--- title: Enabling Secure Historian Access for Explorer Utilizing Pulse description: Enable the Explorer for secure access to your Historical data. --- [Skip to content](https://docs.timebase.flow-software.com/knowledge-base/enabling-user-management-in-explorer-utilizing-pulse#main-content) [More support](https://docs.timebase.flow-software.com/knowledge-base/kb-tickets/new?hsLang=en) [![FlowEmailHeader](https://docs.timebase.flow-software.com/hs-fs/hubfs/FlowEmailHeader.png?width=120&height=33&name=FlowEmailHeader.png)](https://flow-software.com/) Open main navigation Close main navigation - [More support](https://docs.timebase.flow-software.com/knowledge-base/kb-tickets/new) - [Open a Support Ticket](https://docs.timebase.flow-software.com/knowledge-base/kb-tickets/new) [Open a Support Ticket](https://docs.timebase.flow-software.com/knowledge-base/kb-tickets/new?hsLang=en) Search all Timebase documentation - There are no suggestions because the search field is empty. 1. [Timebase Knowledge Base](https://docs.timebase.flow-software.com/knowledge-base?hsLang=en) 2. [Timebase Pulse](https://docs.timebase.flow-software.com/knowledge-base/timebase-pulse?hsLang=en) # Enabling Secure Historian Access for Explorer Utilizing Pulse ## Enable the Explorer for secure access to your Historical data. [**Ensure Pulse is Configured for HTTPS**](https://docs.timebase.flow-software.com/knowledge-base/enabling-user-management-in-explorer-utilizing-pulse#HistorianHttps) [**Create a Client in Pulse**](https://docs.timebase.flow-software.com/knowledge-base/enabling-user-management-in-explorer-utilizing-pulse#PulseClient) [**Configure Explorer to Utilise an Identity Provider**](https://docs.timebase.flow-software.com/knowledge-base/enabling-user-management-in-explorer-utilizing-pulse#HistorianIdp) **[Keep Your Secret Safe Using Environmental Variables](https://docs.timebase.flow-software.com/knowledge-base/enabling-user-management-in-explorer-utilizing-pulse#SafeSecret)** --- ### Ensure Explorer is configured for https   In order to utilise authorized access, Explorer must be configured to utilize https communication and be bound to a certificate.  See the example below on a sample settings.config file to enable https on Explorer: Default location for the settings.config file on Windows environments are: C:\\ProgramData\\Flow Software\\Timebase\\Explorer\\Settings Make sure that your configured url endpoints are not using the same port. By default, the **http** endpoint is binding to port **4531** and **https** to port **4532** ``` "Kestrel": {    "Endpoints": {      "Http": {       "Url": "http://:4511"      },       "Https": {       "Url": "https://:4512",        "Certificate": {           "Subject": "localhost",           "Store": "Root",           "Location": "CurrentUser",        "AllowInvalid": "true"       }     }  }  } ``` What are the possible values for the different certificate properties you may ask? **Location** is either `CurrentUser`or `LocalMachine` Your **Store**`` Name is either `AddressBook`, `AuthRoot`, `CertificateAuthority`, `Disallowed`, `My`, `Root`, `TrustedPeople`, or `TrustedPublisher`  **Subject** refers to the value of the "Subject" field in your certificate **AllowInvalid** where the value is set to true if the validity check for the certificate should by bypassed/ignored. Set to false if only valid certificates are permitted.     ### Create a Client in Pulse By Default, Pulse will have created clients to use for all Timebase modules. These clients's Client Id and Client Secrets can be used to configure the different modules Idp settings. It is assumed by this point that Pulse is installed, configured to use https and bound to your certificate and active. Create a Client via the Pulse UI by navigating to the https address of your Pulse service. Client should have the following minimum config configured: ![2-image-png-4](https://docs.timebase.flow-software.com/hs-fs/hubfs/2-image-png-4.webp?width=260&height=638&name=2-image-png-4.webp) **Client Id** - Unique Client Identifier  **Redirect URL** - redirect to the Log in dialog after successful authorization. For the Historian this value will be: **https://\:4532/callback**   **Allowed Audiences -** Explorer must be allowed to "connect" to all historians providing data. Make sure to add your Historian Client Ids **Grant Types** - `Client Credentials` **Scopes** - `Open ID`   Once done configuring the client, select **save**. Select your newly created client to gain access to your **Client Id** and **Client Secret**. You need both of these for the next step. ![2-imageclient](https://docs.timebase.flow-software.com/hs-fs/hubfs/2-imageclient.webp?width=624&height=522&name=2-imageclient.webp) You can copy/paste your Id and client secret from the client details page to configure your Explorer's identity provider settings.     ### Configure Explorer to Utilise an Identity Provider In order for Explorer to authenticate against Pulse using the new Client you configured; you need to edit the Explorer sources file to include your new authentication settings. See an example below: Default location for the sources.config file on Windows environments are: C:\\ProgramData\\Flow Software\\Timebase\\Explorer\\Config ``` {  "Historians": {    "Local": {      "Name": "Local",      "Host": "localhost",     "Port": 4512,     "UseTls": true,      "Auth": {        "Enabled": false,        "IdP": {          "Host": "localhost",          "Port": 4542,          "UseTls": true        },       "ClientId": "",       "ClientSecret": ""      }    }  }} ```   You will use your copied Client Id and Client Secret to configure your historian Idp settings. ### Keep your secret save using Environmental variables Potentially, having your secret in plain text can be a security violation and best practises would be to use environment variables to store your secret.  Environmental variables can be referenced in your setting file: ``` "Auth": {    "Enabled": true,    "IdP": {       "Host": "",        "Port": 4542,       "UseTls": true    },   "ClientId": "",   "ClientSecret": "%MyClientSecrectEnv%"  } ```   For Windows based systems, an environmental variable placeholder is denoted by %%, while in Linux / Mac it is denoted by ${} e.g %MyClientSecrectEnv% n Windows and ${MyClientSecrectEnv} in Linux / Mac   - [Software Releases](https://docs.timebase.flow-software.com/knowledge-base/software-releases?hsLang=en) - [Timebase Quick Start](https://docs.timebase.flow-software.com/knowledge-base/timebase-quick-start?hsLang=en#main-content) - [Start Here!](https://docs.timebase.flow-software.com/knowledge-base/timebase-quick-start?hsLang=en#start-here) - [System Requirements](https://docs.timebase.flow-software.com/knowledge-base/timebase-quick-start?hsLang=en#system-requirements) - [Advanced Topics](https://docs.timebase.flow-software.com/knowledge-base/timebase-quick-start?hsLang=en#advanced-topics) - [Timebase Historian](https://docs.timebase.flow-software.com/knowledge-base/timebase-historian?hsLang=en) - [Timebase Data Collectors](https://docs.timebase.flow-software.com/knowledge-base/timebase-data-collectors?hsLang=en) - [Timebase Explorer](https://docs.timebase.flow-software.com/knowledge-base/timebase-explorer?hsLang=en) - [Timebase Pulse](https://docs.timebase.flow-software.com/knowledge-base/timebase-pulse?hsLang=en) - [Windows Services Starter](https://docs.timebase.flow-software.com/knowledge-base/windows-services-starter?hsLang=en) Copyright © 2025, Flow Software