- 7 minutes to read

Prerequisites for the Nodinite Web Client

This page lists what the Nodinite Web Client needs from the server, the browser, and the network. The Web Client is an IIS-hosted web application on the Nodinite Application Server and ships with the Nodinite Core Services package; you install it with Install Nodinite v7.

graph LR subgraph "Consumers" roBrowser["fab:fa-chrome Chrome
fab:fa-edge Edge
fab:fa-firefox Firefox
fab:fa-safari Safari"] end subgraph "Nodinite Application Server (IIS)" roWebClient("fa:fa-globe Web Client") --- roWebAPI("fa:fa-cloud-sun Web API") roBrowser --- roWebClient end

Diagram: Supported browsers and Web Client communication with the Web API.

Verified Topic
IIS Windows Features
Supported Client Browser
Windows rights
Firewall

Use the checklist above to prepare the server for the Web Client.

IIS Windows Features

The Nodinite Web Client is an IIS-hosted web application built on .NET 10 and ASP.NET Core. The server needs a Windows Server version that .NET 10 supports.

Key requirements

  • Windows Authentication - Required when the environment uses Windows Authentication (set in the Portal, Step 2: Auth)
  • ASP.NET Core Module V2 - Required to host .NET 10 web applications in IIS

IIS Windows Features - Complete feature list, installation scripts, and troubleshooting

Supported Client Browser

The Nodinite Web Client runs in current, evergreen browsers. Browsers update themselves every few weeks, so Nodinite supports the current stable version of each browser below rather than a fixed minimum version. Keep automatic updates on; an outdated browser may render pages incorrectly or miss security fixes.

Browser Supported version Release notes Status
Microsoft Edge (Chromium-based) Current stable version Edge stable channel ✅ Recommended
Google Chrome Current stable version Chrome releases ✅ Recommended
Mozilla Firefox Current release, or the current Extended Support Release (ESR) Firefox releases ✅ Supported
Apple Safari Current version on a supported macOS Safari release notes ✅ Supported
Internet Explorer None Internet Explorer retirement ❌ Not supported

We develop and test Nodinite using Chrome and Edge to give you the best and richest experience. Our recommendation is to stick with these options.

The browser must allow pop-ups from the Web Client for downloads, see Allow browser pop-ups. With Windows Authentication, add the Web Client to the Local Intranet zone so users sign in without a prompt, see Login prompt asks for a password.

What Windows rights does the Web Client require?

The Nodinite Web Client runs as its own IIS web site with a dedicated App Pool. The service identity is set in the Portal (Step 2: Auth → Service account defaults, or per service in Step 4: Servers → Core platform services), and the CLI package configures the site and App Pool during installation.

Service Account Requirements

  • The App Pool service account must be able to log on to the server: Allow Logon locally
  • If the service account is not a local administrator, it must be a member of the IIS_IUSRS group
  • The service account must have Read rights on the %windows%\system32\inetsrv\config folder (for redirection.config access)

Note

To grant a user account the ability to log on locally to a domain controller, make that user a member of a group that already has the "Allow logon locally" system right, or grant the right to that user account directly.

How It Works

  • The App Pool runs with the service identity from the Portal
  • End-users authenticate against the Web Client site with the mode chosen in the Portal: Windows Authentication or OAuth 2.0 / OpenID Connect
  • Calls to the Web API carry the end-user's identity, so the Web API can apply role-based access control

With Windows Authentication and a domain account or gMSA as identity, register the HTTP SPNs for the Web Client host name so Kerberos works, see HTTP SPN for IIS.

IIS Authentication settings - Authentication configuration and troubleshooting
IIS_IUSRS Group Membership - How to configure service accounts for least-privilege deployments

Tip

Troubleshooting permissions: If you encounter "Cannot read configuration file due to insufficient permissions" errors, ensure the App Pool account has Read rights on %windows%\system32\inetsrv\config. See the IISConfigurationFile troubleshooting guide.

What are the required Firewall settings for the Web Client?

The users' browsers are the only callers of the Nodinite Web Client. The Web Client never touches SQL Server; it calls the Web API for all data and, when the AI Assistant is on, the MCP Server. Sign-in uses the domain controller (Windows Authentication) or Microsoft Entra ID (OAuth 2.0 / OIDC). The diagram shows each host, with the port on the arrow, drawn from the side that opens the connection.

graph LR subgraph "Users' browsers" roBrowser["fab:fa-chrome fab:fa-edge Browser"] end subgraph "Nodinite Core Services Server" roWebClient["fa:fa-globe Web Client - IIS"] roWebAPI["fa:fa-cloud-sun Web API - IIS"] roMCP["fa:fa-plug MCP Server - IIS"] end subgraph "Domain Controller" roDC["fa:fa-server DNS, Kerberos, LDAP"] end subgraph "Microsoft Entra ID - OAuth mode only" roEntra["fab:fa-microsoft login.microsoftonline.com"] end subgraph "AI provider - AI Assistant only" roAI["fa:fa-robot Model endpoint"] end roBrowser -->|"HTTPS, Web Client port"| roWebClient roWebClient -->|"Web API port"| roWebAPI roWebClient -.->|"MCP Server port"| roMCP roBrowser -->|"53, 88"| roDC roWebClient -->|"53, 88, 389"| roDC roBrowser -.->|"HTTPS 443, sign in"| roEntra roWebClient -.->|"HTTPS 443"| roEntra roWebClient -.->|"HTTPS 443"| roAI

Diagram: browsers reach the Web Client on its Portal port, and the Web Client calls the Web API on the same server. Dotted arrows apply only in OAuth 2.0 mode or when the AI Assistant is turned on.

Note

Ports are set per environment: on Windows Server, each Core Service runs as its own IIS web site on its own port, set in the Nodinite Portal (Step 4: Servers → Core platform services). Step 6: Review and Download summarizes the allocated ports. Ports in examples are examples only. The CLI package creates the IIS bindings, not the firewall rules.

Between the users' browsers and the Web Client

Direction Source Destination Protocol Port(s) Purpose Notes
Inbound Users' browsers Core Services Server (Web Client) TCP (HTTPS) Web Client port Every Web Client page Set in the Portal; use HTTPS with a trusted certificate, see Hardening
Outbound Users' browsers Domain Controller TCP/UDP 53, 88 Resolve the Web Client host name and get a Kerberos ticket Windows Authentication; see Login prompt asks for a password
Outbound Users' browsers Microsoft Entra ID (login.microsoftonline.com) TCP (HTTPS) 443 Sign in OAuth 2.0 / OIDC mode only; see Auth mode

Reporting tools and scripts call the Web API directly, not the Web Client; their rules are in the Web API prerequisites. The Copy API URI feature in the Web Client helps users find those endpoints for custom Reports.

Between the Web Client and the Web API and MCP Server

All Core Services run on the one Core Services Server, so these rules are needed only if a host firewall restricts local traffic.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Core Services Server (Web Client) Core Services Server (Web API) TCP (HTTPS) Web API port All data; the Web API handles every database call Set in the Portal
Outbound Core Services Server (Web Client) Core Services Server (MCP Server) TCP (HTTPS) MCP Server port MCP tools for the AI Assistant Only when the AI Assistant is on; see MCP Endpoint External Access

Between the Web Client and the identity and AI services

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Core Services Server (Web Client) Domain Controller (DNS server) TCP/UDP 53 DNS name resolution Hosts-file entries are a fallback
Outbound Core Services Server (Web Client) Domain Controller TCP/UDP 88, 389 Kerberos and LDAP for Windows Authentication Needs an HTTP SPN for IIS when the site runs under a domain account
Outbound Core Services Server (Web Client) Microsoft Entra ID (login.microsoftonline.com) TCP (HTTPS) 443 OpenID configuration, signing keys, and tokens for the Web API and MCP Server OAuth 2.0 / OIDC mode only
Outbound Core Services Server (Web Client) AI provider endpoint TCP (HTTPS) 443 AI Assistant and Diagram Assistance prompts Only when an AI provider is configured; allow the provider's host name

What to get right

  • No fixed default port: the Web Client port is whatever you set in the Portal; users browse to the host name and that port.
  • No SQL Server rule: the Web Client doesn't access any database.
  • Versions: Nodinite v7 hosts the Web Client on its own Portal port; update bookmarks and firewall rules when you move from an earlier version.
  • DNS (53): users must browse with the host name or FQDN that matches the TLS certificate, never the IP address, because Kerberos builds the SPN from the name.

Frequently asked questions

Find answers to common problems and the FAQ for the Nodinite Web Client on the Troubleshooting page.

Can I secure the Web Client?

Yes. Run the Nodinite Web Client over HTTPS only. In v7 you enter the TLS host name (FQDN) and certificate subject in the Portal (Step 4: Servers → Core host Configuration), and the CLI package binds the certificate to the Web Client site.

Important

Review the Nodinite IIS Hardening user guide for more information.

What SQL rights does the Web Client require?

None. The Nodinite Web Client does not access any database; its App Pool identity needs no SQL Server grants.

Note

Nodinite v6 is no longer supported. To move an existing v6 installation, follow Updating from v6 to v7.

Next Steps

Install Web Client
Hardening
IIS Windows Features

Web Client
Core Services
IIS Authentication settings
HTTP SPN for IIS
Reports
Roles
Troubleshooting
Uninstall Web Client
Update Web Client
Web API