In this session we're going to talk about an important post-install task for the PI
data archive setting up a basic security model. When the PI data archive is installed
it has a trust configured to automatically log in all local connections as a super user
called PI admin. This is the very definition of a privilege escalation attack it's intended
to be temporary and be removed right after installation,
which is what we're going to do here. So we're going to make appropriate security
mappings for both our administrator which is us and the analysis service the only other
service we've installed that actively makes a connection to the data archive right now.
So first off how does security actually work in the PI data archive? So here we have a user this
is us we're using an application called system management tools, we run PI System management
tools as this user PI school student01 so the domain is PI school and the user is student01.
We initiate the connection and then the PI data archive checks its list of mappings.
So it checks its list and says okay I know you, you're PI school student zero one and
I’ve got a mapping for you to an identity. Now this identity you can think of it
as a identity card when a user connects the PI data archive hands them a card telling them what
identity they have and what they have permission to do. So we're going to set up this mapping here
to map to this identity called PI admins. Now PI admins by default has read write access to points,
read write access to security and really everything else.
We're on PISRV01 again and we're going to open PI System management tools so click start and
then click PI System management tools. Now once this opens up we're already connected to
our PISRV01 in the top left hand corner, we're going to take a look at the security plugin.
So expand that out and let's take a look at mappings and trusts.
So here we've got two tabs, mappings which abide by our modern security model and trusts
which is the older security model. We have this proxy 127 trust this is the loopback trust that
we're eventually going to remove. Don't remove it now though we're still relying on it. So in the
bottom left hand corner we see we are connected as PI school slash student01 and PI admin. We can
actually see if we're using a trust or a mapping expand out operation, network manager statistics
once that loads up we'll see everything that's connected to our PI data archive right now
and we can analyze what security model is using to connect.
So here's a bunch of smt host.exe this is the application name for system management tools
and a lot of the other internal PI data archive services.
Let's take a look at smt host.exe move this all the way to the right hand side
and we see these are connecting through a trust called proxy127 identity PI admin.
So let's go to mappings and trusts and back to the mappings tab,
we're going to add a new mapping.
Let's click on the ellipsis and search for our account. So this will be student zero one,
check names it's found it that's great and okay so this is our account
and we're going to log in with the identity
so we've got a few different kinds of identities here. We've got new age identities we've also
got some legacy groups and users we're actually going to take advantage of a legacy group here
there's really no difference between these different categories of identities except
for what models they support to log in with and we're going to disable the older models anyway.
We're going to take advantage of this PI admins PI group here, this already has all the configuration
needed for and for an administrator. So here we're going to click okay and let's create it.
So we now have our mapping.
It's mapping student01 to PI admins,
so let's go back into operation and network manager statistics and take a look.
So we're still logging in under the PI admin trust here now if we close system management tools
and we open it again. Just to force of reconnection,
we go into operation, network manage statistics
scroll all the way to the right now we're getting in without a trust from our user account
to PI admins and we also get the PI world identity as well. Every authenticated user
also gets the PI world identity so you can control security for essentially everyone if
you want. So we've just configured a mapping to the PI admins identity for our administrator.
Now let's take a look at the analysis service.
The first step here is to create an identity and give that identity write access to points.
The analysis service runs under PI school slash svc PI analytic this was
the group managed service account that we assigned to it when we installed PI AF server. So when
we connect we'll need to make a mapping to this account, so we're going to make this mapping here
and we're going to make an identity called svc PI analytic and we're going to give it
access to PI point. So when it does connect it's allowed to create calculation PI points
and once it's created it's allowed to write to these PI points. We're back on PI SRV01
now and before we go into mappings and trust and create our mapping we actually need to create the
identity this time. We're not just going to log in the analytics service as a super user that,
would be ridiculous we're going to log it in with just the permissions it needs.
We're going to go up and click on new identity,
we're going to call this identity svc dash PI analytic and we're going to give it a description.
Identity for the PI analysis service we're going to go create here
so we've essentially just created the identity card it's just got nothing written on it yet
we can come up to database security. This is where we configure top level security for
every different part of the PI data archive, the one we want here is PI point. So I’m going
to double click on this PI point and then add in the new identity that I created.
I’m going to give it read write access and okay.
So this gives the svc-PI analytic identity access to create PI points.
The next step is to go down to mappings and actually map our service account to this.
So we need to come up to create a new mapping, the account that we're mapping to is PI school
svc PI analytic dollar. Note that I’m manually typing this
because we need to do that for group managed service accounts and the dollar sign at the end
indicates that it is a group managed service account, if you're using an ordinary service
account you would click on the ellipsis here and then you would search for the account name
but seeing as though we're using a group managed service account we're typing it in manually and
then clicking on the resolve SID. It's resolved it's been found that's great we're mapping it
to an identity so these ellipses here we can select our svc PI analyt and there we go create.
We've configured our mapping now we have a few things left to do.
We'll go to trusts and we'll double click on this proxy 127 and then we're going to disable it but
before you disable it look in the bottom left hand corner and make sure that you are logging in as
PI school student01 and PI admins PI world. Make sure that you are logging in as that administrator
mapping you can also check on network managed statistics just go back in the video a little bit.
Because if you're not logging in as that and you disable the trust you'll be locked out.
Let's go okay.
So we've disabled the trust
and now the next step is to go to security settings down the bottom and check out our
security slider. So right now we have trusts enabled, we're going to disable trusts completely
so we're going to slide this security slider up
and save. So note that this requires a restart of the PI base subsystem.
The PI base soft system is one of the services in the PI data archive we're going to restart
that but really we're going to restart all services. So I’m going to use this as an
opportunity to show you how to stop all PI services and start them up again gracefully.
So start up a command prompt and navigate back to d drive
and then into percent by server percent adm and then run the command PI srv stop
dot bast. So this is a script that goes through every service one by one stopping them
so I’ll speed up the video a little bit and now I’m going to type in PI srv start dot bat.
In this video we covered how to let in administrator users and then how to let in
services like the PI analytics service and give them the permission they need to do their jobs.
Then we disabled the temporary loopback trust and removed support for legacy trusts completely from
the system by raising the security slider to the top. There's a few caveats here you should
not perform the last two steps in an already established PI System without first going through
the PI network manager statistics and making sure there's no applications connecting using trusts.
For each application connecting using a trust you'll have to find out if it supports mappings
create a mapping and then reconfigure it to use the mapping properly. You can't push the slider
to the top at all if you're using any interfaces running on non-windows operating systems,
they won't be able to connect using mappings, or if you've got any legacy third-party applications
that were developed way back when and they rely on trusts and don't support mappings at all.
So but anything written after about the year 2009 should support mappings but you never know.