This article’s objective is to help users troubleshoot “(401) unauthorized” error messages in the Shop Floor Insight application.

There could be many reasons why a customer gets a “(401) Unauthorized” error message.

Here are a few things to consider and verify:

• Find the corresponding Windows Service. For every company that uses Shop Floor Insight, there needs to be one Windows Service. Ensure the correct Service has been identified as it is typical to have multiple Services installed.
• Ensure this Windows account defined for the Shop Floor Insight service is OK.

• • Is the Windows Account disabled?
  • Have the credentials for this account been modified or expired?

If the Windows account in question is disabled or has expired/incorrect credentials, the service will not run.

• • Does the Windows account have access to where the service files are located? The user should have access to these files if he/she tries to access them locally on the server where the service runs.

For example, if the Shop Floor Insight Service is installed in the folder “C:\Program Files\Shop Floor Insight\” the user specified on the Service needs to be able to browse (on the Server where the Shop Floor Service runs) to that exact folder and not have any permission issues.

When the user is logged onto the computer where the Service runs, this is what the user will see if he/she user does NOT have access to this folder. In this example, the Shop Floor Insight service will not run.

• The next thing to verify is if the Service account has access to Business Central.

How this is done will depend on what credential type is used for the installation.

Most On-Premise installations will use a “Windows Account” credential type configuration. This method does not require any configuration in the Windows Credential manager.

• • To verify if the Service account has access to Business Central, have the same user attempt to log into Business Central, with the exact account as it is defined in the Service. (including domain if specified)

However, Business Central SaaS installations will use a “UserName” credential type configuration. This method requires the use of an entry in the Windows Credential manager.

• • For SaaS installations, verify if the Service account has access to Business Central. In the config file of the corresponding Shop Floor Service, find the corresponding Windows Credential entry by searching for “AuthenticationModeGenericCredentialVaultTarget”. Take notice of the value saved here.

• • Go to the Windows Credential Manager and find the entry that was specified in the config file.

• • Open the entry. The username specified here needs to exist as a valid user in Business Central. Only the user name should be specified in the credential manager. See the images below.

  • The password specified here should be the “Web Service Access Key” found on the corresponding user card in Business Central.

• • Ensure that both username and password are correct.
  • Change the Web Service Access Key and update the credential manager entry if need be.

• The next thing to verify is if the Business Central user that is used by the Shop Floor Service can login to the SOAP URLs.

NOTE: For any installation using “Windows Account” as credential type, this step will be the same as verifying if the user has access to Business Central.

• • In Business Central, search for “Web Services”.
  • Find any entry pertaining to the Shop Floor Insight. These entries will have “TCM” or “SFI” as a prefix in the service name.
  • In the “SOAP URL” column to the right, click the link address.

• • This will open a web page. with a prompt for user and password.

• • Enter the same user as specified in the credential manager, along with the Web Services password.

  • If the user cannot login, this could indicate an issue with the credentials specified in the credential manager for the Service Account in question. Verify the credentials are OK. Another possibility is that the user in question does not have sufficient permissions in Business Central.

• Is it possible the credential type configuration settings have changed? Both the server and client need to have the same configuration in terms of “Credential Type”. Reminder that all SaaS installations are required to use “UserName” as credential type. It isn’t “normal” that the credential type of the client or server change.
  • For On-premise installations, the “Credential Type” of the server is set via the Business Central Administration tool.

• The credential type of the Shop Floor Insight application’s client is defined in the config file where the Shop Floor Insight service runs. Search for “U” and see what is specified in the “Value” tag below.