Skip to main content
S
shlcm6-Contributor
6-Contributor
November 17, 2025
Question

Configure Windchill SSO with shibboleth, stuck with the 'target' url

  • November 17, 2025
  • 2 replies
  • 580 views

As configure Windchill SSO by following the manual: Security Assertion Markup Language (SAML) Authentication , now we are able to open the SSO login page and login with username/password successfully. But when the browser tries to jump into Windchill home page, it showes error message like 'Failed to process the request, Contact your administrator...'. As checked the method server log, there're debug message like below:

2025-11-17 13:09:14,115 DEBUG [ajp-nio-127.0.0.1-8011-exec-1] sso.shibboleth.sessionHook wcadmin - Query Parameter - return = https://plmdev.xxxx.com:4443/Shibboleth.sso/SAML2/POST?hook=1
2025-11-17 13:09:14,115 DEBUG [ajp-nio-127.0.0.1-8011-exec-1] sso.shibboleth.sessionHook wcadmin - Query Parameter - target = null
2025-11-17 13:09:14,116 DEBUG [ajp-nio-127.0.0.1-8011-exec-1] sso.shibboleth.sessionHook wcadmin - Windchill Domain Name = plmdev.xxxx.com

 

Just wondering where we can set the 'target' properly so that the sessionHook can handle the request successfully. Any advice will be appreciated...

2 replies

S
shlcm6-ContributorAuthor
6-Contributor
November 17, 2025

Forgot adding the error page url: 

https://plmdev.xxxx.com:4443/Windchill/sso/shibboleth/sessionHook?return=https%3A%2F%2Fplmdev.xxxx.com%3A4443%2FShibboleth.sso%2FSAML2%2FPOST%3Fhook%3D1

avillanueva
23-Emerald I
avillanueva23-Emerald I
23-Emerald I
November 17, 2025

out of curiousity, was wcadmin using basic authentication? You mentioned that you have it working with both SSO and username/password. I am wondering if its crossing over which would suggest a webserver misconfiguration.

avillanueva
23-Emerald I
avillanueva23-Emerald I
23-Emerald I
November 21, 2025

I check my settings and for the sessionHook, it should be just this:

sessionHook="/Windchill/sso/shibboleth/sessionHook"

By putting the target attribute there, that is why its forcing to Apache page. This should be getting parameterized for you somewhere but does not need to be forced. 

Also, I noticed that your entityId was different than mine. Not sure if this matters:

entityID="https://<my FQDN>/shibboleth"

The issue lies somewhere else. Its not in the attributes mapping. 

V
vnamboodheriCommunity Manager
Community Moderator
November 28, 2025

Hello @shlcm, 

 

It looks like you have some responses from some community members. If any of these replies helped you solve your question please mark the appropriate reply as the Accepted Solution. 

Of course, if you have more to share on your issue, please let the Community know so other community members can continue to help you.

Thanks,
Vivek N.
Community Moderation Team.

Terms & ConditionsCookie settingsAccessibility statement