Now before I get into this topic of the
API and the SDK Protocols that are used by our,
on our Applications, I want to try to put it into
perspective. Why are we talking about this? 'Cause we are going to spend a lot of time on this.
Well, it's all in service of
making it easier to configure Trusts.
So, what's a trust and who, who needs to worry about that?
Well, for that, let's kind of get the big picture here.
So, if this is your manufacturing control network with
all kinds of mission-critical, you
know, servers hanging off of it --one of them, of course,
is going to be PI. And that's going to be connected to
your regular network, just your general LAN,
and that's where individual users are going to be sitting there
with their PC's looking at Applications
like I do not know -- how about DataLink? And, then, maybe over here
you have got other clients that are running other machines,
other applications, like ProcessBook, for example. Anyway,
so this is our, this is our situation.
And, with a situation like this,
we have unattended applications that need to
connect as well as these attended applications.
Now these attended applications are those
things that have users associated with them. They are
attended. Somebody logs in as a Windows
user and it's using the Windows Integrated Security,
you know, this nice Windows Integrated Security that
goes from the login here all the way through to PI
so that we know exactly what Windows user you are
and will connect to you using those credentials. That's the
way most connecting clients will connect. But, then,
we have these unattended applications. Let me picture
another server here. This would be
things like that OPC Interface. This would be
an Interface Node running, in this case, let's
say this is running the OPC Interface. Now that's
an unattended application. It does not matter what time
of day. If you have to restart the computer, you want that
to start up. It's an auto-start service, and
so we do not typically use Windows Integrated
Security for this machine.
Now the OPC Interface may not be the only thing
running on there that is, is a known attended
application. Do you remember there was a layer of software that we
called the Buffering Layer? Buffering
is something that will also start up automatically on that machine
and it's also going to need to -- you know,both of them are going to need
some mechanism to connect to this PI Server.
So, how will we do that? Well,
we are going to do that through a mechanism called
Trusts. Okay. And that's the topic of
today. Today is all about Trusts,
and in order to
explain Trusts, to begin with, we need to understand
the difference between applications
that are based on our newer Protocol called the SDK,
and our older Protocol called the API,
'cause they have different connection
credentials that they send to different servers, and
we make use of those different credentials. Okay,
now, it's very fair to say that almost all of the
interfaces that are attended, that have some kind of a
screen, like this. This is DataLink. This has got, you know, nice
little table. This is ProcessBook. It's got trends.
Those are attended applications. Almost all of them
use the newer of the two Protocols.
That new Protocol, or the newer Protocol is known
as the SDK. So,
I will just mark here SDK.
The SDK is what each of these are going to connect
with. Now the SDK
knows all about Windows Integrated Security, and it's
through Windows Integrated Security that the SDK-based
applications are going to go ahead and connect to this PI Server.
Now, the other applications, the
unattended applications, typically
those are not based on the SDK, typically
these unattended applications are built around our older
Protocol, and that's known as the API.
API stands for the Application Programming Interface.
Actually, some of these Interfaces
are using both the API and the SDK,
and if I remember correctly, the SDK --
or the OPC Interface is one of those. It actually
makes use of both the API and the SDK.
Now, how do you know which your Interface
is using? Well, you will find it in the Interface Manual
in general. And, there's also some troubleshooting that I can show you
within the Message Logs that we can use for that as well.
Now, there's an exception to the rule. I said
most of these unattended applications are going to
be used using this API or the API along
with the SDK. There's one unattended application
that uses the SDK, and that's this Buffering
Sub-system. Now, there is
an older version of this Buff...or the Buffering Sub-system
that is API-based, but we are not talking about that
in this instance. Let's, let's discuss the newer one,
the Buffering Sub-system, that SDK
is what that Buffering Sub-system is based on.
Now I mention all of this because when we talk
about Trusts we are only talking about these
applications over here, these unattended applications.
It's these unattended applications that
are going to be connecting using something other than
the Windows Integrated Security. Now if only
our unattended applications are going to require Trusts,
I mean, what's the big deal? Why did I go on and on and on about
these Trusts? Well, it's because those Trusts,
when you configure them, they can be
complicated because, if it's an
API-based application, the Trust is configured one
way, and if it's an SDK-based application,
then the Trust is configured a different way. And it all
has to do with the connection credentials that are derived,
by the Server, from the connecting client. See, these
are the things that are derived from the connecting client if it's
API-based. We are going to derive the IP Address,
we are also going to derive the first four letters
of the application name of that connecting
client followed by the letter E. Application
name is, well, that's deceptive. It's
not the executable name, it's not the file name, and it's
not the process name. Application name
is actually the name that the
developer decides to give
to that application, by default. Or, the
application name could be what you decide to
configure in Interface Configuration Utility.
In fact, that's what I would recommend you do.
You can stop worrying about,
you know, what this application name might have been named
back when we first created the Interface. You can stop worrying about
all of that if you just go into the
Interface Configuration Utility for that interface,
like I have done here for the OPC Interface.
And I just go here and I specify an application
name of my own choosing.
There are some restrictions to that. It depends on what versions of
of, you know, the Interface, what versions of the API you are
using, etc. But, in general, that's, you know,
that's what we would recommend if you are having difficulty figuring
out what that application name is.
Now, I should point out at this point, that if you do not want
to rename the application name, you do
have another choice. And, the other choice is to just go
into the System Manager Message Log
and try to find exactly what that application
is connecting as. That's something we did in an earlier
video. If I simply go into System Management Tools here.
This is on my Interface Node. Remember, I,
I installed SMT on this Node so that I could do this.
If I go into Messages,
here's our Message Logs here. And I am going to search
for let's just say, for the last five hours.
I will search for anything that had the word -- let's go with
eight hours -- anything that had the word OPC in it.
So what I am doing is I am searching
for any messages from when
the OPC Interface tried to connect, and
yes, as, as you can see right here, this is, these are the
connection credentials that are being passed by the OPC
Interface by default. So, since, I did not
take it on myself to rename this application
name, that's by default what the OPC Interface
connects as. There's OPCp with a capital
letter E. Okay, so far, so good.
I, I said you could either just use the application name
that you find here, in the Message Log, or
you could specify the application name yourself.
Unfortunately, when you, when you go to do that,
you will notice this is where it gets a little complicated.
If you look at the balloon help that appears, there's
notice here that it, it looks like, depending on the version of the API,
you can actually use a different number of characters.
What I am talking about here is something that's
well documented in the -- if you go into the,
the online help for Interface Configuration Utility.
Now I found this by just searching for the
word "application name." Now, what this is telling
us is that if you have got API Version
1.6 or greater, then there's a file
PIClient at I & I that can be modified with this
argument right here, those two things. If you modify
that, then you have the option
of setting this up to
eight characters. So, instead of using just that
four plus the E, it's simply going to be eight characters,
whatever eight characters you put in here. So,
that's, you know, that's everything I
wanted to tell you about this application name.
And, again, now that we know about the application
name and how we are going to determine what that is,
or how we can even set it if we want -- you know, of course, the grand
finale to this is to make use of this
in this -- when you create a Trust, to allow the Interface
to write. Now, remember, this is only for unattended applications
for Interfaces. Now, let's return to our lecture notes. here.
And, we had mentioned that the API
based connections use
this application name: the first four characters,
etc., and then we went into great detail. Now, what if
you are trying to let an unattended, unattended
application that is SDK-based, what if
you are trying to allow that to connect using a Trust?
Well, that sends a slightly different set of
connection credentials -- IP Address, of course --
but we also send now, instead of the application name,
we just simply send the file name
of the application. So that's considerably easier,
and if you are not sure what the file name is, most
of the Interfaces we explain what the file
name is. I am, I am looking at the OPC Interface here.
It's telling me, for the Buffering Sub-system, it's
PIBufss.
If you look in the buffering documentation itself,
we mention PIBufss.exe. Yeah, so, if you are
not sure yourself what the actual executable is
for buffering or whatever application that's unattended
that is SDK-based, just take a look in the Documentation.
See if you can find it in there. Now, finally, the SDK-based
applications will pass Windows
User Information, the domain and the Windows
User that you are currently logged in as. And that's actually how our
Windows Integrated Security works for our SDK-based applications.
So, as we go through our
discussion on Trusts, and that, that's what comes next. If you look at
wheres, where we are next, we are going to be discussing Trusts in great
detail right now. Just keep in mind, that when it is
time to specify this application name
when you are creating the Trust, you have some tools to
either set the application name yourself, or to go ahead
and find out what it is by looking in the Message Logs.