Commonly encountered problems

Problems on installation

For commonly encountered problems with installation, see Troubleshoot common installation problems.

Problems after the service is installed

• Kerberos Delegation

  Problem: Requests to the service fail with the response It may be that the impersonated client user account cannot be delegated to the remote server.

  Solution: Configure Kerberos delegation to allow credentials to take a "double hop":

  • If running PI Web API using the default service account (NT SERVICE\piwebapi):

    • Ensure that the computer is trusted for delegation in Active Directory.

  • If running PI Web API as a custom account:

    • Ensure that the account is trusted for delegation in Active Directory.

    • Ensure that the account has Service Principal Names registered for HTTP/hostname and HTTP/fully.qualified.hostname

  • Ensure that the account is not marked “sensitive and cannot be delegated” in Active Directory.

• Same-Origin Policy

  Problem: Requests made within browser scripts (for example, AJAX requests) fail with a message about same-origin or cross-origin request policy.

  Solution: By default, browsers prevent scripts served from one site from making requests to other sites. To enable this behavior, enable the Cross-Origin Resource Sharing settings in the PI Web API Configuration database. For further details on setting these values, see Cross-Origin Resource Sharing.

• Changing the Service Account

  Problem: Changing the PI Web API service account after installation causes problems with the service: the service may fail to start or fail to serve requests as expected.

  Solution: Run the PI Web API Admin Utility and set the PI Web API service account.

• Firefox Kerberos Authentication

  Problem: When Kerberos is configured as the PI Web API authentication method, requests made in Firefox fail with the response Authorization has been denied for this request.

  Solution: Refer to the KB01223 - Kerberos and Internet Browsers knowledge transfer article for additional information.

• IE Compatibility Mode

  Problem: Visiting PI Web API resources in Internet Explorer returns a prompt to download raw JSON, instead of the expected HTML response with help page links. In another scenario, responses are returned but the response is not formatted (that is, returns everything in a single line) and links are not displayed as hyperlinks.

  Solution: In Internet Explorer, in Tools > Compatibility View settings clear Display intranet sites in Compatibility View.

• Administrative Operations Return Unauthorized

  Problem: Administrative operations (for example, updating service configuration) fail with the response Authorization has been denied for this request.

  Solution: Administrative operations require the user to be a member of the PI Web API Admins group on the server computer. Users added to this group must log off and on before administrator privileges take effect.

Problems with Bearer authentication

• Problem: Bearer has been configured as the authentication method PI Web API will use for authenticating users. User sends a request to the PI Web API and then receives a 401 Unauthorized status code.

  • Solution: Open Windows Event Viewer and find PIWebAPI Admin log under Application and Service logs.

    If you see either of the following warnings, check your configuration database to ensure BearerIssuer has been configured properly.

    “[Configuration]: This PI Web API server has been misconfigured: The 'BearerIssuer' setting is not configured. Bearer authentication has been disabled. After updating your configuration, restart PI Web API for changes to take effect.”

    or

    “[Host]: Error using access token One or more errors occurred.”

    BearerIssuer should be set to URI of the AVEVA Identity Manager (AIM) Server. After ensuring BearerIssuer is configured properly, restart PI Web API for changes to take effect.

    After checking your configuration database to ensure BearerIssuer has been configured properly, verify the TLS certificate used by the AVEVA Identity Manager (AIM) is trusted on the PI Web API machine..

Problems with performance issues

For a list of common performance improvements that we recommend to improve your PI Web API experience, see the Best Practices and Performance Improvements knowledge article.

If you are experiencing specific issues with your PI Web API performance, refer to AVEVA Customer Support.

Problems on uninstallation

For commonly encountered problems with uninstalling PI Web API, see the "Problems on uninstallation" section in Troubleshoot common installation problems.