inrule/authoring-webclient repository overview

⁠irAuthor Web Client

The Web Client serves the irAuthor Web browser application. It runs alongside the irAuthor Web Backend, which provides authoring APIs, sign-in settings, tenant access, and catalog connections.

⁠Before you start

You need:

• Docker with Linux container support.
• A configured Backend and a compatible Web Client image.
• HTTPS addresses on your network and trusted TLS certificates for both services.
• A public SPA application registered with an OpenID Connect identity provider, such as Auth0 or Microsoft Entra ID.
• A browser with Web Locks and crypto.randomUUID support in a secure context, such as HTTPS.

The Web Client handles sign-in, token renewal, and sign-out using settings supplied by the Backend. Configure the issuer and API audience under Identity:Jwt, and the SPA client ID, scopes, public authorization parameters, and optional logout endpoint under Webclient:Oidc on the Backend. Include the delegated API scope for Entra or explicit audience parameter for Auth0, and configure the provider to include email in both ID and API access tokens.

These examples use Docker host address 192.168.10.20 and the shared Docker network irauthor:

Replace the IP address with your host's LAN address. Use certificates valid for that address and trusted by client machines. If your certificates use DNS names, substitute those names consistently.

The Backend address must be reachable from both the browser and the Web Client container. Use the host's LAN address, not the Backend's Docker-only name or localhost.

Register https://192.168.10.20 with the identity provider for sign-in redirects, logout redirects, and browser origins. In the Auth0 example, these are Allowed Callback URLs, Allowed Logout URLs, and Allowed Web Origins. Set the Backend's Mcp__Exposure__AllowedOrigins__0 to that exact origin, without a path or trailing slash. Additional origins use __1, __2, and so on.

MCP and AI capabilities are not supported in self-hosted installations. The Backend's Mcp__Exposure__AllowedOrigins__* setting also controls browser access to the authoring APIs and is still needed for this setup.

The examples use an HTTPS reverse proxy on the Docker host. The containers serve HTTP behind that proxy.

⁠Required configuration

Create webclient.env with your Backend's browser-facing address:

AUTHORING_API_URL=https://192.168.10.20:8443

AUTHORING_API_URL is required; the container stops if it is missing. Keep credentials out of this URL and browser configuration.

Configure sign-in, tenants, and catalog connections on the Backend.

⁠Optional configuration

⁠Run the container

Run these commands in PowerShell beside webclient.env. Use the same irauthor Docker network as the Backend; its setup instructions create the network and connect the dependency containers.

Enter the Web Client image reference for your deployment, including its version tag or digest. Use a version compatible with the Backend rather than updating either image independently through latest.

$WebclientImage = Read-Host "Web Client image reference, including version tag or digest"
docker run -d --name irauthor-webclient --network irauthor --env-file .\webclient.env -p 127.0.0.1:5100:80 $WebclientImage

The container listens on HTTP port 80. Configure the host-local reverse proxy to forward https://192.168.10.20 to http://127.0.0.1:5100. Keep the container's HTTP port bound to loopback. A proxy on another host or in another container needs a separately restricted network path.

⁠Verify the installation

docker logs irauthor-webclient
curl.exe --fail http://localhost:5100/_/health
curl.exe --fail --include https://192.168.10.20/configuration/webclient.json

/_/health confirms that the Web Client and Backend are available. Complete the sign-in and catalog checks below to verify access.

The configuration request must return HTTP 200 with JSON and Cache-Control: no-store, not HTML or a login page. Confirm that Oidc contains your configured issuer, SPA client ID, scopes, and public provider parameters.

Open https://192.168.10.20/acme, replacing acme with the tenant alias configured on the Backend. Sign in through the Web Client and confirm catalog access. The user's sign-in email must match exactly one active account in the tenant's catalog. Reaching the login page alone does not verify authenticated access.

If your Backend and Web Client versions provide a tenant picker, you can also select the tenant there.

Verify token renewal, logout, and account switching. Sign-out clears the application session across tabs. Provider sign-out uses discovery or the Backend's optional Webclient__Oidc__EndSessionEndpoint; without either, the provider SSO session remains active.

⁠Troubleshooting

⁠Configuration changes

When changing AUTHORING_API_URL or NGINX_RESOLVER, recreate the Web Client container with the updated environment. docker restart does not reload an environment file.

For application settings supplied by the Backend, apply the updated Backend configuration and reload the browser page. Recreate the Backend container when changing its environment variables. No Web Client rebuild is needed.

Authoring data belongs in the Backend's SQL Server database and irCatalog, not a Web Client volume.

⁠Related documentation

See InRule documentation⁠ or contact InRule Customer Support for Backend setup, product, licensing, and deployment questions.