Create a PI identity mapping

When you create a mapping between a PI identity and a Windows group, Data Archive automatically authenticates all members of that Windows group as that PI identity. Ideally, you should use Windows Active Directory groups for mappings, but you can use any AD principal, local Windows group, or local Windows user.

You can also create a mapping between a PI identity and an AVEVA Identity Manager role using claims-based authentication via OpenID Connect (OIDC). See Map a role or client ID to a PI identity using OIDC for instructions.

You can create mappings between individual Windows users and PI identities, but it is not recommended. Mappings based on individual users will prevent you from managing your Data Archive security access by manipulating group memberships.

1. Under Servers, select the Data Archive server.

2. In the System Management Tools pane, select Security > Identities, Users, & Groups.

3. Select the PI Identities tab.

4. Double-click the identity that you want to map in order to open its Properties dialog box.

5. Click the Mappings & Trusts tab.

   The top portion shows all existing mappings for this PI identity. The bottom portion shows all existing PI trusts for this PI identity.

6. Click Add under the mappings to open the Add New Mapping dialog box. (There is also an Add button under the trusts; be sure to click the right button.)

   Note: The Add button is disabled if the selected PI identity is disabled or not usable in a mapping.

7. In Windows Account, enter the account you want to map to. This can be an AD principal or a local Windows group or user. To select the account either:

   • Click the browse button to browse for the account.

   • Type in the account name. If you choose to type in the account name, click the resolve SID button to verify that this is a valid account. If the account is valid, a SID appears in the field. Otherwise, a dialog box with an error message opens.

8. In Description, enter a description of the mapping, if desired. There are no restrictions on the contents of this field.

9. Click OK to create the new mapping.