Section 7.5 Database Security.
There's a table that's
accessible within the Security Tab called
Database Security. This is where there're objects
that are, well, larger than the objects we have dealt with before -- the
entire database for certain classes of
objects. Well, for example, the PIPOINT
Database is the entire collection
of all the Points on the PI System. We have dealt so far with
individual Points. Well, this is the
construct that represents all the Points together.
Just like, similarly, when we look at PIUSER,
that reflects all the PI Users or
it represents all the Users in the System. Now, just like
individual Points, the PIPOINT Database itself
has an Owner. It has a Group that's associated with
that, that
Database, and then, there's certain permissions. As you can
see here, the only permission, or the only,
the only entity that was permission
to create things in the PIPOINT Database
is the Owner. Right now he has read-right access. The Owner
is PIADMIN. Again, there is a Group
called PIAdmin, but, actually, in fact, that Group has no more
permissions than the rest of the world. It only has read access.
So, let's see how this happens, or let's
see what this means for one of the Users
we created in an earlier exercise.
So let's take a look at this, this environment here.
Now, right now, I am actually connected to a different
server than we have look at before. This is my Client
Computer, the computer that I am working on.
But this is the PI Server. In fact, it's actually
a virtual machine, but it's a PI Server that's --
in all senses of the word. So, it's a
separate computer, and
I need to, remotely, get access to it. So
I have Users on that computer like
Sid and Sam, those Users we created
earlier. As you can see, Sid --
well, he has no special permissions. He belongs to the same Group
that we set up in the previous exercise. But, as I mentioned,
since he is not PIADMIN, since he does not
own this, he should not be able to create PI Tags. And, in fact, you
can prove this if you go into the PointBuilder
and create a brand new tag. Let's call this myTest4,
for example. When I try to
Save, if I am currently logged in as the User
called Sid, it's going to fail. So, let me demonstrate.
I will go into File, Connections.
I am currently logged in as PIAdmin, who is a privileged User.
But I will just do a right-click and choose
Connect As, and I am going to Connect As
my User called Sid.
If I Refresh this,
you can see I am now logged in as Sid. Now watch what happens when I
try to save this or look at the Message
Box down at the bottom. Yeah, if you take a look
at the bottom here, you can see
we get the famous Negative 1041 Error, No
Write Access. So, basically,
even though this User, Sid, he was a privileged
User who does have edit permission for certain tags,
he cannot, in fact, create new tags. And the reason for that is
because he does not have the write permissions
in PIPOINT. So,
there's certain things about the Database Security
Table that we will discuss in more detail later.
But, basically, the importance of the Database
Tables is it allows administrators to
grant specific Groups to have access to certain tables.
It's through the
Database Table that we would give people access to create tags,
create Digital State Users, Modules, etc.
So, let's start by demonstrating what we would do for the
User, Sid. I am going to switch over to the
System Management Tools, and I think the way
I would like to do this is, first, I would like to build a brand
new Group, and which we will, we will just call this Group
myPointBuilders. It's all the people who have
permission to build Points. I would rather do that
then stick with PIADMIN. I would like to stick that to just
purely Administrative Tools for that particular
Group. Anyway, so I will great this Group called myPointBuilders.
Now, an interesting thing happens and I, I think you should be aware
of it. See, I am, I am still logged in as Sid. On this current
version, see Sid does not have permission to build Groups,
and if I were to try to create this, you'd get
a pretty ugly Error Message, but you can continue
as you work with it. See, if I, if I try to create
this, I get an Unhandled Error. Obviously, that's a
mistake. We should have handled that a little more gracefully. But, in any
case, the reason that's happening, and that my happen to you back home
with this particular version, is because I am not privileged
to add that Group.
So what I would like to do -- let me go into Connections.
Let me connect as
PIADMIN who has more permissions,
permissions to create this. I will go ahead and create a new Group
Group called
my, whoop, MyPointbuilders.
[typing]
There we go. There's MyPointbuilders. Again,
did not want to scare anybody with that, just wanted to let you know that's
something in this current release -- I
wanted -- that's version 3200. You will see
that if you try to create an object that you do not -- and you do not
have permission to create -- at least in,
with regard to the Groups. Now, that's a
good example of -- sometimes, you know, the testing ...
We, we certainly do not ship something if we know it's got a bug in it
but sometimes they are slipped through, so
anyway, if that happens to you, please give us a call and we will
show the upgrade path to fix that.
In any case, what I just did is, I just built a
new Group called MyPointbuilders.
I am going to go ahead and add Sid to that Group,
or give Sid membership in the Group. So, I will go into Group Membership.
I will add his membership in MyPointbuilders.
Again,
that really does not accomplish anything. It just makes Sid a little bit
special. He now belongs to one more Group. Now the real,
the real big finish here is to go into Database
Security, go into PIPOINT,
and let us make the Group
associated with this PIPOINT Database, let's make it
MyPointbuilders. Again, still, that does not
accomplish the job. I still have to specify
read-write permission for members of the Group. So, by
setting read-write permission there,
that should allow me to build Points
with the PIPOINT Database, or with
the PI PointBuilder. So, let me now log in one more time
as Sid.
I will connect as Sid again.
[typing]
And I am not sure if I am going to have to
stop and restart to get these changes. I
think these changes take place immediately. So now, I am
logged in as Sid. Let's see if, in fact,
I will be able to create this tag. Let's call this
myTest6. I will choose Save.
And there we go. See, now
Sid was properly able to create that --
I am logged in as
Sid. And since Sid is a member of myPointBuilders --
myPointBuilders has read-write access to that Table -- I am able
to create PI Points.
Now, if you only have read access to
these PI Databases, there are actually certain privileges you do get.
For example, if you need to edit existing
Points, if you have the proper Point Access
Security, then you will be able to edit those
Points. Let me demonstrate. Do you remember our
User called Sam?
I am currently logged in as the User, Sam, and if
we -- let's just verify that. Yeah, see,
I am ver... I am logged in as the User, Sam,
and if we take a look at his permissions --
Sam, he is a member
of E&I, LAB and SUP. As members of the
Supervisors Group, if we look at this particular
tag -- this is that special secret tag
that we wanted nobody to have access except the
Supervisors -- yes, if you notice, world
has no access. The Supervisors
are both the controllers of the Data and
the Point Definition. They are the Group associated with the Point Access,
and that Group has read-write access. Well,
there's one interesting point about all this.
Sam, as a member of the Supervisors
Group, he does not,
as you can see, he is not a member of MyPointBuilders.
And he's not the Owner, PIADMIN.
So, how is it he can actually make these edits?
Because he, in fact, cannot edit this. If I change this to
110 -- let me go ahead and save this.
And so, as you can see, I was able to successfully edit that.
How can Sam edit this? Well, it's that
exception to the rule, or I should not say exception to the rule, but it's that,
that slightly non-intuitive
behavior which is that, if you have read
access to that database, as long as you have the proper
Point Access, you can, in fact edit tags. You cannot create new
tags, but you can edit existing tags
as long as, you know, all the other settings are
proper for your being a member of a Group
that has the right Point Access.
Another thing about these databases -- you will notice that
you can change the password only
of your -- of the User you are currently logged
in as. So, if you -- even if
you are PIADMIN, you will notice that
you can only change your
own password when you are, when, when logged in.
Now, with PIADMIN, you can
provide a, a change to a
password that a User has forgotten
by using that exclamation mark, but simply
put, if you are logged in as a User and you
know another User's password, you cannot change his password. You have to be
logged in as that User.