Hello and welcome back to the
PI WebParts 2013 SP1 installation video series.
In the previous video we
configured and did all the post installation
steps for PI WebParts. And in this video
we'll be setting up PI Security for
PI WebParts. For the PI Server, I will show it using
both PI mappings and PI
trusts. And the recommendation is to use PI mappings.
And I'll also show it for AF Security which has to use the
Active Directory credentials. So in order to setup
PI Security, I'm going to have to bring up PI
System Management Tools. I don't have this on my
PI WebParts services machine so I'm going to jump over to my
PI Server. This is my PI Server and I'm going to bring up
PI System Management Tools.
Now I'm going
to start with
PI mapping. So in order
to create a PI mapping, you have to
first create an identity that the mapping is going to use.
This identity is what grants the
user the correct
credentials. So the account is going to be
mapped to this identity and then the identity
is going to be giving the credentials needed.
In order to create the identity under the security tab in System Management
Tools, you'll see identities, users and groups.
Select that. And you'll have to run it as
administrator. So if you didn't do that initially, you'll
have to restart under different credentials. And I'll just run it as administrator for you.
And on the PI identities tab, you can add an identity.
I've already created one for the PI WebParts
service account. So the credentials
the service account is going to need is read access to the PI point database,
and read access to all of the PI points,
both the data and the point security.
So that's why we are going to have to give this
identity permissions
too. If you do not already create the identity,
you can right click in the white space, new identity. And then just type in a name.
Once you've typed in a name,
you can just do create. Again, I've already created
my identity.
So I'm going to use this PI WebParts
services account. So now that I have the
identity, I know
the permissions that the service account needs. I need to actually give this
identity those permissions.
The first one mention is it has to have
permissions to the PI point database.
In order to give it those permissions, you go to the
database security underneath security and you'll find PI
point. If you double click it, you can
edit the permissions. You'll see that I already have
the PI WebParts Services account there, but if you do
not, select add. Find the identity that you
created for your services account. In my
case, it's PI WebParts Service account. Select add and
click OK. And then with that highlighted,
you want to make sure that it has read
permissions, it does not need write. And once you have that correct,
you can select OK. And you can
see in this long string, you have PI WebParts
Services and it has read access.
So the next as I mentioned, the
services account needs read access to all of the PI
points data and point security. In order to do
that, you go to points,
point builder. And just
search for any of your tags or your
points. I'm going to search
for Sinusoid.
And once you have that point selected, go to the
security tab and you'll see point security and data
security. The PI Service account that is running the
service account that is running PI WebParts
Services, will need read access to both of these.
In order to do that, you select
add and find your PI WebParts Services account
identity. So I'd add, press OK. And then
it will be added. And then when you select it,
you want to make sure to deselect
write so that it just has read access. And do the
same for data security. I've already done the
same. I've already done it here on data security,
but if you have not,
select add. Find your identity,
select add and then again just make sure that it only has read
access. Once you set that up, you
can just save it. You are going to need to do that
for every single one of your
tags. Doing that in PI System Management
Tools will take a very long time. I do not recommend it.
So in order to speed it up, you can use what's
called PI Tag Configurator which is an add-in to Excel.
For more information on
that, you can see our PI
Server Administration Guide. And you can also view some videos in the
PI Server Administration playlists on YouTube
which will help you change the
tag settings using PI Tag Configurator. I'm not going to go through that
in this video, I've already done so. So
all of my tags now have given
read access to this
identity. Now that we've given the correct permissions
to the identity we are going to use, we actually have to
map the service account running PI WebParts
Services application pool to this identity.
In order to do that, you go to
security, mappings and trusts. And under the
mappings tab, you'll see that I have nothing. So right now if that
service account tries to connect, it won't be granted any
permissions and it won't be able to connect.
So to change that, I have to create a new mapping.
Either click this button here at the top or
right click in the white space under new mapping.
And I'll have to find the Windows account.
So I click these three dots
and I know it's SVC-PIWebParts.
Oh sorry, PIWebClientsSV
I'll check the names.
TSPIWebClients is the
account that I had. You'll see when I
do check names after putting it in correctly, it shows up.
So I click OK. Now I have
to map this to that identity I've granted permissions to.
So if I do these three dots, it will show up all of the
identities and I'll find the PI WebParts service account and select OK.
So now when this service account tries to
connect which is the one running my PI WebParts services application
pool, it will be granted the identity PI WebParts
service account.
And that WebParts service account since I just
configured it, it has read access to the PI point database and
read access to the point and data security for all of the PI points.
Now that you've granted
the correct permissions to your service
account, you will also want to grant permissions to all of the users
that are going to use PI WebParts.
So if you setup Kerberos correctly, the service account can
connect right now. But the actual user will not be able to see
anything. To do that,
it's the same things as
the service account. So again, you want to create an
identity first. I've already created one called PI WebParts
user. That user needs read access
to the PI point database which you
can see if I double click, I've already given it that access.
And it will also need read
access to all the points that this user is allowed to
see. So not every user might be able to see
every point for different security reasons.
So you can actually give
certain permissions to certain accounts.
For this PI WebParts user,
you will see that it has
read access to Sinusoid
and CBT 158.
But it does not have access to a different
tag called balevel.1. So you'll see
that there is no PI WebParts user here.
With my current configuration,
any user
that uses the PI WebParts user identity,
will only have access to Sinusoid and CDT158.
Now I'm going to want to map
all the users that get these permissions to that identity.
So again, it goes to mappings and trust.
And do a new mapping.
And I'm going to use my user.
And I'm going to give myself
the PI WebParts user permission.
So the service account has read access to all
of your PI points in the PI point database.
But your user only needs read
access to the PI point database and read
access to the PI points that it's allowed to
see which is not necessarily all of them.
So I've now setup
my PI security for PI
WebParts using
PI mappings.
I will test out to make sure
these work in our next video. But for now I'm
also going to show you how to create a PI
trust to allow this in. Again, we recommend PI mappings.
And if you've setup Kerberos,
use PI mappings. But if you are unable to
setup Kerberos, then you can use a PI trust.
A disadvantage of a PI trust
is every user will have access to all of the points
that you allow this
trust to. So if you do want certain users to only have
access to certain points, then you will not want to use
a PI trust because then everyone will have the exact same access.
With PI mappings and Kerberos, depending on your
mappings, you can give different users, different access to different points.
But if you do want to create a
trust, to create a trust you can
right click and do new trust. Or just do this
down arrow and advanced. When you select
advanced, you'll see this window.
So I'll call this PI WebParts.
You can name it whatever you'd like.
I'm just going to use the network path which is
Sterling. But if you want to use
the IP address, you can use that. But
if you use the IP address, just make sure the
netmask is 255
all the way across. If you do
different numbers here, you are going to be granting more access than you'd like.
Since I am using the network path, I do not
want IP address or netmask.
For the application name,
it's called W3WP.exe
This is what SharePoint will
connect as with this application.
And then for PI identity, I'm actually just going to use
the PI WebParts service account because this one has read access
to all of my points.
And just select OK and you'll see it added here.
Now that we've configured both
mappings and trusts for PI security,
we can go ahead and setup AF security.
We do that using PI System Explorer.
And you can open that up to
your AF Server.
Now the permissions of the service account running the PI WebParts
services application pool will need read access
to the server. Read access to the database
collection. Read access to all of the databases
that you will like to see
in PI WebParts. And read access to all of the elements that you'd like
to see in PI WebParts. So I'll show you
how to do that. To change the server and the
database's collection, you go to
database and then you click the three dots next to your AF server.
Right click your AF security and you'll see
security and server is the first one you want to change.
So right now everyone has read access,
so that's fine. But if you don't have everyone,
then you are going to need to add your service account.
While you are here,
you can also add all of the users that you
want to be able to see data from this
server because the users
that are connecting to PI WebParts will need read access to the server,
read access to the database's collection. Read access
to any database that that specific user is allowed to see.
And read access to all of the elements that specific
user is allowed to view. So I go ahead and
add my user here as well.
And they only need
read access.
So we'll take away all of the access
that it does not need.
To add read access to the database's collection,
you right click your AF server, go to security. You'll
see databases. And then databases again.
And again you add them the same way.
And you want to add
read data as well.
And again, I'm going to add my user as well. You can add
groups here instead of just
users in order to make it a little bit quicker to
configure and easier to maintain.
You are also going to want to add
the service account and the user to the database
that you want it to be able to view. To do
that, you click on your specific database and you'll see
security and database. And again,
we'll just do the add.
Give it just read
access
and allow the user as well.
And finally, you need read access to all of the elements that you'd want to be able to
see. Again, the service account and the users. So once you are
in your database, you just right click one of the
elements and then select security. And just like
before, we add them again.
I forgot to add my
user.
Now this only changes
the permissions for the one element that we are on.
If you want to change the permissions for all
it's child's as well, you click advanced and you'll
see replace all child object permissions with inheritable
permissions from this object. So I'll select that.
If I click OK, it will give me a warning saying
it's going to do that. And I just select yes. Now
all of the child elements have this same
access. Be warned it does replace whatever
security was there before.
And with that,
now in PI WebParts, we would be
able to see equipment maintenance. But I have
everyone as having read access to everything. So they'll be able to see everything.
If you ever need to be
reminded of what permissions to give the service
account and users to your AF and PI
Servers, it is in your
PI WebParts Administrative Guide.
It will tell you exactly where you need to give everything read access.
So if you ever forget, go ahead and take a look there.
But now we've setup security
and in the next video, we will take a look and test our
WebParts to make sure everything is working properly.
And as I mentioned before, I will test using both the
PI mappings which is recommended, as well as the PI trust.