What is ProjectWise Web?

ProjectWise Web is a ProjectWise 365 service that provides ProjectWise Design Integration users with secure, web-based (cloud) access to the content in their on-premise ProjectWise datasources.

Who is ProjectWise Web for?

ProjectWise Web is intended for ProjectWise Design Integration users who need to create, edit, or review ProjectWise documents from the web.

How do you get to ProjectWise Web?

Who can access ProjectWise Web?

You must be a member of the ProjectWise project in order to be able to access ProjectWise Web in that project.

What browsers can I use with ProjectWise Web?

You can access ProjectWise Web from a Microsoft Windows desktop (or server) using any these supported browsers: Google Chrome, Microsoft Edge, Mozilla Firefox

You can also access ProjectWise Web from a mobile device, however this is not actively supported.

What work areas will I see once I'm in ProjectWise Web (how do they get there)?

The project administrator will select which work areas will be available in ProjectWise Web.

Can ProjectWise Web provide access to other types of repositories?

No, ProjectWise Web is specifically designed to only provide access to work areas in ProjectWise datasources.

Who can access a work area that has been made available in ProjectWise Web?

Any user who is a participant of the work area, whose datasource user account is active, and who is a team member of the ProjectWise project, can log in from ProjectWise Web.

You can log in with a Bentley IMS account, a Windows account or a logical (ProjectWise native) account.

Do I need a license to use ProjectWise Web?

Yes, each user who logs in through ProjectWise Web will consume a Bentley CONNECTIONS Passport.

What content will I see when I log in to a work area in ProjectWise Web?

Once logged in, users will only see whatever folders and documents they already have permission to see in ProjectWise Explorer.

You cannot see or access any content in the datasource that you do not have permission to see or access.

What can users do in ProjectWise Web?

Once logged in to a work area, users can browse folders, search for documents, download documents, check out documents, open documents, markup PDFs, and get HTTPS links for documents, folders, and saved searches so they can be sent to other users or embedded in documents.

How are document and folder permissions set in ProjectWise Web?

You cannot set or change document and folder permissions from ProjectWise Web.

Instead, document and folder permissions are set in ProjectWise Explorer as usual, and whatever permissions are set there will carry over to ProjectWise Web.

I have access to a document in ProjectWise Web but I cannot view it or download it - why?

You probably do not have File Read permission on the document.

If you have general access to a document (Read permission) but you do not have general access to view the file that is attached to the document (File Read permission), then you will be able to see the document in the list (in its folder, or in the search results), but you will not be able to view or download the document's file.

How is ProjectWise Web View different from ProjectWise Web?

First, let's talk about how they are the same:

• Both are cloud services available in the CONNECT Center
• Both services can provide web-based (cloud) access to content stored in ProjectWise datasources
• Both services use the same general method (Bentley Web Services Gateway and the ProjectWise Plug-in for WSG) to provide a connection to ProjectWise datasources
• Both services respect the user permissions set in the ProjectWise datasource that is being connected to
• Both services support the same methods for logging in to the datasource (Bentley IMS single sign-on, or manual log in with a logical (ProjectWise native) account or Windows-based account)

Now let's talk about how they are different:

• ProjectWise Web provides web access to selected work areas in a particular datasource. ProjectWise Web View provides web access to selected datasources.
• ProjectWise access in ProjectWise Web is read-write. ProjectWise access in ProjectWise Web View is read-only.
• ProjectWise Web is one of the ProjectWise 365 Services available in each ProjectWise project, and is accessed from a tile inside the project (it is project based). ProjectWise Web View is NOT a ProjectWise 365 Service, and is instead accessed from a tile directly from the CONNECT Center home page (it is enterprise/organization based).
• You must be a member of a ProjectWise project in order to enter the ProjectWise Web portal of that project. You do not need to be a member of any project in order to enter ProjectWise Web View (you only need a Bentley IMS account, which is already a general requirement for accessing the CONNECT Center).
• ProjectWise Web requires a license. ProjectWise Web View is free.

Where are my old work area connections from ProjectWise Share?

If you still have any older work area connections that you created in the old ProjectWise Web / ProjectWise Share portal (https://projectshareportal.bentley.com), you can access them by opening the Connections panel in ProjectWise Web and then clicking Open older PW Web Connections at the bottom.

How do admins add work areas to ProjectWise Web?

The administrator adds work areas to ProjectWise Web by creating work area connections on the Manage ProjectWise Connections page:

1. Click the Manage Connections icon (upper left) to open the Manage ProjectWise Connections page.
2. Click New Connection.
   

See Adding an Existing Work Area Connection To a New Tab in Microsoft Teams .

How does ProjectWise Web connect to ProjectWise datasources?

ProjectWise Web uses Bentley Web Services Gateway and the ProjectWise Plug-in for Bentley Web Services Gateway to connect to the ProjectWise Design Integration Server where your datasource(s) are stored.

How do I configure Bentley Web Services Gateway and the ProjectWise Plug-in?

Bentley Web Services Gateway configuration is documented in the ProjectWise Implementation Guide, but these are general the steps for setting up Bentley Web Services Gateway for ProjectWise Web:

1. First you configure a secure website in IIS (Internet Information Services) that you will deploy Bentley Web Services Gateway and the ProjectWise Plug-in to.
2. Then you install ProjectWise Explorer and configure the ProjectWise network to provide Bentley Web Services Gateway with access to the datasources of your ProjectWise Design Integration Server or servers.
3. Then you install Bentley Web Services Gateway and the ProjectWise Plug-in for Bentley Web Services Gateway.
4. Then you deploy Bentley Web Services Gateway and the ProjectWise Plug-in to the website you configured in step 1, making sure to enable cross-origin resource sharing (CORS) requests for all of the Bentley cloud services that you will be using with this Bentley Web Services Gateway deployment.
5. If users need to mark up PDFs using the PDF Markup Service, your Bentley Web Services Gateway must be public facing.

How do I make Bentley Web Services Gateway public facing?

This task is done by your IT department.

Bentley Web Services Gateway must be public facing in order for users to be able to mark up PDFs using the PDF Markup Service. If that feature is not required, then Bentley Web Services Gateway does not need to be public facing. If the server on which Bentley Web Services Gateway is installed is not already public facing and you need these features, talk to your IT department about making Bentley Web Services Gateway public facing.

How do I enable CORS in Bentley Web Services Gateway?

When you are deploying Bentley Web Services Gateway, the deployment wizard has a page where you can specify the URL for each Bentley cloud service you will be using with Bentley Web Services Gateway that needs CORS (cross-origin resource sharing) requests enabled.

The specific steps are documented in the ProjectWise Implementation Guide, but these are the URLs that you need to enter in order to enable CORS for each service (this table includes all of the URLs that are needed for both ProjectWise Web and ProjectWise Web View):

Can ProjectWise Web display work areas from datasources running on different servers?

Yes, as long as connections to those servers have been configured in the ProjectWise network on the Bentley Web Services Gateway computer.

What versions of Bentley Web Services Gateway and the ProjectWise Plug-in are required for ProjectWise Web?

To get the latest functionality in ProjectWise Web, the administrator should install the latest released version of the ProjectWise Plug-in for Bentley Web Services Gateway.

At the time of this writing:

• The latest released version of the ProjectWise Plug-in for WSG is CONNECT Edition Update 3.4 (10.00.03.434) which requires ProjectWise Explorer CONNECT Edition Update 3.3 (10.00.03.336)
• The latest released version of Bentley Web Services Gateway is 02.06.08.09.
• The latest released version of the ProjectWise Design Integration Server is CONNECT Edition Update 3.2 R4 (10.00.03.299).

Why does Bentley Web Services Gateway require port 443 to be open?

Short answer:

So that ProjectWise Web users can connect to Bentley Web Services Gateway.

Longer answer:

The secure website in IIS that you deploy Bentley Web Services Gateway to uses port 443 by default. Technically you can configure your secure website to use some other port, but 443 is the default port for secure (HTTPS) websites. This means that communication to Bentley Web Services Gateway comes in through port 443, which in turn means that this port needs to be open in order to allow ProjectWise Web users to access Bentley Web Services Gateway.

There are two places you need to open port 443.

• First - and this is required for both internal and external users - in the Windows Firewall on the Bentley Web Services Gateway computer
• Second - and this is required only for external users - in your corporate firewall

When a user connects to ProjectWise Web, the necessary JavaScript files are downloaded to the user's computer, and so that instance of ProjectWise Web is actually running locally, from inside the user's browser. This means that ProjectWise Web connections to Bentley Web Services Gateway are really coming from each user's computer, not from ProjectWise Web in the CONNECT Center (in the cloud).

For internal ProjectWise Web users (users who are working inside the LAN/VPN where Bentley Web Services Gateway is running) to be able to connect to Bentley Web Services Gateway, you must open port 443 in the Windows Firewall running on the Bentley Web Services Gateway computer.

For external ProjectWise Web users (users who are working outside the LAN/VPN where Bentley Web Services Gateway is running) to be able to connect to Bentley Web Services Gateway, you must open port 443 in the Windows Firewall running on the Bentley Web Services Gateway computer AND ALSO you must open port 443 in your corporate firewall.

If you ONLY have internal ProjectWise Web users, then you do not need to open port 443 in your corporate firewall, but you must at least open port 443 in the Windows Firewall running on the Bentley Web Services computer.

Can I create a whitelist of trusted IP addresses in order to limit the traffic coming in through port 443?

Yes.

Because communication to Bentley Web Services Gateway is actually coming directly from each ProjectWise Web user's computer, you can whitelist the IP address of the individual ProjectWise Web users (client computers) that you want to allow access through port 443.

You cannot (nor do you need to) whitelist the actual ProjectWise Web service that is running in the CONNECT Center, as it does not have an IP address.

What types of authentication does ProjectWise Web support?

ProjectWise Web supports the same types of authentication supported by ProjectWise Design Integration, which are:

• Bentley IMS authentication
• ProjectWise authentication
• Windows authentication

Does ProjectWise Web support OIDC authentication?

No.

ProjectWise Web supports the same types of authentication supported by ProjectWise Design Integration. ProjectWise Design Integration Server does not currently support OIDC authentication, therefore ProjectWise Web does not support it either.

Does ProjectWise Web support single sign-on?

Yes, ProjectWise Web supports Bentley IMS single sign-on.

When the work area connection is configured to use Bentley IMS authentication, a work area participant with a Bentley IMS account will be logged in automatically just by selecting the datasource in ProjectWise Web. If the user does not have a Bentley IMS account in the datasource, they will be prompted to enter the user name and password of their logical (ProjectWise native) account or Windows account).

What are the requirements for logging in to a connection with a Bentley IMS account?

• The datasource that contains the work area you plan to connect to must have Bentley IMS authentication / single sign-on enabled
• You must turn on Use Bentley IMS Authentication when creating the work area connection
• The user must have a Bentley IMS account in the datasource and be a participant of the work area.
• Access to https://ims.bentley.com/

  In order for users to be able to log in with their Bentley IMS account, an outbound rule that allows access to https://ims.bentley.com/ must be added to every firewall between Bentley Web Services Gateway and https://ims.bentley.com/.

Does ProjectWise Web save passwords?

No.

No user name or password combination is ever saved anywhere, locally or in the cloud, when the user logs in to a datasource through ProjectWise Web.

Logging in with a Bentley IMS account does generate an access token, but this is only used to identify the user, it does not contain the user's user name and password.

What are the requirements for opening Office documents in a browser?

• You must have a Microsoft 365 subscription
• ProjectWise Drive (version 2021.3.x or later) cannot be installed (when this version is installed, documents will open in your Office desktop app instead of a browser)

What are the requirements for marking up PDFs

Do we need to secure the API Explorer page of the Bentley Web Services Gateway deployment?

You do not need to secure the API Explorer page, as it is just a client-side JavaScript page that is used to test your deployment and confirm that you can actually log in to your datasources through Bentley Web Services Gateway.

However, if you want to remove it altogether, you can safely delete the following folder (where the page is generated from) without affecting your Bentley Web Services Gateway deployment in any way:

C:\inetpub\wwwroot\ws\Pages\ApiExplorer

Note that anything under the C:\inetpub\wwwroot\ws\Pages\ folder in the deployment is not required for running Bentley Web Services Gateway. These are just documentation files and public tools that access the Bentley Web Services Gateway deployment through the HTTP protocol.

Does ProjectWise Web store any of my ProjectWise data in the cloud?

No.

No data from your on-premise ProjectWise datasource is ever stored in the cloud. As usual, all documents (files) are stored in the storage area of the ProjectWise Design Integration Server, and everything else is stored in the ProjectWise database.

When a user opens or downloads a document in ProjectWise Web, a copy of that document is sent from the ProjectWise Design Integration Server's storage area directly to the user's computer. When a user uploads a document in ProjectWise Web, a copy of that document is placed in the ProjectWise Design Integration Server's storage area, which is now the master copy of the document.