How to configure a worker with basic auth in a windchill sso configured environment.

[AP_10483126]

How to configure a worker with basic auth in a windchill sso configured environment.

[jbailey]

In the WVS guide here, you can refer to:
https://www.ptc.com/support/-/media/support/refdocs/Windchill_PDMLink/13_1/WCVisualizationServicesGuide_13_1_2_0.pdf?sc_lang=en&source=search

auth.properties on Page 64
Trusted Host Mode Page 96

This describes both trusted host with $user variable https://support.ptc.com/help/windchill/r13.1.2.0/en/index.html#page/Windchill_Help_Center/WVSPrintManagement/WVSVisualizationFormbasedAuthentication.html

This describes the Client Credential Grant method:
https://support.ptc.com/help/windchill/r13.1.2.0/en/index.html#page/Windchill_Help_Center/WVSPrintManagement/WVSConfigWorkerwithCCG.html#

[AP_10483126]

https://www.ptc.com/en/support/article/CS372426?source=search

It seems the trusted host is deprecated. Using windchill 12.1

How doe we register the url in server management and use basic authentication instead of SSO?

[jbailey]

Depending on which version of Windchill you are on, it will still work. I can confirm it works on 13.0.2.x. It uses an already open URL for basic auth that enforces access via the trustedhosts configuration. Is there a reason you need basic auth instead of the $user variable method? Obviously with the Client Credential Grant method you will need to configure Windchill for OAuth.

[AP_10483126]

with this i see it based on each publishing application. WIll i be able to register the server in the server management within workgroup manager?

[jbailey]

For unattended publishing - you don't register the server in server management. It will register the server upon each publish job using either auth.properties basic auth, auth.properties $user variable auth, or Client Credentials Grant auth. If you are doing something interactively on the publisher (troubleshooting, checking connectivity etc.) you would register the server in Creo using your interactive login via SAML. If you are doing this interactively, you will need to make sure to unregister the server when you are done because this could cause issues (Creo will try and login on startup with the server registered - interfering with WVS unattended authentication.

[AP_10483126]

In an environment configured for SSO, how can we allow a specific subset of users to authenticate with basic authentication—for tools like Workgroup Manager and certain CAD design applications—while ensuring that all other users continue to authenticate through SSO?

[jbailey]

There are some articles on that - I would make sure you are very careful. It is not recommended by PTC.

Article - CS389291 - Can we have some external users accessing Windchill with basic authentication while other users using SSO authentication on Windchill SSO environment

[AP_10483126]

This article doesnt fix the issue 

[jbailey]

What is the use case for allowing some users to log in without SSO? All of the UI accessed Windchill Tools (Creo WGM, WGM for other tools, Creo View, Desktop Integration etc) support SSO for login. As I mentioned earlier, on the publishing machine, it uses auth.properties to establish the credentials of the user for the purpose of publishing - and you don't register the server interactively. If you are testing something on the worker (logging on to windchill to interactively look at publishing, file access etc.) That would be done using SSO.

[AP_10483126]

Need test users to login with basic authentication from their local machines for testing.Let me create another topic on this issue seperately.

[avillanueva · Accepted solution]

Trusted host is deprecated yes but a replacement has not been provided. Ok to use that for now.  You can remove the password from the auth.properties and the CAD worker should be trusted.