In this video we'll setup PI Data Archive
and PI Point access for a new PI
interface in PI Buffer Subsystem which we are using to buffer
the data. We'll want to
configure the minimum needed permissions for this as
described in this KB article,
7 best practices for securing your PI Server.
Before we start, let's
go over the plan. We'll create
identities which will require that we are using PI Data
Archive 3.4.380.36 and
later. We'll create
separate identities for PI Interfaces and PI Buffers.
Separate identities because
interfaces and buffering don't need access to the
same things and we want to configure minimum
permissions. Once our identities are
created, we are going to need to have a way for our
interface and buffer to authenticate and receive these identities.
For the PI Interface,
since we have PI API for Windows Integrated Security
installed on the interface node, we are going to be using a
mapping. Once we are done with the
plan I'll show you how to check
if PI API for Windows Integrated Security is installed on your interface
node. If your interface node does not have PI API
for Windows Integrated Security installed, you
will instead use a PI Trust.
We also be using a mapping for PI Buffer
Subsystem. A mapping requires that we are using
version 3.4.280.79 or
later for PI Buffer Subsystem.
Before we get started, let's confirm I have indeed
installed PI API for Windows Integrated Security on the interface
node. I'll hop
on over to the interface node, PIINT01
and take a look at programs and
features. And you can see that PI API for Windows
Integrated Security is installed on this node. Note
that this is a separate installation from the
interface. When we
get to the section on configuring the mapping, I'll
mention where you can more information about configuring the
trust in case you cannot install PI API for Windows Integrated
Security. Let's get started by
going to our PISVR01
node and I'm going to open
System Management Tools. I'll
navigate to security and check out identities, users and
groups. You can see in the lower
left that I have authenticated as
PI Admins. In
order to configure security for interfaces and buffers, I'm going to need to have
write access permissions
to a lot of security configurations. I've confirmed
that PI Admin still has access to all of the required
configuration items to complete the required security
changes today. Let's start by creating our two new
identities. First let
me right click, create new
identity and I'll call this PI Interfaces.
And I'll do the same
for PI Buffers.
And here I have my two new identities.
Next lets' take a look at the
mappings. This is where I'll be creating
the mappings for the interface and
buffer. However I need to know what service accounts
they are running under to create the mapping. If you chose not
to install PI API 2016 for Windows Integrated
Security on the interface node, you would instead
be creating a trust for the interface application instead
of a mapping to the domain account being used as the service
account. For details on creating this trust,
please see the description of this video for further
information. Let's go ahead
on over to the interface node to check the service accounts for the interfaces and
buffer.
Note that if your interface and
buffer are in a workgroup, it may still be possible to use
API for Windows Integrated Security. Please
see this KB, using Windows
Credential Manager with PI applications
for further information.
Now that we are in services, we can see that
the interface is running as
SVC-Interfaces while the buffer
is running as
SVC-Buffers. Let's go back to the PI Server
node and create our mappings.
I'm going to right click and say new mapping.
And find the Windows account for the interface.
And we'll map this to the identity
PI Interfaces.
Let's do the same
for the buffer service
account.
And we'll map this to the identity
PI Buffers.
We've now created
our two identities and mapped them to the service
accounts used for the interface and buffer.
However the identities don't yet have the correct permissions
on the PI Data Archive. Let's go back to the
KB, seven best practices for securing your PI Server
to check out those leased permissions.
If we scroll
down
we'll get to best practice number five, configuring
minimum permissions for interfaces. You can see that there are multiple
different tables depending on your
configuration. For example, table 5.3
shows the minimum permissions for the
PI Data Archive when there is no buffering and no output points.
In this case the interface
needs read permission on the PI Point
database and read permission on any of the tags
point security. It also needs write permission on the data
security of the individual tags. However in our
case we are buffering but have no output points.
So you will be using table 5.1
Let's start by configuring the
interface identity to have read permissions on the PI Point
database security. Then we'll work on the individual
tags. To do this, let's go to the PI Server
node and let's go to database
security. Let's go to the PI Point
table and we'll go
to properties.
Let's add PI Interfaces
and we'll make sure that it
only has read permissions.
Now let's go back to the KB
to check what we need on the individual
tags.For the
individual tags, the interface identity
needs read permissions on point security while the
buffer's identity needs write permissions on the data
security. Let's first make this change
on one tag in System Management Tools.
Let's go to points, point
builder and let's search for one of our
tags. I've already created all of the tags
but they have the default security
settings. Our point source is OPC and we'll start with
pump 1 bearing temperature.
If I go to security,
under point security,
I'm going to add PI Interfaces.
And give it only
read access.
Under data security, I'll add PI Buffers
and give it only write access.
And then be sure to save these changes.
Double
check it again here and here.
Let's head on over
to the interface node and we'll go ahead and
start the interface. We can see that
PI Buffer Subsystem is already running which I
configured previously. After creating the
identity and mappings, it automatically connected to the PI
Data Archive with those permissions.
If you are instead changing existing permissions on
your system, you should restart the PI Buffer
Subsystem before restarting the PI Interface
to make sure it picks up the new security settings.
You can see here that the interface is
not running. Let's go ahead and start it now.
We'll go ahead and open ICU.
And we'll open the message logs so
I can see if the tag gets picked up correctly.
Now I have already configured
all of my location codes
and we are just configuring the security here.
So I'll go ahead and start the interface.
And we can see here that the total number of points that it
found with Point Source
OPC and of those, one of them is
loaded. So that's probably the
one that we configured the security
for. So the interface can see that point. Let's go ahead and head back
over to our PI Server node and check
under data, current values and you can see here
that it is picking up a current
value. Now we need to change the security for all of the other tags.
And we wouldn't want to do this by hand in
System Management Tools. Instead we'll use a tool called PI
Builder which is in Excel.
So let me open
Excel land open a new sheet and I'll go ahead and click on
PI Builder and I'll search for all of the tags that have Point Source
OPC and bring those in.
The main thing I need here is the
security settings. So I'll bring in data security
and point security.
You can see here that this
first one, pump1.bearingTemperature
includes our
write access for data security and read
access for PI Interfaces. So go ahead and select those
and double click here. And now
it's going to be propagated to all of the different
tags. If I go ahead and publish that,
it'll send those changes back to the PI Server and I'll do
edit only to make sure if there are any mistakes, it doesn't accidentally
create any new
tags. Let's go back to System Management
Tools and I'll check in Point
Builder one other tag. We'll check the flow
rate tag. And sure enough, the security now
includes PI Interfaces with read access under Point
Security and PI Buffers has write
access under Data Security. Let's go ahead and
check our current values for all of
our tags coming from Point Source OPC.
You can see here that some of the tags started updating
but others still say point created. It can take
up to two minutes for the interface to start picking up
changes to tag configurations. But if you made a lot of changes,
it can take even longer for all of them to
update. We can go ahead and restart the interface
but in some cases you wouldn't want to do that because it could create data
loss. Instead here, let me wait a few minutes
for the rest of the tag configurations to be
picked up and the data to start
updating. As you can see here, our
tags are now updating with current information. It
just took a few minutes for the interface to pick up those changes.
Again, if you had a lot of tag
configuration changes, it may be better to restart the interface because it
can take a while for the interface to pick all of them
up. One more thing we should do is head back to the interface node
and check the health of the Buffer Subsystem.
If we go back to ICU, Tools,
Buffering, we want to make sure that we have our
events sending through the buffer. In this case we do have total
events sent and we have a green check
next to our server. So we know that our buffer is
healthy and sending events. I've successfully
configured the minimum permissions for my PI Interface
and PI Buffer Subsystem to write data to these
PI points while using the recommended PI API for
Windows Integrated Security. Keep in mind that if you did not
install PI API for Windows Integrated Security on the interface
node, you would need to instead
use a PI Trust for the interface. Please see the description
below for further information on configuring a
trust.