Navigate --[ API gateway ]--> Windchill

[Constantine]

Hello All,

I have an API gateway, which also acts as an OIDC IdP. There's a Windchill instance which is configured to serve APIs to that gateway with SSO. There's an external app, which uses that setup, and it works fine.

I'd like to investigate an idea of connecting Navigate through the same API gateway, and not directly to Windchill. I expect to do some configuration on the ThingWorx side, but zero changes on the Windchill end, because other API gateway app(s) already work, so I assume that there's nothing to change.

Before I spend time on trying to set it up, just wanted to check with the community -- is it a supported setup, and what kind of issues should I expect?

Also, this might be a very lame question, but what do I need to configure on the ThingWorx side to make an external OIDC IdP work in this scenario?

Thanks,

Constantine

[barko]

No, not supported and I think it can’t be done. Windchill has a file securityContext.properties that needs the details of the Windchill RP Oauth client from the CAS, and without that any request for data from Navigate using Oauth will fail. Navigate has to send the Oauth token with the request to Windchill. We don’t know what effect a custom routing will have.

Support for OIDC on the ThingWorx side is dependent upon the ThingWorx version. Windchill adopted OIDC much earlier than ThingWorx did, so there is no easy correlation to assume.

[slangley]

Hi @Constantine 

If the previous response answered your question, please mark it as the Accepted Solution for the benefit of others in the community.

Regards.

--Sharon

[Constantine · Accepted solution]

Hello @slangley, thanks for the reminder! Actually I found a way to make it work and got a working prototype. A few items for anyone else interested in it:

1. It is possible to put an API Gateway in the middle between Navigate and ThingWorx, provided that
   1. the gateway handles authentication (they usually do)
   2. and mints its own tokens.
2. The gateway is then used as an Authorization Server both to authenticate users and authorize requests to Windchil
   1. You can have the same client configured in AuthorizationServersSettings and in OIDCSettings sections of sso-settings.json
   2. Authentication and authorization use different redirect URLs, so make sure you configured both in your AS. Our API Gateway only allows a single redirect URL, so I just created two clients with different client IDs, and it works:
      1. /Thingworx/oidc/SSO
      2. /Thingworx/oauth2_authorization_code_redirect
3. It works with non-AD, non-PF OAuth providers, as long as they are compliant with OIDC standard, namely support nonce parameters

Here's our working setup:

I'll mark this comment as accepted solution, hope it would help someone.

/ Constantine