Add a mapping to an identity

When you add a mapping for an identity, you need to specify the Windows account to be mapped and the name of the mapping. See Map a role to a PI AF identity if you are using OpenID Connect (OIDC) and want to map a role.

The security identifier (SID) for the account is generated automatically and cannot be changed while the mapping is being created.

1. Open the Mapping Properties window.

2. Select the Windows option.

3. In the Account field, enter one of the following object types:

   • User

   • Group

   • Built-in security principal

   • Service account

   • Computer name

     You can also click and enter search criteria in the Select User, Computer, Service Account, or Group window to select the object type, location, and name. The available search locations are the local computer hosting the connected PI AF server and Microsoft Active Directory nodes that the user can access.

     Note: You can also enter a SID directly in the Account field. When the entry is validated, a domain identifier is prepended if the account is a domain account. If the account is a local account on the AVEVA™ PI System™ host machine, the fully qualified domain name is prepended.

4. To validate your entry in the Account field, press Tab or click in another field.

   The Account SID field displays the SID of the account, and the Name field defaults to displaying the account name.

5. In the Name field, modify the default account name as needed.

   Text you enter in the Description field is displayed in the PI AF Server Properties window. Use this field to differentiate between mappings for any given identity (since in PI AF a single user can be mapped to multiple identities).

6. If an identity has not been selected already, select the identity you wish to associate with the mapping from the Identity drop-down list.

7. Click OK.