5 Replies Latest reply on Apr 21, 2017 7:18 AM by gregor

    Coresight Brows Tags

    patrik0173

      Hello :-)

       

      I can't brows tags from another computer, i logon the webpage with a webserver local account? I can se Assets and create display from them, I can open Processbook pictures thru Coresight and them will show tag values. How to config a local account on webserver to let user to create a coresight display and brows tags from pi data server?

       

      Servername: Serverxx

      Lokal account: Coresight

      Adress: http://Serverxx/coresight

      User: Serverxx\Coresight

      Pass: coresight

       

      Everything works except tag browsing?

       

      //Patrik

        • Re: Coresight Brows Tags
          gregor

          Hello Patrick,

           

          PI Coresight installation includes PI Web API and the Index Search Crawler of PI Web API is used to search for data items. I assume the missing piece for you is the PI Index Search Crawler configuration.

          Please browse to the PI Coresight administration page (http://yourCoresighthost/Coresight/Admin). Locate Data Servers Allowed and click [Manage Configuration]. Make sure your PI Data Archive host is listed. If not, please check the Known Servers Table on your PI Coresight host.

           

          I am used to configure the Index Search Crawler trough PI Web API and hence am unsure if it is possible to create an index within the PI Coresight Admin page. The PI Coresight documentation should offer some insights. However, you can browse to https://yourCoresighthost/piwebapi/admin/search/database.html and add an index for your PI Data Archive host there (PI:YourPIDataArchiveHostName). Please note that the Index Search Crawler requires Kerberos authentication.

          2 of 2 people found this helpful
          • Re: Coresight Brows Tags
            jru

            Hi Patrik,

             

            Thanks for posting on PI Square.  I'm a little confused by what you mean by browsing for tags.

             

            When you are using the search pane, if you need to find tags on a PI Server, you'll have to use the Keyword search to find the tags.  The AF Server is different since you can search AND browse for elements and attributes.

             

            In other words, are you having issues searching for tags?  For instance, using the search for Sinusoid, does Coresight return results like the one below:

            If you are having issues with searching, the very first thing I would check for is if the WebAPI crawler has crawled the PI Server.  You can do this by going to:

            https://serverxx/piwebapi/admin/search/database.html

             

            If the WebAPI properly crawled the PI Server, we should see something like this for the PI Server:

            Please let me know what you find out

            ~Jesse

            2 of 2 people found this helpful
              • Re: Coresight Brows Tags
                patrik0173

                Hello!

                 

                The database is crawled... the problem is that if i logon corsight server and create an display it works, if i open web on another pc, with a local account and try to create an display the tag brows not working, af is working :-) se picture below

                  • Re: Coresight Brows Tags
                    Andre Johnsen

                    Hi,

                    This might be a authentication over double-hop issue.

                    Coresight is default installed with Windows authentication (Negotiate), and Coresight requires Windows authentication to your PI Data Archive.

                    A easy way to find out if it's an authentication issue is to open a display (that contains data) and look at the PI Message Logs on the PI Data Archive when connecting. Typically when it's an authentication issue you'll see that you are attempting to connect with NT AUTHORITY\ANONYMOUS LOGON.

                     

                    I would check out: Coresight Squared – What’s next? Kerberos and more..  or Live Libarary for infomation on how to configure Kerberos authentication.

                     

                    Reccomended fix: Configure Kerberos authentication

                    Work-Arround: Use basic authentication - this solution doesn't scale, when eynought users the local LSAS process will be the bottleneck. Do not use basic authentication if you don't force HTTPS, basic authentication is username and password sent in clear text over the network (Base64 encoded).

                    • Re: Coresight Brows Tags
                      gregor

                      Hello Patrick,

                       

                      Your description of the issue indicates missing Kerberos Delegation.

                       

                      By adding a client to the scope, data requests are going via multiple hops, from the browser on the client to PI Coresight, to PI Web API, to the PI Data Archive or PI AF Server.

                      Kerberos is a ticketing system and the multiple hop scenario requires tickets to be forwarded from one instance to another. This forwarding is referred to as Kerberos Delegation and it is by default disabled.

                       

                      The following KB articles are containing more detailed information.

                      KB01222 - Types of Kerberos Delegation

                      KB01223 - Kerberos and Internet Browsers

                       

                      We are suggesting constrained delegation which more or less means to allow selected services by host or user account (service account) to forward authentication tickets. Not only because configuring Kerberos Delegation requires administrative privileges on the domain controller, we highly recommend to consult with your IT.