In this lesson we're talking about letting our users into our asset framework server.
Now the good thing is that the security model is almost exactly the same as on the PI data
archive. You create identities, give those identities permission to do things and then
map domain users and groups to them. But before we go into the configuration it's
important to know how user connections work when connecting to asset framework.
So here's us, we want to use PI Datalink.
PI Datalink is the PI systems plug in to Microsoft Excel. So we want to put the
most recent value of a pump's temperature in a cell on our report, so when we execute the query
Excel connects to the asset framework server after authentication through a mapping and approval from
the server it asks I want the current value of pump 01's temperature. AF doesn't return a value,
it returns a pointer, something like slash slash PISRV01 slash pump01.ts.pv.
So PI Datalink automatically sees that this is a reference to a PI point and instantly goes
to PISRV01 authenticates and then asks what's the current value of pump01.ts.pv? The PI data archive
returns 14.6, then PI Datalink shows the value on the spreadsheet. It also remembers some of
the context it grabbed from AF it might have units and some other metadata that goes along with it.
It isn't just PI Datalink that does this but all PI system clients make independent connections to
both the PI data archive and AF server. This is why a connecting user will need access
to both the data archive and asset framework servers independently
no matter how they're accessing the data. Now in this lesson we'll configure our asset framework
server to minimum best practices. We're going to configure user access for administrators
who'll always have full access to everything, users will have read-only access to everything
and power users will have read-write access to a special development database on the server.
Here we are on PISRV01 we're going to open
PI system explorer. So click start, navigate down to PI system and then run PI system explorer.
You can run this tool from really anywhere I usually in real life we'd be running it from
our own laptop rather than remoting into the server and running it especially not the PI
data archive but we've opened it up now let's make that full screen and we get connected to
our database one that we created when we tested that asset framework was installed properly
right at the beginning of this course. So we're going to click on the database button.
Now we see here a list of our databases, now we've got two of them we've got configuration
and we've got database one. Database one we created when we first installed the server
and configuration stores configuration data for various
PI system applications. This isn't really a database that's navigated to by users.
Now just in preparation for the following exercise we're going to rename this database one
we're going to rename it to production
and we're going to create a new database and this is going to be called development.
Now there's a lot of reasons why you might have multiple databases in asset framework
you may have one like here for development and production, you may have different databases for
different applications maybe you have a custom application that requires data to be set out in
a very specific way, maybe you have different databases for different user groups and set
up security differently between them. Now we're going to use this as a little bit of an example
because later we're going to configure security so our
power users can modify our development database but not our production database.
Speaking of security let's take a look. So the place to go to here is show properties,
this will show the properties of the asset framework server we're connected to. We see a
whole lot of tabs here, the ones we're interested in are the mappings and the identities tabs.
These work in very much the same way as the PI data archive identities and mappings. So
let's take a look at how security is configured so far. If we look at the mappings we have the local
administrators group mapped to administrators and the windows everyone group mapped to world.
This is the default configuration for asset framework servers and really a placeholder
until you put in a better security model. It's not intended that you'll just leave this in here, it's
inherently very insecure and really only there to allow you to access it for the first time.
We're going to go ahead and configure our admins users and power users mappings here.
First off the administrator mapping, so rather than the local administrators group
I'd like a mapping from my PI admins group, so let's make a new mapping right click
in the white space and new mapping. Now the account we'd like if we click on search is PI
administrators, PI ad and then check names will do you okay we'd like to map that to administrators.
So administrators is an identity that comes by default with the asset framework server that has
access to everything. Now we have this old built-in administrators mapping here, we're
going to go ahead and remove this, it's really not best practice to use local groups in your
security you want to standardize on using domain groups. So we're going to right click and delete
okay. Now we're going to create a mapping for our users. We've got this everyone mapping at the top
where everyone that tries to connect will just be let in under this world identity.
Instead we're going to make another one, so we'll right click and make a new mapping.
Our account is going to be PI users
and our identity we're going to take advantage of this world identity that's already in
place. Now we have PI users in here we're going to go ahead and delete this everyone identity here.
Okay I'm feeling better already.
Now the final mapping is for our power users. Before we make a mapping though
we'll need an identity, so we're going to flick over to identities
and we're going to make a power user's identity.
Okay we may as well make the mapping here while we're configuring the identity.
It allows us to create a mapping straight away.
So we're going to map and here we're going to select our PI power users group.
Okay so that's looking good we're going to go okay on there, go back to our mappings
and we see the power users mapping in there now as well. Now there's one last thing I'd like to
do with power users which is give them permission to edit the development database. So we're going
to go okay on here and we're going to right click on the development database and click on security.
Now every part of asset framework allows you to configure who is allowed to do what
at every level, the security gets very granular we're not going to go through specific settings
on specific parts of the database we're just going to give the power users full control over
this development database. If you're interested in looking at the granular security controls
then check the documentation, we'll reference it to the side.
Now this development database we have everything selected up the top so all
parts of our development database we're going to add in our power users and give them full control.
So we're going to go okay here
and that's that for security configuration. There's a few things I wanted to show you
before we leave though, I'm going to go back into the server properties here
and then click on connections.
Here I have everyone that's currently connected to my asset framework server.
This is a very useful way for you to see which of your clients is currently connected and who
are they connecting as. Another thing I'd like you to see is effective permissions.
So if we cancel this and go back into the security options we were looking at before with the
development database, I can right click and click on security and I can click on effective access.
Now I'm going to select a user account at the top I'm going to click on the magnifying glass
and I'm going to type in student02.
Student02 is actually in our users group so let's see what they have access to here.
Okay they're logging in as world and they have read permission to development
analyses read and read data etc. so we can see exactly what they can do.
Now I'm going to search for student03. Student03 is in the power users group,
so let's see what they can do. Okay their identities are power users
and world and I can see that they have really full control over every object in this database.
So this is a very useful tool to see what kind of effects your security changes have made. Now our
security is all set up asset framework is ready to be built, so we have our development database
and our production database. Really from here I'd expect my power users to go into my development
database they would build out a structure that is useful for certain projects in the
organization then my administrator would port over their work to the production database and
users will be able to see it. Now we don't cover actually building the database in this course,
that's covered in other courses under our power user course series.