Everything on this page is done on the Mosart server, in Mosart central settings, under Remote Controller Service > Security. Open those settings from Manus Administrator, AV Automation or Media Admin.

Note: Do all of it on the main server and on the backup server. The backup is configured separately and is the easiest thing to leave half-done. A setup that works until a failover is almost always a backup server that was never configured, or never restarted.

Info: Two similar names are in play. Remote Controller Service is the settings category you navigate to. The Windows service you restart is listed as MosartRemoteControlService.

Turn on HTTPS

Under the HTTPS section:

Setting

Value

Use HTTPS

on

Certificate path

path to your .crt file

Certificate key path

path to your .key file

Certificate password

the private key password

SignalR HTTPS port

55168 (the default)

The HTTPS port is the plain port plus one. Plain HTTP is 55167, so HTTPS is 55168.

Restart the Mosart Remote Control Service, then confirm the server answers on the new port:

https://<mosart-server>:55168/api/v1/status

You should get a status document, with no certificate warning.

Turn on OIDC authentication

Under the OIDC / JWT authentication section:

Setting

Value

Use OIDC authentication

on. Requires HTTPS.

OIDC authority

the Authority URL, the same one the Web Apps use

OIDC audience

the Client ID, or leave empty to skip audience validation

Restart the Mosart Remote Control Service.

Note: If the audience does not match the aud value in the token, every call is refused with 401 even though the token itself is valid. Leave the audience empty if you are unsure, and set it once sign-in is working.

Note: Turning this on switches off the REST API key. The key is not checked at all, so every integration that authenticates to the Mosart REST API with the REST API key is refused with 401. See Choosing an Authentication Mode, and plan for this before you enable authentication in production.

Roles the Mosart server enforces

With OIDC on, the Mosart server reads the user's role from the access token and enforces it on the Named Overlays REST API:

Role

On the Named Overlays API

mosart-admin

Read and write: create, edit, delete and import overlays.

mosart-viewer

Read only. Writes are refused with 403.

A signed-in user holding neither role is refused on reads as well as writes.

Info: Role enforcement on the Mosart server requires Viz Mosart 5.16 or later together with Mosart Web Apps 3.2 or later. In earlier versions the Mosart server checked only that a caller was authenticated.

Other surfaces on the Mosart server accept any signed-in user, whatever role they hold. That includes the SignalR hub and the playout REST API (timeline, fader, devices and settings). Role coverage for those is tracked separately.

Check the server on its own

Before involving the browser, confirm the server behaves:

  1. It answers on HTTPS. https://<mosart-server>:55168/api/v1/status returns a status document.

  2. It refuses anonymous callers. The same URL under /api/v1/namedoverlays, with no credential, returns 401.

  3. It refuses the API key. With OIDC on, a call presenting X-API-Key also returns 401. That is correct, and it is the check that tells you OIDC really took effect.

Then continue with the end-to-end check on the Security chapter page.