Mapping attributes for SSO with Azure and Shibboleth

[ZahyMatar]

Hey everyone, 

We are in the final stages of our SSO configuration for Windchill. We get prompted with the Microsoft sign-in, but it ends up searching for the user's email attribute in Windchill rather than their first.last (our current setup for user accounts in Windchill).

We have tried mapping the attributes to no avail. We are also required to delete everything in the address bar after */Windchill in order to get it to load. I end up with a "URL not found" error. 

[jbailey]

Might need some more context here. Version of Windchill? Have you tried SAMLTracer to see what is being returned in an assertion?

[BrianSullivan · Accepted solution]

Hello Zahy,

The Mapping is on the MS Azure Side.

PTC Support Technique is mapping the Claim/Name in MS Azure to the ID in Windchill.

1. Default is Email Address

2. PTC Literature shows you can change Claim/Name change from user.principalname to user.onpremisessamaccountname

which would map your O.S. Log In Syntax.

Talk with you MS Azure expert on whether there is a different value that they have in MS Azure that is equivalent to firstname.lastname.

Brian