Before I can create or manage a tour
I first must set my security scheme.
The first thing I'll see is a prompt for
a user and password. PI Manual Logger, when it's first
installed, comes with one default user that is names
"PI ML" and the password
is "PI ML" as well.
Manual Logger has it's own users and
groups that are apart from the regular PI
security. The best way to think of this is these users and groups
determine who can manage the tours and also
collect data on the tours while PI
security can determine who can do actual
PI data entry or who has the rights to write to
PI data tags. So first I will bring in
the manage users and groups display.
Once the user management display comes up
we see there is an existing group--PI ML Admins--
and user--PI ML.
PI ML is what we initially used to log into
PI Manual Logger. As we see from the description
this is the admin user
and this is the administrators group. This
user and then any member of this group can
perform any task in PI Manual Logger.
This includes security, creating users and
groups, setting global options, building
tours, setting the databases that it's
linked to etc. These are the super
user in the super user group of PI ML]
I'd like to supplement this
existing security scheme. I'm going to start with something
simple. First I'm going to create a group--I'll use
the "new" button.
This group is going to be for
data entry so I will name it accordingly.
Then I'll create a user as
well. Again I'll use the "new"
button...
And
then I'll enter a password.
Now I'm going to make this user a member of this
group. I can do that one of two ways;
I can either go to the properties of this user or the properties of the
group. I'll got to the properties of the
group and I'll see "user membership" and
I can do an add here. I have a choice of all the users that
exist. The reason I'm
doing this is all permissions on tours are set based on
groups. So when I go to build my tour
I'm going to set the data entry group to "data entry
only". I'd like to have a little more granularity
in my security scheme. I'd like to have a group
and a set of users that can modify tours
and approve data yet not have all of the rights
of PI ML Admins. So I'm going to add a new
group and new user; I'll do this through that same
process first clicking on the
"new" button,
do the same
for the user,
and enter a
password and now
I'll make this user a member of that group.
I'm going to go to his
settings, group membership and I can add him to that
group. Note that he can be a member of multiple
groups. I'm going to add him to "data entry only" as
well.
I'm going to say "okay" here.
Also we've created a
very simple case here where I have one user per group.
Obviously we can have multiple users per group.
The way we're going to use this security scheme is
the data entry only group will be the group of
users that can do data entry on tours.
PI ML Supervisors; this will
be the group that can create, modify tours and approve
data sent to PI.
PI ML Admins we'll leave that as
default access meaning that it has any privilege within PI
ML Admins. I can come back to the
user management display at any time,
add or remove groups or users, set passwords,
etc. One thing to note
also; the PI ML Admins group gets it's super rights fro m
a setting. If I come to "tools", "global
options", look under security
settings here is where I define what the Admin user group
is and by default it's PI ML Admins. I'm going to
leave this for now. Now that
I've finished my Manual Logger security
I'm going to want to go over to PI and set my
PI security. Remember, PI Manual Logger security
works in tandem with PI
To configure PI security I'm going to use the
PI System management tools. So I go to the PI System
menu group; PI System Management Tools.
What I will be doing here is setting
security that says that my PI ML users can write to
PI ML tags. So this is much the same exercise
I'd do for any type of data entry for tags such as
for interfaces. First I'm going to the
security plug-in and then to "identities,
users and groups".
I''m going to create a new identity that's expressly intended for
PI ML data entry.
Now what I'd like to do is
tie this to a Windows AD principal so I'm going to use
a mapping. This is the best practice versus using
a trust. So I'll click on "mappings"
So now I'll create a mapping to the newly created
identity. What I'm going to do is create this
mapping--I'm going to search for a Windows
user or group. In this case I have a Windows
group created for my
PI Manual Logger users.
This is a local group but it could
be a domain group as well. So I see here I've got PI ML
users...
and now I'm linking that to that identity that I just created.
So any user that belongs to this group will
be authenticated into PI as this PI
identity.
Now that I've created my mappings I need
to address PI tag security.
I'm going to come over to
"points", "point builder"; I have
some previously created PI ML tags. I've prefixed
these all with PI ML to make them easy to find.
I'll select one as an example.
I'll come over to the security
tab and I see that I have the default
point in data security. What I need to do is add
my identity for both point security
and data security. PI ML users
need read access on point
security and read-write on data security so that they can
write to the tags. So I'll do an
add here, pick my
identity and I'll set him to
just read. I'll come over to
data security and add him
again and ensure that he
has read-write and I'll save my tag.
This completes my security configuration.
Let's review what I've done. On the Manual Logger
side I've created a group and a user designated for data
entry. Within PI I've
created an identity for the same purpose.
That identity is mapped to a Windows
group. That Windows group would contain my Windows
users that would be my manual data entry
users within Manual Logger.
Finally I set my tag security.
I used that identity, added it to the
tag, gave it read permissions on the
point and read-write permissions on the
data.