We successfully use SAML and in all authentication instances it sends you to the authentication in Creo, Windchill, CV, DTI, WGM etc and back. PTC's support of this using Shibboleth is quite robust. At that point, the IdP would serve the login message. You likely could use forms based to create a simple solution, but in the industry you are in, basic authentication will become a thing of the past sooner rather than later. SAML or Oauth2 (both Authentication and Authorization) will give you more options because most IdP tools offer a wide array of authentication tools to implement MFA.
