Phase 1: Prepare to install PI Integrator for Esri ArcGIS

Proper configuration is required when installing PI Integrator for Esri ArcGIS. Ensure you have all of the system requirements in place before installing. See System requirements.

PI Integrator for Esri ArcGIS stores configuration data in SQL. For Microsoft SQL Server, if you intend to use Windows authentication for the PI Integrator for Esri ArcGIS connection, note the following:

• The Windows user account that will be used to install PI Integrator for Esri ArcGIS must be added as an SQL Server login, and mapped to the following server roles:

  • dbcreator

  • securityadmin

• This login mapping is required only during installation. After installation, the installing user's SQL login may be removed or un-mapped as desired.

• The installation software grants db_owner access rights to the service account that is specified during installation. Permissions on the account are confined to the internal PI Integrator for Esri ArcGIS database. The account must remain in place for PI Integrator for Esri ArcGIS to function properly.

If you intend to use legacy SQL Server Authentication for PI Integrator for Esri ArcGIS connection, note the following:

• The SQL login that was specified during installation will also be used by PI Integrator for Esri ArcGIS.

• During installation, the SQL login must be mapped to the following server roles:

  • dbcreator

  • securityadmin

• The dbcreator and securityadmin login mapping is required only during installation. After installation, the mapping can be removed.

• The SQL login will become the owner of the newly-created database, and PI Integrator for Esri ArcGIS will use the SQL login to access its database.

Security considerations

User access to AF attributes and underlying PI points through the Integrator is determined solely by the PI permissions of the service account running the Integrator. In other words, no end user identities are propagated by the Integrator to the PI Data Archive or AF; all Integrator users have the same access to PI data through the Integrator.

The PI Integrator for Esri ArcGIS service's connection to the PI Data Archive requires read access to the PIPOINT database and read and read data permissions to the individual PI points that will supply attribute data to the Integrator. A PI mapping is more secure than a PI trust and thus is the preferred method. If the PIWorld PI identity is enabled, then the Integrator service account can be mapped to a low-privileged PI user (such as pidemo) in order to receive the PIWorld identity's privileges. Otherwise a custom PI identity can be created with these privileges and mapped to the Integrator service account.

For the connection to AF, the Integrator requires read and read data AF permissions at the AF server level and each database (and all levels beneath the database level) from which it will receive attribute data. By default the Windows group 'Everyone' is mapped to the AF World identity that will satisfy this requirement. If this identity has been modified or disabled, however, a custom AF identity can be created and explicitly granted these permissions.

For PI permissions in AVEVA PI Vision displays, the end user's PI permissions are determined solely by AVEVA PI Vision security. PI Integrator for Esri ArcGIS allows you to link features on your map to a AVEVA PI Vision server. Users must have permissions on the AVEVA PI Vision server to use these links.