Configure SSO in Windchill with Shibboleth

[MV_8761582]

I am using Windchill PDMLink Release 12.1 and Datecode with CPS 12.1.2.2

Hello,

I would like to set up our Windchill instance to use SSO with Shibboleth. Is there any help I can get with this?

[jbailey]

So the PTC resources are pretty good about SSO

https://support.ptc.com/help/wnc/r12.1.1.0/en/index.html#page/Windchill_Help_Center/WCAdvDeployGuide/WCAdvDepAuth_ConfigAltAuth_SSO.html#https://support.ptc.com/help/wnc/r12.0.2.0/en/index.html#page/Windchill_Help_Center%2FWCAdvDepAuth_ConfigAltAuth_SSO.html%

The prerequisites... you need a SAML IDP... if you don't have one, you will have to configure one with Shibboleth IdP or PingFederate. As of now, Ping licensing is included for use of all the features for PTC products.. DO NOT use it for an IdP for anything other than PTC product work - you expose yourself to license violations.

Once an IdP has been established, follow these steps:

1. Have a WC entry created in your IdP (They will need to know an entity ID, and some URL's as well as maybe a certificate)
2. Install Shibboleth On the WC Server
3. Configure shibboleth2.xml and the attribtue-map.xml file for your environment.  You will need url's from the IdP as well as the IdP entity ID.
   • Take note if you are using electronic signatures in WC workflows, as there are extra steps in configuring the shibboleth2 and other apache files 
   • If you are using an attribute other than UID like sAMAccountName, userPrincipalName etc as the unique ID.... and are using electronic signatures, you also need to modify <wthome>\Windchill\codebase\reauthsecure\SSOReauthentication.jsp Note: This is UNDOCUMENTED  by PTC, I have suggested they document it for almost 2 years. The JSP file picks the attribute value from the header to authenticate a user against (verify a user completing the task is the same user that was logged ininitially)
4. Create Shibboleth Apache Files per PTC Instructions to handle interception of requests
   1. Remember - if you turn on Esignatures, extra steps are covered in apache config for shibboleth
5. Configure Sessionhook settings (in PTC documentation - used to ensure when the auth flow returns from the IdP it goes to the URL that the user initially tried to get to.... if you dont do this, it will go to https://<your WC url>/Windchill/app
6. Configure WC to use protocol Auth (instructions in PTC Docs)
   1. If using Windchill Desktop Integration, Configure DTI configs to use Wizard in Auth (detailed in PTC Documentation)
7. Add IdP certificate into Java Keystore (can be done at any time before use)
8. Restart Windchill

[cgautier]

Hello MV_8761582,

This is Charles from PTC Technical Support in Europe, I will provide you assistance on this question. Was the information provided helpful somehow?

KR,

Charles.

[cgautier]

Hello MV_8761582,

This is Charles from PTC Technical Support in Europe, I will provide you assistance on this question. Was the information provided helpful somehow?

KR,

Charles.

[VG_WC12]

Hi , @MV_8761582 , Are you able to set this up?

I am trying to implement SSO in Windchill with SAML and Azure AD. As a first step , I am planning to  ask cloud team to add WIndchill Application in Microsoft ENtra ID and configure Microsoft Entra SSO. what are the details we may required to send them to do this configuration in Azure AD.

Can someone explain  shibboleth2.xml and the attribtue-map.xml file to be configured in Windchill , what are the details required from IDP and how to configure. What unique entityID refers here and what is session hook?

[jbailey]

attribute-map.xml is used to match an incoming attribute name from the IdP (Entra in your case) to an attribute name that Shibboleth will use to match to user ID.

From the IdP you will need:

• IdP Entity ID
• IdP metadata - either URL (preferred) or static file
• SAML Discovery URL for the IdP
• Attribute name that will hold your username attribute
• SP Entity ID configured in IdP for your Windchill implementation (this is the unique Entity ID - basically a name that the IdP and Shibboleth both know and can use to validate - if you ask your Entra folks for the entity ID for the Windchill SP - they will know what to give you)

On the IdP side, they need to set up at least one endpoint - /Shibboleth.sso/SAML2/POST. If your Windchill implementation uses PTC electronic signatures in Workflows, you will need a second endpoint set up... /reauthsecure/Shibboleth.sso/SAML2/POST

The shibboleth2.xml file is where you configure the SP (Shibboleth) to connect to the IdP and configure security/validation

I do recommend looking over the PTC documentation, it does give you a straight forward set of instructions. Once the IdP is configured, you should be able to configure Windchill for SSO in a couple of hours including documenting what you did.

Other considerations for SSO

• if you use an attribute other than UID and use electronic signatures, you have to modify a jsp file (see my earlier comment)
• If you use desktop integration, additional files need modified to use WIZARD for auth
• Depending on your version of Windchill - WGM and CreoView clients may show a script error when trying to do auth, in that case additional files may need to be modified to ignore the script error that os shown because of poor PTC coding 🙂

Oh, and use SAML tracer... it will save you from a lot of headaches in trying to track down what you configured wrong