4 Replies Latest reply on Dec 8, 2017 4:24 PM by andre.furtado

Cannot connect to the PI Data Archive through PI Web API

andre.furtado Dec 5, 2017 3:45 PM

Hello,

I am getting the following message when I try to get data from PI Data Archive through PI Web API:

"Timestamp": "2017-12-05T15:24:27.7826759Z",

"Value": "Cannot connect to the PI Data Archive. Trust authentication trial failed because insufficient privilege to access the PI Data Archive. Windows authentication trial failed because insufficient privilege to access the PI Data Archive. ",

"UnitsAbbreviation": "",

"Good": false,

"Questionable": false,

"Substituted": false

I've checked if there is an issue with PI Mappings or PI Trust but apparently there is not. Also, pulling data from PI DataLink works just fine.

Any ideas of what might be happening?

Thank you!

Re: Cannot connect to the PI Data Archive through PI Web API

vkaufmann Dec 5, 2017 4:07 PM (in response to andre.furtado)

What is the account running the PI Web API and what is the value of the AuthenticationMethods configuration attribute (you'll have to double-click to get the value of the array) found on the System Configuration element in the Configuration database on the AF server that the Web API has been configured to use?

--Vince
1 of 1 people found this helpful
Like Show 0 Likes(0)

Actions
- Re: Cannot connect to the PI Data Archive through PI Web API
  
  andre.furtado Dec 5, 2017 6:42 PM (in response to vkaufmann)
  
  The configuration attribute is set to "String Array".
  
  Like Show 0 Likes(0)
  
  Actions
  - Re: Cannot connect to the PI Data Archive through PI Web API
    
    André Åsheim Dec 8, 2017 8:00 AM (in response to andre.furtado)
    
    If you edit the "String arry" you will see a list of authenitcation options that are enabeled for your PI WebAPI.
    Likely it's set to Kerberos.
    In order to get Kerberos working you need to configure your account for delegation.
    1. Register SPN on the account that runs the PI WebAPI (SETSPN -S HTTP/HOSTNAME domain\account)
    2. Allow the service account to delegate to the PI server and AF server (SPN's have to be registered for those services as well, PIServer/HOST (for PI Data Archive) and AFServer/HOST (for AF server))
    You can use the Kerberos guide for PI Vision (Coresight) for the configuration
    Coresight Squared – What’s next? Kerberos and more..
    
    Not reccomended: Switch to Basic authentication by adding/replacing "Kerberos" with "Basic" (case sensitive) in the AuthenticationMethods attribute, Do NOT change to basic if the PI WebAPI is used in a PI Vision installation.
    
    Like Show 0 Likes(0)
    
    Actions
    - Re: Cannot connect to the PI Data Archive through PI Web API
      
      andre.furtado Dec 8, 2017 4:24 PM (in response to André Åsheim)
      
      Yeah..it was set to Kerberus and I changed to Basic and it worked! Thanks!
      
      Like Show 0 Likes(0)
      
      Actions

Go to original post