There are a variety of reasons why a customer receives a (401) Unauthorized error message.

Verify the following:

• The correct Windows Service has been identified (you may have multiple services installed). For every company that uses Shop Floor Insight, there needs to be one Windows Service.
• The Windows account defined for the Shop Floor Insight service is good. See Windows Account below for more information.
• The Service account has access to Business Central (method is dependent on the credential type used for the installation). See Service Account below for more information.
• The next thing to verify is if the Business Central user that is used by the Shop Floor Service can login to the SOAP URLs. See SOAP URLs below for more information.
• The entries on the Web Services list for users using a sandbox container. If the SOAP URL values have the string of text “?tenant=default” at the end, the configuration file of the corresponding Shop Floor service also needs to be configured with this string of text for the three URLs listed in the configuration file. See Web Services List below for more information.
• The credential type configuration settings have not changed. Both the server and client must have the same configuration for Credential Type. All SaaS installations are required to use UserName as credential type. See Credential Type Configuration Settings below for more information.

Windows Account

The Windows account defined for the Shop Floor Insight service is good:

• The Windows account is enabled.
• The Windows account’s credentials are current and unchanged.

• The Windows account has access to the service files’ location. The user should have access to these files if they try to access them locally on the server where the service runs. For example, if the Shop Floor Insight Service is installed in the folder C:\Program Files\Shop Floor Insight\, the user specified on the Service needs to be able to navigate to that folder without issue (on the Server where the Shop Floor Service runs). If the user encounters permission issues, the Shop Floor Insight service will not run.

Service Account

The Service account has access to Business Central (dependent on the credential type used for the installation):

• On-Premise: Uses a Windows Account credential type configuration. No configuration in the Windows Credential manager is needed. Have the same user attempt to log into Business Central, with the exact account as it is defined in the Service (including domain if specified) to verify if the Service account has access to Business Central.
• SaaS: Uses a UserName credential type configuration. Requires a Windows Credential manager entry, and the service account requires access to Business Central.

In the config file of the corresponding Shop Floor Service, complete the following:

1. Locate and open the corresponding Windows Credential entry by searching for “AuthenticationModeGenericCredentialVaultTarget”.
2. Ensure the username specified here exists as a valid user in Business Central (only the username should be specified in the credential manager).
3. Ensure the password matches the Web Service Access Key found on the corresponding user card in Business Central.
4. Ensure the username and password are correct.
5. Change the Web Service Access Key if needed.
6. Update the credential manager entry if needed.

SOAP URLs

Verify that the Business Central user used by the Shop Floor Service can log into the SOAP URLs. Complete the following:

1. Search for “Web Services” in Business Central.
2. Find a relevant Shop Floor Insight entry (entries with “TCM” or “SFI” prefixes in the service name).
3. Select the link address in the SOAP URL column.
4. Enter the same user and Web Services password from the credential manager.

Web Services List

The entries on the Web Services list for users using a sandbox container. If the SOAP URL values have the string of text “?tenant=default” at the end, the configuration file of the corresponding Shop Floor service also needs to be configured with this string of text for the three URLs listed in the configuration file. For example:

• http://Server_name:1234/BC150/WS/CRONUS%20Canada%2C%20Inc./Codeunit/TCMClientState?tenant=default
• http://Server_name:1234/BC150/WS/CRONUS%20Canada%2C%20Inc./Codeunit/TCMCustomFieldMgmt?tenant=default
• http://Server_name:1234/BC150/WS/CRONUS%20Canada%2C%20Inc.?tenant=default

If the Web Services have this string of text, the URLs in the config file also need to have this value as indicated in the example above.

This only applies to recently created sandbox containers using BcContainerHelper. This is due to a Microsoft update to BcContainerHelper changing sandbox containers to become multitenant by default. The tenant needs to be specified in the config file. More information can be found here.

Credential Type Configuration Settings

The server and client must have the same Credential Type configuration (SaaS installations are required to use “UserName” as a credential type). It is not normal for the client’s or server’s credential type change.

• For On-premise installations, the server’s Credential Type is set via the Business Central Administration tool.
• The Shop Floor Insight application’s client’s credential type is defined in the config file where the Shop Floor Insight service runs. Search for “Classic and Digest” and see what is specified in the Value tag.