Enterprise historians > PI Server setup > Grant authorization to access Enterprise Historians

Create Windows user mapping to view remote historical data (PI Server) from DeltaV Live

Explicit logins are not supported in OSIsoft PI Server, beginning with version 3.4.380. You must create a Windows user mapping for the DeltaV user (or DeltaV group) by completing the following steps.

Note

This procedure applies to DeltaV Live workstations only. DeltaV Operate workstations use the application trust authentication method described in a separate topic.

When DeltaV and the historian are in different domains, there must be a two-way trust between the domains.

  1. Log on to the PI Server as a user with privileges to modify the PI Server settings. This can be the user account used when installing the PI Server or an account granted access to modify the PI Server. If the PI Server is in a domain, you must have domain administrator rights for at least part of this procedure.
  2. Create the users or user group as follows:
    • When DeltaV and the historian are in domains, follow these steps:
      1. Create a local domain group (for example, PIDeltaVUsers) on the PI Server's domain controller.

      2. Add either the DeltaV domain group (DeltaV) or the individual DeltaV domain user accounts to the PI local domain group (PIDeltaVUsers in our example).

        By specifying the DeltaV user group, all users in that group will have access to the historian.

        Always enter the user or group name as the fully qualified name (domain name.group or domain name.user).

    • When DeltaV is in a workgroup and the historian is in a domain, you must create the DeltaV users on the PI Server as local users with the exact same username and password as on the DeltaV system.

  3. Start the PI System Management Tools (PI SMT) by clicking All Programs → PI System → PI System Management Tools.
  4. Under the Servers pane, select the name of your OSI PI Server.
  5. In the System Management Tools pane, expand Security → Mappings and Trusts.
  6. Select the Mappings tab.
  7. Create a new mapping by clicking the New button.
  8. In the Windows Account field of the Add New Mapping dialog, specify the user account or group that you want to grant access to the OSISoft PI Historian.

    • Click the Browse button, and then select the group, for example the PI local domain group (PIDeltaVUsers in our example), or the local user accounts created on the PI Server (that match the DeltaV local accounts).

    • Type the account or group name in the Windows Account field.

      After typing the name, click the Resolve SID button to verify that it is valid. If valid, a Security Identifier (SID) appears in the field. Otherwise, an error message appears.
  9. In the PI Identity field, select the PIOperators identity.
    Note

    Other options are available, but the PI Identity is the preferred method.

    You can select other identities, but the PIOperators is the least privileged option.

    1. Click the Browse button to open the Select PI Identity, PI Group, or PI User dialog.
    2. Use the Type option to filter the choice to select PI Identity.
    3. Select the PIOperators identity.

      Do not delete or modify the PI Identities or you will affect the way the PIOperators identity functions.

    4. Click the OK button.
  10. Click the OK button to create the mapping and close the Add New Mapping dialog.
  11. Set the authentication protocol order on the PI Server.
    1. Start the PI Software Development Kit (SDK) by clicking All Programs → PI System → PI-SDK Utility.
    2. In the navigation pane of the PI-SDK Utility window, select Connections, and then click File → Connections → Options.
    3. In the Specify Authentication Procedure area, select the order as follows:
      Operator Environment Protocol order
      DeltaV Live only

      Windows Security

      PI Trust

      DeltaV Operate only

      PI Trust

      Windows Security

      Both DeltaV Live and DeltaV Operate

      PI Trust

      Windows Security

    4. Click OK to exit the dialog.
Related information