Wonderware InTouch Access Anywhere 2017 Readme

Last revision: 3/21/2017

About This Readme

This Readme provides information about Wonderware InTouch Access Anywhere 17.0.

Wonderware InTouch Access Anywhere Overview

Wonderware® InTouch Access Anywhere™ provides remote access to Wonderware InTouch™ applications with an HTML5 Web browser running on a desktop computer or a mobile device. Any Web browser that supports HTML5 can be used as the client to view InTouch applications running on a remote desktop server. Wonderware InTouch Access Anywhere enables you to select an InTouch application from a list and view it running in WindowViewer.

The InTouch Access Anywhere installation media provides the following:

• InTouch Access Anywhere Server: Enables you to view remote Wonderware InTouch applications hosted on Terminal Servers with an HTML5-compliant web browser running on mobile devices or a desktop.
• InTouch Access Anywhere Secure Gateway: Optional server that provides secure remote connections from clients running on unsecured networks to internal network resources. The Secure Gateway provides authentication and authorization services as well as data encryption.

New Features and Enhancements InTouch Access Anywhere

InTouch Access Anywhere 2017 Version 17.0

New Features and Enhancements:

• Security enhancements have been added to this release to address a number of security vulnerabilities in the previous release of InTouch Access Anywhere Secure Gateway, 2014 R2 SP1b. See the InTouch Access Anywhere Secure Gateway Security Settings section of this Readme for details.
• An updated InTouch Access Anywhere user interface including start and configuration pages

  Note: If you have customized the InTouch Access Anywhere start page, you will need to reapply these customizations. It is recommended to document these customizations before upgrading.

• Touch feedback for applications running on touch devices
• Capability to view Wonderware System Platform 2017 ViewApps

  Note: In a mixed product environment in which InTouch applications run on the same computer as Wonderware System Platform 2017 ViewApps, WindowViewer must be started before the ViewApp to be able to view both types of applications with InTouch Access Anywhere.

• Support for Windows Server 2016 operating system
• User documentation updates improve clarity and completeness

For a complete list of resolved issues, see the Resolved Issues section of this Readme.

Requirements, Browsers, and Mobile Devices

This section summarizes InTouch Access Anywhere installation requirements, supported browsers, and considerations for viewing InTouch applications on mobile devices. For more detailed information, see the Wonderware InTouch Access Anywhere Documentation

Installation Requirements

The following list describes the prerequisites to install the InTouch Access Anywhere Server or Secure Gateway.

• The computer that will host the Wonderware InTouch Access Anywhere Server must be running a 64-bit version of Windows Server supported by InTouch 2012 R2 or later.

  Note: InTouch Access Anywhere Server does not support embedded editions of the Windows Operating System.

• You must have an InTouch 2012 R2 TSE (RDS) or newer license activated. When InTouch is launched by InTouch Access Anywhere, this RDS license will be acquired per browser session. The license is released when the InTouch session is closed.
• Wonderware InTouch Access Anywhere Server and Wonderware InTouch HMI must be installed on the same Windows Server computer where the RDS Server Role is enabled. For detailed instructions, refer to the InTouch Access Anywhere Server Administrator Manual.

  Per-Device RDS licenses are not supported.

• You must have the InTouch Access Anywhere Secure Gateway installed on a computer running Windows Server 2012 R2 Standard or newer Operating System.
• The InTouch Access Anywhere Server and Secure Gateway must be installed on separate computers.

Important Security Requirement: Securely Deploying InTouch Access Anywhere

Direct access to the InTouch Access Anywhere Secure Gateway over the Internet is not supported. We recommend that you access the Gateway via a VPN tunnel for all remote connections.

Browsers

Wonderware InTouch Access Anywhere can be accessed from smart phones, tablets, and laptop computers that provide an HTML5-compliant web browser.

Browsers Tested with InTouch Access Anywhere

Browsers verified to work with Wonderware InTouch Access Anywhere include the following:

• Microsoft Edge
• Microsoft Internet Explorer 11
• Firefox version 47
• Safari version 8
• Chrome version 51
• Opera version 38

  Important: Please be aware that only the browsers in the above list have been tested in the specified hardware platforms (PCs, tablets and Smart Phones). No testing has been done with HTML5 browsers nor other devices not included in the above list (SmartTVs, eBook Readers, game consoles, etc.).

Functionally Compatible Browsers

Certain versions of the above listed browsers, such as:

• Microsoft Internet Explorer 10
• Firefox versions 6 and higher
• Safari versions 5 and higher
• Chrome versions 12 and higher
• Opera versions 11 and higher

are in theory functionally compatible with InTouch Access Anywhere. While you may be able to use them, specific behaviors are unknown as these browser versions have not been tested.

Browsers: Important Notes

Although Wonderware InTouch Access Anywhere supports the listed browsers, you should review the Known Issues and Behaviors section of this Readme for issues specific to each browser.

Mobile Devices

Run-time interactions with InTouch applications are different on mobile devices than on traditional desktop computers. For example:

• Touch gestures perform some of the tasks that a mouse would do on a desktop or laptop, but not all mouse events have an equivalent touch gesture.
• Many mobile devices have built-in software keyboards instead of physical keyboards, which do not have keys such as F1-F12, CTRL, and ALT.

When using InTouch Access Anywhere to remotely view and interact with your applications, it is important to be aware of the behavior differences among devices, operating systems, and browsers. For the best user experience, you should become familiar with the touch interfaces in the devices you will use, and factor these differences into the design of your InTouch applications. For example:

• Input animations do not need to invoke the InTouch or Windows operating system keyboards as mobile devices typically have their own.
• Existing InTouch applications that make use of mouse events and keys or key combinations without a supported equivalent in a touch environment may require you to modify your application to use alternate supported methods.

Installing Wonderware InTouch Access Anywhere

Use the following procedures to install Wonderware InTouch Access Anywhere.

• Installing Wonderware InTouch Access Anywhere Server
• Installing the Wonderware InTouch Access Anywhere Secure Gateway

Installing Wonderware InTouch Access Anywhere Server

Note: If you are upgrading to a newer version of InTouch Access Anywhere Server, take the following steps first:

1. Back up any customizations to your InTouch Access Anywhere Server installation.
2. Uninstall InTouch Access Anywhere Server from the Programs and Features section of the Windows Control Panel.
3. Install InTouch Access Anywhere Server as described below.

To install Wonderware InTouch Access Anywhere Server:

1. Run setup.exe from the root folder of the Wonderware InTouch Access Anywhere installation media.
2. After briefly displaying a splash screen, the options selection window appears. Select InTouch Access Anywhere Server, and click Next.
3. Click Next to accept the default installation settings, or select the Customize Installation option to change the installation destination, and then:
   1. Click Next.
   2. Click the Browse button to provide an installation path.
   3. Click Next.
4. Accept the license agreement by selecting the I have read and accept the terms of the license agreement(s) option, and then clicking Agree.
5. The Ready to Install the Application screen appears. Review the installation details and click Install.
6. Click Finish after the installer indicates that the Installation has completed successfully.

Installing the Wonderware InTouch Access Anywhere Secure Gateway

Refer to the InTouch Access Anywhere Secure Gateway Administrator Manual for detailed instructions on installing InTouch Access Anywhere Secure Gateway.

Secure Gateway: Important Notes

You cannot install the InTouch Access Anywhere Secure Gateway on the same computer as InTouch or the InTouch Access Anywhere Server.

The InTouch Access Anywhere Secure Gateway does not provide two factor authentication. This can be a security concern when you directly access the InTouch Access Anywhere server through the Internet. InTouch Access Anywhere Secure Gateway security is not designed to be directly connected to the internet. We recommend that you use a VPN as the first level of authentication when accessing the InTouch Access Anywhere server through the Secure Gateway.

To access InTouch applications beyond a firewall you must install the Secure Gateway on a separate computer located in a DMZ.

After installing the Wonderware InTouch Access Anywhere Secure Gateway, your InTouch applications will not be available in the Application Name: list box when running InTouch Access Anywhere through the gateway. To access a list of your applications, see the Secure Gateway post-installation instructions in the InTouch Access Anywhere Secure Gateway Administrator Manual.

Resolved Issues

This section lists defects resolved with this release.

Known Issues and Behaviors

This section describes known issues and platform/browser-specific behaviors in Wonderware InTouch Access Anywhere. The issues are grouped by areas affected by the issue. Workarounds are provided when available. You can also refer to the InTouch Access Anywhere user documentation for more information.

Wonderware InTouch Access Anywhere Documentation

Wonderware InTouch Access Anywhere product documentation is provided as a set of Portable Document Files (PDF):

You need Adobe Reader installed on your computer to view InTouch documentation. You can download the latest version of Adobe Reader from the Adobe Corporation web site: http://www.adobe.com/products/acrobat/readstep2.html.

After installing Adobe Reader, double-click a PDF file with your pointing device to view the book with Adobe Reader. You can also open a PDF with the Adobe Reader Open command from the File menu.

InTouch Access Anywhere Secure Gateway Security Settings

As part of the security improvements delivered in this release, InTouch Access Anywhere Secure Gateway is now configured to be secured by default and requires further configuration after the product is installed. You can also configure the security settings back to the same levels as in previous releases (not recommended).

The security settings are described in InTouch Access Anywhere Secure Gateway Administrator Manual (ITAA_Gateway_AdminManual.pdf), in the following sections:

• Whitelist Security on Page 26
• Configure Session Cookie Timeout on page 28
• Configuring the Origin Header Parameter for Whitelist Security on page 28
• Manually Configure a Trusted Certificate on page 37
• Configure the Secured Port and SSL Certificate on page 36

TargetHostWhitelistAllowedIPv4Addresses and certificate trust must be configured before using the InTouch Access Anywhere Secure Gateway. If you do not configure TargetHostWhitelistAllowedIPv4Addresses with the white listed systems, connections to the InTouch Access Anywhere Server through the InTouch Access Anywhere Secure Gateway will fail. You will get the following error message:

"Gateway: Target Host access is not allowed for address <IP Address>."

If you do not configure the certificate trust, you will be prompted with a certificate error if the Access Anywhere Server's certificate is not recognized on the Gateway node.