Modify the web​.config file

Note: You can skip this section if you are using either on-premises SQL server or Amazon RDS for SQL Server and Windows Integrated Security for AVEVA PI Vision web services to connect to the AVEVA PI Vision SQL database.

The AVEVA PI Vision web services use the ADO.NET connection string in the web.config file to determine how to connect to and authenticate with the AVEVA PI Vision SQL database. This topic provides instructions and examples to edit the AVEVA PI Vision connection string for the following reasons:

• To specify SQL server authentication

• To specify an Azure SQL Server and the authentication method used to connect to it (e.g., SQL Server or Microsoft Entra authentication)

For all examples, open the web.config file in the AVEVA PI Vision root installation folder in any text editor. Locate the connectionStrings section. The default connection string entry looks like the following:

<connectionStrings>
<add name="PIVisionConnectionString" connectionString="Data Source={SQLServer>\<SQLInstance>};Initial Catalog={SQLDBName};Integrated Security=True;Application Name=&quot;PI Visualization Web Service&quot;" />
</connectionStrings>

Specify SQL authentication for any SQL server

Note: This method is not recommended as the password will need to be stored in the web.config file. If you use this method, limit the Windows security settings on the web.config file only to users who need access including the Windows account used by the PI Vision application web services.

1. If you are using Azure SQL Database or Amazon RDS for SQL Server, replace the Data Source value with the name of your Azure SQL Database (e.g. my-azure-sql.database.windows.net) or Amazon RDS for SQL Server (e.g. mysqlserver.abcdefg1ij2k.us-east-1.rds.amazonaws.com) endpoint.

2. Add an entry User ID with the value of the SQL user you would like PI Vision application web services to use to connect to the Azure SQL database (e.g., MySQLUser).

   User ID=MySQLUser;

3. Add an entry Password with the value of the password corresponding to the SQL user you would like PI Vision application web services to use to connect to the Azure SQL database (e.g., Password123!):

   Password=Password123!;

4. Remove the "Integrated Security=True;" entry.

5. Verify the connection string; it should look like the following:

   <add name="PIVisionConnectionString" connectionString="Data Source=my-azure-sql.database.windows.net;Initial Catalog=PIVision;User ID=MySQLUser;Password=Password123!;Application Name=&quot;PI Visualization Web Service&quot;" />

   AVEVA recommends that you apply a certificate from a trusted certificate authority to your Microsoft SQL Server. Refer to the Microsoft SQL Server document Certificate requirements for more information. Reducing the security of the selected encryption options may result in a successful connection, however you must evaluate if that security level is adequate for your organization. For example, if the connection errors when "Trust Server Certificate" is not specified in the connection string or set to false, adding “Trust Server Certificate=True” to the connection string like the example below may result in a successful connection but is less secure:

   <add name="PIVisionConnectionString" connectionString="Data Source=my-azure-sql.database.windows.net;Initial Catalog=PIVision;User ID=MySQLUser;Password=Password123!;Trust Server Certificate=True;Application Name=&quot;PI Visualization Web Service&quot;" />

6. Save and close the web.config file.

Specify another authentication method for Azure SQL database

7. Replace the Data Source value with the name of your Azure SQL server (e.g. my-azure-sql.database.windows.net):

   Data Source=my-azure-sql.database.windows.net;

8. Replace the Initial Catalog value with the name of your Azure SQL database (e.g., PIVision):

   Initial Catalog=PIVision;

9. Remove the "Integrated Security=True;" entry.

10. Configure the preferred authentication method.

Microsoft Entra System Assigned Managed Identity

1. Add an entry for Authentication:

   Authentication=Active Directory Managed Identity;

2. The connection string should look like the following:

   <add name="PIVisionConnectionString" connectionString="Data Source=my-azure-sql.database.windows.net;Initial Catalog=PIVision;Authentication=Active Directory Managed Identity;Application Name=&quot;PI Visualization Web Service&quot;" />
   

Microsoft Entra User Assigned Managed Identity

1. Add an entry for Authentication:

   Authentication=Active Directory Managed Identity;

2. Add an entry for User ID, which is the client ID of the managed identity (e.g., 65935a7f-8ad3-4261-8fae-cecae613c87e):

   User ID=65935a7f-8ad3-4261-8fae-cecae613c87e;

3. The connection string should look like the following:

   <add name="PIVisionConnectionString" connectionString="Data Source=my-azure-sql.database.windows.net;Initial Catalog=PIVision;User ID=65935a7f-8ad3-4261-8fae-cecae613c87e;Authentication=Active Directory Managed Identity;Application Name=&quot;PI Visualization Web Service&quot;" />

Microsoft Entra Default authentication

1. Add an entry for Authentication:

   Authentication=Active Directory Default;

2. The connection string should look like the following:

   <add name="PIVisionConnectionString" connectionString="Data Source=my-azure-sql.database.windows.net;Initial Catalog=PIVision;Authentication=Active Directory Default;Application Name=&quot;PI Visualization Web Service&quot;" />

Microsoft Entra password authentication

Note: This method is not recommended as the password will need to be stored in the web.config file. If you use this method, limit the Windows security settings on the web.config file only to users who need access including the Windows account used by the PI Vision application web services.

1. Add an entry for Authentication:

   Authentication=Active Directory Password;

2. Add an entry User ID with the value of the Microsoft Entra user you would like PI Vision application web services to use to connect to the Azure SQL database (e.g. MyEntraUser).

   User ID=MyEntraUser;

3. Add an entry "Password" with the value of the password corresponding to the Microsoft Entra user you would like PI Vision application web services to use to connect to the Azure SQL database (e.g. Password123!):

   Password=Password123!;

4. The connection string should look like the following:

   <add name="PIVisionConnectionString" connectionString="Data Source=my-azure-sql.database.windows.net;Initial Catalog=PIVision;User ID=MyEntraUser;Password=Password123!;Authentication=Active Directory Password;Application Name=&quot;PI Visualization Web Service&quot;" />