture to remotely access InTouch applications running on an HMI SCADA
network from an untrusted business network.
The following sequence of events occur after the user enters the URL to remotely view a running InTouch
application.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 7
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 1 – Overview
1. Initiate a connection from the client device by directing the browser to the InTouch Access Anywhere start
page hosted on the web server (http://<machinename>:8080/). The Start.html page is displayed in the web
browser using HTTP/HTTPS.
2. The browser opens a WebSocket connection to the InTouch Access Anywhere Server, which is running on
the RDS host itself.
Note: If the optional InTouch Access Anywhere Secure Gateway is installed, an InTouch Access Anywhere
Server browser session will connect through it.
3. The InTouch Access Anywhere Server translates the WebSocket communication to and from RDP, thus
establishing a connection from the browser to the RDS host itself.
4. The browser then displays the content of the remote InTouch application.
Licensing
InTouch Access Anywhere is licensed for use only with InTouch WindowViewer running under an activated
InTouch 2012 R2 TSE (RDS) or newer license.
When InTouch is launched by InTouch Access Anywhere, this RDS license will be consumed per browser session.
It will be released when InTouch is closed by InTouch Access Anywhere.
Per device licenses are not supported.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 8
Chapter 2
This chapter describes how to install and configure InTouch Access Anywhere Server. It includes requirements
that need to be met for InTouch Access Anywhere to be functional, prerequisites for installation, and detailed
information about the installation and configuration procedures.
Pre-Installation Requirements
Important
InTouch Access Anywhere is offered as two separate products based on how the product components are
installed. InTouch Access Anywhere is included in the suite of products that are part of System Platform. InTouch
Access Anywhere components are installed by selecting them from the list of the System Platform product
installer. InTouch Access Anywhere is the stand-alone version delivered on a single CD. After selecting the
Setup.exe file on the CD, a menu appears to select the InTouch Access Anywhere components to be installed.
Functionally, the two versions of InTouch Access Anywhere are the same. This manual describes how to install,
manage, and monitor the InTouch Access Anywhere server for both versions of InTouch Access Anywhere.
Requirements
Before installing the InTouch Access Anywhere server, verify the following requirements have been met:
The computer that will host the InTouch Access Anywhere server must be running a 64-bit version of the
following:
o Windows 2012 Data Center
o Windows 2012 R2 Data Center and Standard
o Windows 2016 Data Center and Standard
o Windows Server 2019 LTSC Data Center - Desktop Experience, IoT - Desktop Experience, Standard -
Desktop Experience
Note: Embedded operating systems are not supported by InTouch Access Anywhere Server.
.NET Framework 4.6.2 Full Installation or later must be installed on the host computer if you are completing
a stand-alone installation of InTouch Access Anywhere.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 9
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
Note: If you are installing InTouch Access Anywhere from System Platform, the installer verifies the current,
installed versions of .NET on the computer. When only earlier versions of .NET are detected,the installer
automatically updates the computer to the required .NET version.
The different versions of .NET installed on the computer can be verified by looking at the following registry
key:
HKLM\SOFTWARE\Microsoft\.NETFramework
If you need to install .NET, you can downloaded it from the Microsoft .NET download site
(https://dotnet.microsoft.com/download https://dotnet.microsoft.com/download).
InTouch applications must be built with version 10.6 or later to be viewed through InTouch Access
Anywhere
The InTouch Access Anywhere server must be installed on the same computer that hosts InTouch
WindowViewer.
Remote Desktop Services must be configured on the host computer.
Important: InTouch Access Anywhere leverages RDP and translates RDP to WebSockets. RDS access must be
enabled on the computer hosting InTouch Access Anywhere.
Make sure the anticipated users of InTouch Access Anywhere are members of the Remote Desktop Users
group to be granted the right to log on to the Access Anywhere server remotely.
The host computer’s firewall is configured to permit inbound and outbound network traffic on port 8080.
Make sure no other application installed on the InTouch Access Anywhere server also uses port 8080.
On host computers running Windows Server 2012, the InTouch WindowViewer executable file (view.exe)
must be added to the host computer’s RemoteApp list and configured to support command-line arguments.
The corresponding TSE (RDS) Concurrent license is activated on the host computer.
If upgrading to a newer version of InTouch Access Anywhere, first back up any custom components of the
existing installation, then uninstall the existing version before installing the new version.
InTouch Access Anywhere Server cannot be installed on computers in which the host name contains
non-English characters.
InTouch applications cannot be listed by InTouch Access Anywhere if application names or folder paths
contain an ampersand (&) character.
In Windows Server 2012 / Server 2012 R2 / Server 2016 and Server 2019
Important: This configuration requires Active Directory (2008 R2 or newer), and the server configured as follows
must be joined to the AD domain.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 10
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
Important: If and when prompted, make sure to restart the server to finish installation.
To configure and deploy the server
1. Open the Server Manager.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 11
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
2. From the Manage menu, click Add Roles and Features. The Add Roles and Features Wizard opens to the
Before You Begin page.
3. Click Next. The Installation Type page opens.
4. Select Remote Desktop Services installation, and click Next.
5. On the Deployment Type page, select Quick Start, and click Next.
6. On the Deployment Scenario page, select Session Virtualization (Windows 2012) or Session-based desktop
deployment (Windows 2012 R2 and 2016), and click Next.
7. On the Select server page, if your server appears in the Selected list, click Next. If it does not:
a. Select the desired server’s listing in the Server Pool list.
b. Click the right arrow between the lists to add your server to the Selected list
c. Click Next.
8. On the Confirmation page, select the Restart the destination server automatically if required option, and
then click Deploy. Progress meters appear as the wizard proceeds through configuration steps.
9. Following configuration, the Server Manager displays the Completion page to indicate configuration
success.
To configure Collections
1. From the Server Manager, click the Remote Desktop Services page, then click Collections. The Collection of
remotely available applications created by the Quick Start Deployment Scenario appears. If you wish to
remove the default Collection, continue with the next step. Otherwise, go to Step 3.
2. Right-click the QuickSessioncollection listing, click Remove Collection, and then click Yes to dismiss the
confirmation prompt.
3. From the TASKS drop-down list near the top right of the Server Manager, click Create Session Collection.
The Create Collection window opens to the Before You Begin page.
4. Click Next to proceed to the Collection Name page.
5. Enter a Name to identify this Collection in the Name text field. You may also enter a Description in the
provided text field if you wish. When finished, click Next.
6. On the RD Session Host page, select your server from the Server Pool list, and click the right arrow to add it
to the Selected list. When finished, click Next.
7. On the User Groups page, Domain Users are given access to the Collection by default. If you need to add
other User Groups, you may click the Add... button and select them. When finished, click Next.
8. On the User Profile Disks page, you may configure a storage location for user settings. This tutorial will skip
this step, so clear the Enable user profile disks check box, and click Next to continue.
9. On the Confirmation page, click Create. Progress indicators appear.
10. When the progress indicators advance to completion and all steps show a Status of Succeeded, click Close.
To publish the RemoteApp
1. From the Remote Desktop Services page of the Server Manager, select the Collection you just created in the
Overview section.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 12
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
2. From the TASKS drop-down list under the REMOTEAPP PROGRAMS section, click Publish RemoteApp
Programs. The Publish RemoteApp Programs window appears.
3. Find the WindowViewer listing, and select it by checking its box.
Note: If the WindowViewer listing is not present in the list, click Add Another Program... and navigate to
view.exe in the directory to which InTouch was installed.
4. With WindowViewer selected in the list, click Next.
5. From the Confirmation screen, click Publish. A progress indicator appears briefly.
6. The Completion screen appears, indicating that WindowViewer is now Published. Click Close.
7. Return to the Server Manager. Under the REMOTEAPP PROGRAMS section, right-click the WindowViewer
entry and click Edit Properties. The Properties window for WindowViewer appears.
8. Click the Parameters entry at the left of the Properties window.
9. Under Command-line Parameters, select the Allow any command-line parameters option, click OK.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 13
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
5. Select the Allow WindowViewer to dynamically change resolution option to locally scale the application for
different device screens.
6. In the Dynamic Resolution area, select Convert to screen video resolution.
The Convert to screen video resolution enables WindowViewer to run the application at the remote
device’s resolution. For example, if a mobile phone has an 800x600 screen and the InTouch application was
developed at 1280x1024, WindowViewer dynamically scales the application to fit the phone's 800x600
resolution.
7. Click OK to dismiss the configuration windows.
To enable DRC for users
1. Log on to the RDS host computer as an InTouch administrator.
2. Open the win.ini file of the InTouch user who completed the previous steps (located at
"Users\<UserName>\AppData\Local\Wonderware\Win.Ini") in a text editor such as Notepad.
3. Add the section [InTouch] (if necessary).
4. Add the line ViewApplicationResolution=2 under the [InTouch] section.
5. Save the file.
6. Copy this file to the AppData folder corresponding to each user who will use InTouch Access Anywhere with
DRC enabled.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 14
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 15
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
5. Click Next on the dialog box that shows InTouch Access Anywhere server will be installed.
6. Select the check box that acknowledges you have read and accepted the terms of the license agreement and
select Agree.
7. Click Install to begin installing InTouch Access Anywhere server.
A horizontal bar shows the progress of the installation.
8. Click Finish to complete the installation.
9. Configure (or disable) the Windows Firewall for use with InTouch Access Anywhere. For details, see
Configuring a Firewall Program Exception on page 22.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 16
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
3. After the InTouch Access Anywhere Server web page appears, enter user credentials and select the InTouch
application available from the host computer from the drop-down list.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 17
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
Each of the listed Settings pages contain different options. You can either continue with the populated
default settings or make selections from the available options.
Note: See the InTouch Access Anywhere User Guide for detailed descriptions of the options on each Settings
page.
5. Use the Display settings page to select your desired display options and screen resolution.
6. Click the back arrow twice to return to the login screen, and click Connect.
The connection dialog appears momentarily while the web browser connects to the RDS host where the
InTouch Access Anywhere Server is installed.
InTouch WindowViewer is launched at the remote node and shows the selected InTouch application.
Note: After connecting with InTouch Access Anywhere, closing WindowViewer will log you off and end the
session. Closing the browser will leave WindowViewer running; it only disconnects you from the session.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 18
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
Installation
The InTouch Access Anywhere Server runs as a service and can be started and stopped from the Windows
Services Manager or from the InTouch Access Anywhere Configuration tool.
An additional service called serviceInstaller is installed to monitor changes in InTouch applications available on
the node and update the InTouch Access Anywhere Start.html file accordingly. This service updates the InTouch
Applications drop-down list that appears on the initial InTouch Access Anywhere Server log on page.
Note: The InTouch Access Anywhere service runs under a local domain user account and cannot communicate
with applications or folders on remote computers, which are typical of a NAD environment. As a result, NAD
applications do not appear in the list of InTouch applications. For more information, see NAD Limitations on
page 46.
The InTouch Access Anywhere service is configured to run automatically on system startup. If the service is
stopped or is unable to listen on its default port (8080), clients cannot connect to that host. Make sure to
configure firewalls and proxies between the end point devices and the server-side component to enable
communication using port 8080, or use the InTouch Access Anywhere Secure Gateway.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 19
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
4. Select Uninstall/Change.
The Modify, Repair or Remove Installation Wizard will appear.
5. Select Remove, and then click Next.
The InTouch Access Anywhere Server will be uninstalled.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 20
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
You can open a port through the firewall either through the command line, or through the Windows firewall
configuration. The command line option is presented for advanced users as a quicker way to configure the
firewall versus using the GUI.
Using the Command Prompt
To configure the firewall through the command line, first open the Windows Command Prompt and run as an
Administrator. Then, type the following command:
netsh.exe advfirewall firewall add rule name="<Description>" dir=in action-allow protocol=TCP
localport=<PortNumber>
Where:
<Description> = the description used to describe this firewall rule
<PortNumber> = the TCP port to open
For example:
netsh.exe advfirewall firewall add rule name ="Open Port 8080 for InTouch Access Anywhere" dir=in
action=allow protocol=TCP localport=8080
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 21
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 22
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 23
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
You can launch the InTouch Access Anywhere Server Configuration tool from the Start Menu Program Group or
on the Apps view.
In general, changing the InTouch Access Anywhere Server configuration is not required. It is recommended to
use the default settings.
Note: It is recommended to hide the Server Configuration application from end users to prevent unexpected
changes to the server's settings.
The following sections describe the different configuration tabs of the InTouch Access Anywhere Server.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 24
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
General
The General tab provides functions to start and stop the InTouch Access Anywhere Server service. For certain
configuration changes, a service restart is required. This page also displays the number of active InTouch Access
Anywhere Server client sessions connected to this computer.
Note: Whenever the InTouch Access Anywhere Server service is restarted, all sessions on the server are
disconnected.
Performance
The Performance tab displays current performance statistics related to InTouch Access Anywhere connections.
Communication
The Communication page provides options to change the InTouch Access Anywhere Server port and the address
of the host computer running RDS.
When using an InTouch Access Anywhere Server listening port other than the default (8080), the port number
must be explicitly specified in the client address field (for example, http://<machine name>:5678/).
When running InTouch Access Anywhere Server on a computer with multiple network cards, change the RDP
host address. Change this address from localhost to the IP or DNS address of the network card that has RDP
access to the system.
Changes to either setting require a service restart. The General tab provides buttons to start or stop the service.
You can also start or stop the service using the Windows Service Manager.
Note: If you change the port number, ensure that you make the corresponding changes to the config.js file’s
"wsport" setting. For more information, see Static Configuration of the Config.js File on page 33
Acceleration
The Acceleration tab provides options to change the Acceleration or Quality level and disable dynamic
compression.
When the Override client acceleration/quality settings check box is selected, all sessions use the configured
setting, and all client settings are ignored. When selecting or clearing this setting, the service must be restarted
for the change to become effective. When the setting is enabled, changing the acceleration level does not
require a service restart, but active users must reconnect to use the new setting.
Dynamic Compression identifies small graphic elements within an application screen and compresses them
during runtime. The most compression occurs when image quality is set to Low. The best quality images occur
when image quality is set to higher than Low. All other graphical objects are compressed at the selected quality.
This provides the visual impression of a high quality remote desktop session.
By default, this feature is enabled. To disable dynamic compression, clear the Use dynamic compression box.
Security
This Security page provides options to configure the InTouch Access Anywhere Server security settings.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 25
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
Note: InTouch Access Anywhere provides integrated 128-bit SSL encryption. For best performance, set the
host's RDP Security Encryption level to Low and change the Encrypt InTouch Access Anywhere communication to
Always. Using this configuration, InTouch Access Anywhere SSL encryption will be used instead of the RDP
encryption. Do not set this if users will be connecting directly to RDP regularly, as those sessions will end up
using Low encryption.
To use a custom or trusted certificate, enter the thumbprint ID in the Certificate Thumbprint text box and click
Apply. The certificate’s properties will then appear.
Note: When installing a trusted certificate, the DNS address of the InTouch Access Anywhere Server must match
the certificate name. If wildcard certificate is used, the domain must match. For example, if the certificate is for
*.acme.com, the server name must end with acme.com.
Logging
This tab provides functions to enable/disable certain logging features. Technical Support may request a
debugging log for diagnostic purposes. The debugging log is enabled here.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 26
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
Note: Unless instructed by our Support group, customizations performed on the InTouch Access Anywhere page
not herein described are not supported.
Note: The name setting may also be set using the following cookie: EAN_name.
3. After setting the name parameter, the new label will appear in the connection's browser tab and in the
Establishing connection dialog box.
Secure Connections
This section describes secure connection communication between WebSockets to both remote desktops and to
the InTouch Access Anywhere Secure Gateway.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 27
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 28
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 2 – Installation and Configuration
10. After importing the thumbprint, a notification appears confirming the BIN certificate has been successfully
created.
11. Start the InTouch Access Anywhere Server service and it will be ready for use.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 29
Chapter 3
This chapter provides information on supported browsers, and information regarding specific behavior of mobile
devices, and special devices like tablets.
Supported Browsers
Browsers Tested with InTouch Access Anywhere
The following Web browsers have been formally tested and verified to work with InTouch Access Anywhere.
Microsoft Internet Explorer 11
Microsoft Edge
Firefox version 47
Safari version 8
Chrome version 51
Opera version 38
Functionally Compatible Browsers
This list includes HTML5 browsers that should be compatible with InTouch Access Anywhere, but have not been
tested.
Microsoft Internet Explorer 10 if connected through Secure Gateway
Firefox versions 38 and later
Safari versions 5 and later
Chrome versions 12 and later
Opera versions 11 and later
Refer to the InTouch Access Anywhere Readme for more information regarding tested and supported browsers.
Older versions of Firefox and Opera require WebSocket support to be manually enabled in the browser
configuration.
Multiple InTouch Access Anywhere sessions can be opened in different tabs within the web browser, or in
different browser windows. When a session is not in use (its tab or window is not displayed) it will reduce its
CPU and memory utilization.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 30
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 3 – Configuring Mobile and Special Devices
Note: Each InTouch Access Anywhere session consumes an RDP session and an InTouch TSE license.
HTTPS Mode
For environments where WebSockets support is not available, InTouch Access Anywhere can work in HTTPS
mode to transmit data by HTTPS only. HTTPS mode is used only if WebSockets support is not available.
WebSockets will be used when available as it will provide better performance. InTouch Access Anywhere Secure
Gateway requires HTTPS mode when using an Internet Explorer web page browser or any SSL VPNs that only
proxy HTTPS traffic.
Note: HTTPS mode requires a browser that supports the HTML 5 Canvas. Older browsers, such as Microsoft
Internet Explorer 8 (or earlier), do not support the HTML 5 Canvas.
To enable HTTPS mode, the InTouch Access Anywhere Secure Gateway is required. The InTouch Access
Anywhere Server web pages must be delivered using the web server built into the InTouch Access Anywhere
Secure Gateway (files are located under the Webserver\InTouch Access Anywhere folder).
To enable InTouch Access Anywhere for HTTPS support
1. Install the InTouch Access Anywhere Server on the desired RDS host.
2. Install the Secure Gateway on a separate computer located in a DMZ. The Secure Gateway must be installed
on a server that is accessible by the target end-user group(s).
3. To connect to the InTouch Access Anywhere Server using HTTPS, enter the InTouch Access Anywhere URL of
the Secure Gateway (the Secure Gateway includes the InTouch Access Anywhere web component):
https://<securegatewayaddress>/InTouch Access Anywhere/start.html
4. Enter the parameters of the target InTouch Access Anywhere Server in the start.html page.
5. After connecting by HTTPS mode, a '-' character appears as a prefix of the address in the browser tab.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 31
Chapter 4
Advanced Configuration
File Description
ericom.jpg Logo image displayed at top left of InTouch Access Anywhere interface
Note: An experienced web developer can customize more graphics, though these modifications are not
supported by technical support.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 32
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
Note: Clear the browser cache and history, if the drop down list is not updated with the new language option.
address Address of InTouch Access Anywhere Server. This is always blank for
the standard configuration.
audiomode 0 enables audio redirection (default).
1 plays audio on remote computer.
2 disables audio redirection.
blaze_acceleration True determines if RDP acceleration is used.
blaze_image_quality Sets the quality level using a numeric. For example: 40 (fair quality),
75, 95 (best).
dialogTimeoutMinutes Time out period, in minutes, after which an inactive InTouch Access
Anywhere session is automatically closed and logged off. The time
out period is relevant only for dialogs that have a log off button.
disableToolbar True (default); set to False to disable the toolbar, which contains
shortcut icons and file functions, that appears within an InTouch
Access Anywhere session window.
domain The name of the domain against which the user name and password
are authenticated to grant access to the Remote Desktop session.
encryption False determines if encryption is enabled from the client to the
InTouch Access Anywhere server.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 33
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
endURL URL to open to after the InTouch Access Anywhere session has
ended (# value closes window).
If there is a prefix with the symbol ^ then this sets the value of
window.location instead of top.location. This is useful when the
InTouch Access Anywhere session is embedded in a frame.
fulladdress Address of RDP host. This is always blank for the standard
configuration.
gateway_address Defines the address and port of the Secure Gateway.
For example: secure.acme.com:4343
gwport The default gateway port that will be used if it is not explicitly
specified in the address field.
hidden A comma or space-separated list of field names as they appear in
config.js. For example, "username,password,domain". The listed
fields are hidden to prevent the user from modifying them.
To hide a button, such as the Advanced button, prefix the button
text with the word show. For example, "showAdvanced,showAbout"
hides both the Advanced and About buttons.
All hidden variables will ignore previously saved settings.
leaveMessage The message shown to the user after navigating away from an active
session.
minDesktopWidth Sets the minimum desktop width (in pixels) that InTouch Access
Anywhere will display. The default is 800, which may not display as
expected or desired on devices with a display width below 800
pixels.
minDesktopHeight Sets the minimum desktop height (in pixels) that InTouch Access
Anywhere will display. The default is 600, which may not display as
expected or desired on devices with a display height below 600
pixels.
minSendInterval Specifies the minimum duration between mouse position messages
sent from the client when the mouse button is pressed. Units are in
milliseconds.
name Defines a custom string for the connection name. By default, the
RDP host address is used.
noHTTPS By default, InTouch Access Anywhere first attempts to connect using
WebSockets. If the Secure Gateway is used with InTouch Access
Anywhere, the connection will fall back to HTTPS when WebSockets
are not available. If this setting is set to true, only WebSockets will
be used and HTTPS fallback will be disabled.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 34
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
resolution Sets the resolution size of the InTouch Access Anywhere screen. The
value set must be a valid option under the InTouch Access Anywhere
screen resolution setting. For example: "1024,768".
For Full Screen, use: screen.
sessionTimeoutMinutes Time out period, in minutes, after which an inactive session is
disconnected. The time out period resets automatically whenever
the user clicks on the keyboard or a mouse button. The default value
is 0, which disables this feature.
settings (URL parameter Name of the Configuration Group to be used.
only)
settingsURL URL of the connection settings file.
use_gateway False (default), set to true to use a Secure Gateway for remote
access.
wsport The default WebSocket port that will be used by the client. The value
specified in the file (8080 by default) is used for both encrypted and
unencrypted WebSocket communication. The user can override this
value by explicitly specifying another port address in the client user
interface (UI).
For backward compatibility with older versions of InTouch Access
Anywhere Server, this behavior can be modified. If singlePort is set
to false, then the port value specified is only for encrypted
communication. The value specified in the file plus one (8081 by
default) will be used for unencrypted WebSocket communication.
WARNING! Do not attempt to modify config.js settings not listed here unless directed by Technical Support.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 35
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
For example, if the Marketing group needs clipboard redirection and printing enabled, change config.js as
follows:
var defaults = { / this already exists in the file
…
"Marketing": {
printing:true,
clipboard:true
},
};
Note: The quotation marks surrounding Marketing must be identical. If necessary, delete them and re-type
them if the text was copied from another source. Also, the last setting of the configuration group should not
have a ',' at the end. This comma is placed after the closing bracket '}'.
In the URL to be used by the Marketing group, add the settings parameter:
http://<machine name>:8080/InTouch Access Anywhere/start.html?settings=Marketing
Settings Precedence
When an InTouch Access Anywhere client starts, it reads configuration information from a variety of sources. If
two or more sources contain different values for the same setting, the value used by InTouch Access Anywhere
is determined by the following precedence order:
Highest Precedence to Lowest Precedence
URL parameters
Cookies
Saved settings from previous session
config.js
For example, if the gateway_address is specified to be "server1" in config.js but "server2" in a cookie (EAN_
gateway_address), then the value "server2" will be used.
If the setting override Saved is set to true in config.js, then any settings predefined in the config.js file will
override previously used settings, and the precedence order will change slightly:
Highest Precedence to Lowest Precedence
URL parameters
Cookies
config.js
Saved settings from previous session
Note: These settings become effective only after the user starts a new session. In some cases, the local browser
must be closed and reopened before changes become effective. The local browser cache may also need to be
cleared.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 36
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
Note: To use Form POST with Access Anywhere versions prior to 17.2, the Secure Gateway is required.
The following table describes the information placed in each field of the sample form shown above.
Boolean value when set to True starts the RDP session and WindowViewer when the
connection is made to the InTouch Access Anywhere server. True is the default.
Boolean value when set to True runs the specified InTouch application immediately in
WindowViewer when the connection is made to the InTouch Access Anywhere server.
True is the default.
Folder path to the InTouch WindowViewer executable (view.exe), the folder path to
the InTouch application, and the window size option of the application.
Working folder of the InTouch application to store transient run time data.
Login button to submit the POST data to the remote server running the InTouch
application.
To pass desired values to Access Anywhere, POST the variables to the path “/AccessAnywhere/sso”. Use the
EAN_ Cookie prefix to define the parameters that will be passed using a POST form.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 37
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
The following figure shows the underlying HTML code for the sample POST form shown above.
An EAN_ prefix is appended to the names of all parameters passed in the SSO POST form, which are listed in the
config.js file.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 38
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
Folder path to the InTouch WindowViewer executable (view.exe), the folder path to
the InTouch application, the name of the InTouch application, and the window size
option of the application.
"Program and Application:<input type="text" name="EAN_alternate_shell"
size="128"
value='"C:\PROGRA~2\WONDER~1\InTouch\View.Exe""c:\programdata\intouchd
emos\demoapp1_1024"/FitScreen'
Working folder of the InTouch application to store transient run time data.
Working Folder:<input type="text" name="EAN_shell_working_directory"
size="128" value='"C:\PROGRA~2\WONDER~1\InTouch"'
placeholder='"C:\PROGRA~2\WONDER~1\InTouch"'
Default horizontal and vertical pixel resolution of Web browser window showing the
running InTouch application..
Resolution:<input type="text" name="EAN_resolution" size="24"
value="1024,768" placeholder="1024,768"
Login button to submit the POST data to the server running the InTouch application.
<input type="submit" name="submit" value="Log On" onclick="submitForm()"
/>
URL and port of the InTouch Access Anywhere server running the InTouch application
https://10.010.01.123:8080/
This field can be hidden when the user views the form with a Web browser.
The default SSO URL, which is the Access Anywhere server's IP address or domain
name, port, and SSO path.
https://<Access_Anywhere_server>:8080/AccessAnywhere/SSO
The default SSO path is placed in the Access Anywhere server's registry at
HKLM\Software\Ericom Software\Access Server\SERVER Side\SSO Path
You can modify the SSO path by editing the Windows registry and assigning another
value to the SSO Path registry entry.
Include the following fields in the form at a minimum:
name="autostart" value="yes"
name="esg-cookie-prefix" value="EAN_"
name="username"
name="password"
If the target is a relative URL, it will replace the "/sso" portion in the path. Modify the SSO Path on page 40
explains how to modify the SSO path in the Windows registry of the Acess Anywhere server.
If the target is a full URL, it will completely replace the current path.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 39
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
5. Change the SSO path by entering the desired value in Value data field in the form: “mypath1/mypath2"
6. Update the SSO URL entry in your POST form.
https://<host>:<port>/mypath1/mypath2
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 40
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
To display the application, set ITAAAccessCode=1. This setting is unnecessary to display the application
unless it exists and is set to 0.
4. Save the file under its original filename.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 41
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
Activation Criteria
Access Anywhere multi-touch gesture redirection is enabled and activated based on the following criteria:
Multi-touch gesture redirection functionality is enabled if all of the following are true:
Touch is supported by the remote RDP host
Touch is supported by the user's computer or mobile device
Touch redirection is enabled by setting rdpTouchEnabled to True in the config.js file
Multi-touch gesture redirection can be activated if all of the following are true:
Touch feature is enabled
Toggle MultiTouch icon is set to active on the Access Anywhere toolbar
Touch is not suspended by the RDP host
Toolbar button
Users enable and disable the Windows multi-touch gesture redirection feature by toggling the Toggle
MultiTouch icon in the Access Anywhere toolbar, which is enabled by default.
Multi-Touch Enabled Multi-Touch Disabled
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 42
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 4 – Advanced Configuration
rdpTouchEnabled True (default) - enable remote touch. On the Server: enable the
feature, create RDP dynamic virtual channel, and send RDP client
touch events. On the Client – enable the feature, process the
incoming server touch messages.
rdpTouchActive False (default) – Sets the default activation state (ignored when not
enabled.) On the Client this is the initial state of the toolbar button. If
active, send touch events.
rdpTouchAction 0 (default) - Action to be taken if multi-touch redirection is enabled,
but is not supported by the server or client device. Action codes and
their assigned values:
0 - no action
1 - display an error message
2 - display an error message and disconnect from the session
3 - ask for user confirmation to continue without touch
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 43
Chapter 5
Known Limitations
This chapter describes known behaviors and limitations of InTouch Access Anywhere when viewing an InTouch
application on a portable device. Refer to the InTouch Access Anywhere ReadMe for a more detailed list of
current known issues in InTouch Access Anywhere.
Networking Limitations
Network quality
Network quality will impact the performance of InTouch Access Anywhere running on mobile devices. Long
latencies, limited bandwidth, and poor Wi-Fi coverage of the working area will impact user experience.
We recommend that in the menu of your application you add a heartbeat or a clock that displays time,
including seconds, that helps visualize good connectivity.
InTouch Access Anywhere does not support WindowMaker
InTouch WindowMaker is not supported in a Remote Desktop environment. Therefore, InTouch Access
Anywhere does not support InTouch WindowMaker. To prevent users from attempting to start
WindowMaker from WindowViewer, do not install a license that enables WindowMaker and hide the Fast
Switch menu bar in your InTouch applications.
Browser Limitations
Browser Extension Conflicts
Browser extensions and tool bars may inject JavaScript code into web pages, which can adversely impact the
behavior of certain web pages. If InTouch Access Anywhere is not working properly, disable or uninstall any
active browser extensions or tool bars. Restart the web browser after uninstalling or disabling an extension,
and clear the local browser cache, to ensure that it is no longer active.
HTTPS and SSL Encryption
When the InTouch Access Anywhere page is delivered to the web browser using HTTPS, the SSL encryption
setting will be checked by default. Modern browsers usually require WebSocket connections to be
encrypted when launched from pages that are delivered using HTTPS.
Zooming in Browsers
Using the CTRL+ and CTRL- hot keys to zoom an application view in or out only works with Internet Explorer
10.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 44
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 5 – Known Limitations
Navigational Limitations
Mouse Events
When designing your applications, keep in mind that certain mouse events do not have an equivalent
behavior on a touch mobile device, including the following:
o While Left Key Down
o On Right Key Down
o While Right Key Down
o On Right Double Click
o On Right Up
o Mouse Center click
o Pushbutton>Discrete Value>Direct
Other mouse events are triggered with a gesture you must learn. For example, in many mobile devices a
mouse over event is triggered by a tap on the screen.
Right Click on Mac
To perform a right-click on Mac OSX system: Command+ left-click.
Left Click on iPad
A single tap does not consistently toggle the state of a push button. Tap and hold to toggle a push button.
Scroll Bars
In some cases, moving a scroll bar in a touch environment can be difficult, particularly when the device has a
small screen. As an alternative, try touching the empty area of a scroll bar in the direction you want to
move.
Dialog Boxes
Dragging and dropping a dialog box can also be difficult on a touch device with a small screen. We
recommend that you use a stylus to perform these operations for better precision, if possible.
Using Software Keyboards
InTouch provides the ability to invoke an InTouch keyboard or the Windows On Screen Keyboard from Input
Animations. When designing applications to be accessed by InTouch Access Anywhere from mobile devices,
keep in mind that these devices have their own software keyboards optimized for their specific form and
size. In these cases, invoking the InTouch or the Windows keyboards from your application is not needed. In
general, users have a better experience using a device software keyboard.
Also, keep in mind that software keyboards in mobile devices in most cases do not have certain keys
available in a physical keyboard, such as F1-F12, CTRL, or ALT. If you already have an application that uses
Key Scripts associated with some of these keys, modify your application to use alternate available,
supported keys.
Some key combinations may not be available through your mobile device, such as Shift+<letter>, CTRL+Shift,
CTRL+ALT.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 45
AVEVA™ InTouch Access Anywhere Server Administrator Manual
Chapter 5 – Known Limitations
NAD Limitations
Distributed InTouch applications typically have a central development computer, central data storage, and client
workstations that run distributed applications. You use InTouch Network Application Development (NAD) to
build and maintain distributed applications. NAD enables client stations to maintain a copy of a single
application without restricting the development of that application. Client stations are automatically notified
when the application changes.
NAD applications do not appear on the list of applications shown on the Start.html page when the user logs on
to the InTouch Access Anywhere server.
The InTouch Access Anywhere service populates the Start.html file drop-down list of available InTouch
applications. This service runs under a local system account by default and cannot communicate with
applications or folders on remote computers, which are typical of a NAD environment. This is the reason why
NAD applications do not appear in the list of InTouch applications.
If you open Application Manager and see InTouch applications whose folders are not located on the computer's
local hard drives, then those applications will also not appear on the drop down list of the Start.html page.
A workaround is to set the InTouch Access Anywhere service to run under a specific domain user account that
has sufficient privileges on the Access Anywhere server and can also access the application directory on the NAD
master computer.
© 2022 AVEVA Group plc and its subsidiaries. All rights reserved. Page 46