Modify ThingWorx Permissions: Users and Groups
Non-administrator users must be granted permission to access ThingWorx Navigate tasks. A lack of permission may be the problem if your users receive the following error message:
Reason: 403 - You don't have a valid license. Ask your administrator for access to the following license feature: ptc_navigate_view
To grant permission, perform the following steps:
• Add the non-administrator user to one ThingWorx Navigate License group as per your licenses: navigate_view_named_group, navigate_view_concurrent_group, navigate_contribute_named_group, or navigate_contribute_concurrent_group. For more information, see the following section, License Groups.
• Add a non-administrator user to respective ThingWorx Navigate role groups for which the user wants to access to ThingWorx Navigate tasks. For more information on creating role groups, see the section below, Create a New Role
Group.
• Set the access and visibility of the role groups using common tailoring page. For more information on tailoring permissions, see the section below, Tailor
Roles and Custom User Groups.
• When ThingWorx Navigate is configured with Single Sign-on, disable user modification. This is necessary to prevent PingFederate from removing users from groups after login:
1. In ThingWorx Composer, click 
Browse. Under Security, click Authenticators, and then select ThingworxSSOAuthenticator.
Browse. Under Security, click Authenticators, and then select ThingworxSSOAuthenticator.2. Click Configuration, and then clear the User Modification Enabled check box.
3. Click Save.
 | If the User Modification Enabled check box is selected, then user accounts in ThingWorx can be modified. This is important to allow future updates to accounts during subsequent login events after the initial login when the user is created to synchronize the ThingWorx user data with the user account data in the identity provider. For more information see, Single Sign-on Authenticator. |
• Log in with the non-administrator credentials to verify that the user gets access and visibility only to the tasks his specific role group provides.
Modify Permissions to Two Sets of Groups:
License Groups
In licensing, there are four available groups in ThingWorx Navigate: navigate_view_named_group, navigate_view_concurrent_group, navigate_contribute_named_group, and navigate_contribute_concurrent_group.
In navigate_view_named_group and navigate_contribute_named_group, the number of the users is defined in the license. While in navigate_view_concurrent_group and navigate_contribute_concurrent_group, the limitation of the license is limited by a time frame. An active user holds a license for a 24-hour period.
Tailor Roles and Custom User Groups
The user groups in ThingWorx Navigate let you expose different tasks to users of different roles. The groups also make it possible for you to tailor ThingWorx Navigate by role. User groups appear in the Select role to tailor list on the collection tailoring pages and the task-specific tailoring pages.
Each user must be assigned to only one tailoring role to see any ThingWorx Navigate tasks on the landing page. This can be one of the two default tailoring roles that come with ThingWorx Navigate, Manufacturing and Purchasing, or one of the custom user groups that your site provides.
| | If you delete a group without reassigning the users in that group, they can no longer see any tasks on the landing page. |
Create a New Role Group
For new groups to appear as roles on tailoring pages, edit each group to add the following tag: PLMAppsRolesTag under AccessAppTags.
| | If the PLMAppsRolesTag tag is removed from any group, the role does not appear on the collection tailoring pages and the task-specific tailoring pages. |
Remove a Group
If a group is no longer relevant as a ThingWorx Navigate role, complete the following steps:
1. Remove the group from the members of the ThingWorx Navigate Organization.
2. In ThingWorx Navigate, use the options on the collection tailoring pages to hide all tasks from the group.
3. In ThingWorx Composer, remove the PLMAppsRolesTag tag from the group.
| | If the PLMAppsRolesTag tag is removed from any group before you hide the tasks on the collection tailoring pages, the tasks remain visible to the users of the group. |
Populate User Groups
You can change or add users in the user groups.
1. In ThingWorx Composer, click 
Browse. Under Security, click User Groups, and then select the user group you want to edit.
Browse. Under Security, click User Groups, and then select the user group you want to edit.2. Click Edit and modify the groups in these ways:
◦ Drag users from the Available Members list to the Members list.
◦ Remove users.
3. Click Save.