How to use both Windchill authentication and IDP(Active Directory) SSO in ThingWorx Navigate?

[hno]

hi.

i've set up Thingworx SSO with an AD server.

If Windchill cannot be configured for SSO,

Is it possible to use the current Thingworx logged-in user account for the Windchill connector(OData, Swagger) after authenticating Thingworx with SSO?

This is because each user has different permissions in Windchill.

Thanks.

[RB_11083802 · Accepted solution]

Ensure ThingWorx is correctly set up with SSO using your AD server. Users should be able to log in to ThingWorx seamlessly using SSO. Once a user is authenticated in ThingWorx, their session should contain information about their identity and possibly their roles or permissions. Configure the ThingWorx Windchill Connector (using OData, Swagger, or another API mechanism) to accept authenticated sessions from ThingWorx. Implement a token exchange mechanism where ThingWorx can issue a secure token after a successful SSO login. Map the permissions from the ThingWorx session to the required Windchill permissions. Ensure that the Windchill connector can interpret these permissions correctly.