# in the URL is also called URL Fragments. 

The fragments functions differently than the rest of the URL: namely, its processing is exclusively client-side with no participation from the web. When an agent (such as a Web browser) requests a web resource from a Web server, the agent sends the URL to the server, but does not send the fragment. Instead, the agent waits for the server to send the resource, and then the agent processes the resource according to the document type and fragment value.

However, in case of SSO there are multiple redirection happening at SP, Ping and IdP, so the fragments by their nature are not sent in the initial requests and thus after the authentication when the URL comes back to SP like Windchill, it only have the URL before the fragment, which usually redirects to the
Windchill Home Page.

By adding %23 the URL converts from fragment to an absolute encoded URL and is sent as is in the initial request and thus finally it redirects to the page where we started with.

For time being as there are below options:

• Worked around the issue by performing some customization to redirect Windchill accessing request to the landing page before authentication. On that landing page use javascript to convert '#' to '%23'. Then user should click 'OK' button to perform authentication via Shibboleth SP and other SSO components.
• May be its possible through URL Rewrite, but this will need extensive testing.

Hello,

Also Looking for assistance/example for Okta (Identity Provider) to Shibboleth (Service Provider) with Windchill 12.0.

I followed the Steps from Help Center for a normal connection.  I am used to MS Azure Integration.

The IT Setup Okta Configuration and Sent Metadata and the URL for Metadata.  I did move and confirm the backup XML was being read but get a standard Error. Unknown or Unusable Identity Provider./Unable to locate metadata for identity provider.

If someone can provide what their Okta Confiugration Looks like.  The Metadata file provided also smaller than a MS Azure XML File. 

*****!

Unknown or Unusable Identity Provider
The identity provider supplying your login credentials is not authorized for use with this service or does not support the necessary capabilities.

.........

EntityID: https://xxxx.okta.com/app/xxxx_windchill_1/exkok73p40EGjxy1p357/sso/saml

opensaml::saml2md::MetadataException: Unable to locate metadata for identity provider (https://xxxx.okta.com/app/xxxx_windchill_1/exkok73p40EGjxy1p357/sso/saml)

*****!

Background Info:

Attribute Mapping ---> IT person made a custom variable to base user info:

<Attribute name="NameID" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" id="uid">
<AttributeDecoder xsi:type="StringAttributeDecoder"/>
</Attribute>

Shibboleth File:

<RequestMapper type="Native">
<RequestMap>
<!--
The example requires a session for documents in /secure on the containing host with http and
https on the default ports. Note that the name and port in the <Host> elements MUST match
Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element above.
-->
<Host name="zzzz-app-27-dev.yy.xxxx.net">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
<!-- Example of a second vhost mapped to a different applicationId. -->
<!--
<Host name="admin.example.org" applicationId="admin" authType="shibboleth" requireSession="true"/>
-->
</RequestMap>
</RequestMapper>

<ApplicationDefaults entityID="http://zzzz-app-27-dev.yy.xxxx.net/shibboleth"
REMOTE_USER="uid" sessionHook="/Windchill/sso/shibboleth/sessionHook"
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="false" cookieProps="http"
consistentAddress="false">

<SSO entityID="https://xxxx.okta.com/app/xxxx_windchill_1/exkok73p40EGjxy1p357/sso/saml" postArtifact="true" template="bindingTemplate.html" outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
SAML2

</SSO>

<MetadataProvider type="XML" validate="true"
url="https://xxxx.okta.com/app/exkok73p40EGjxy1p357/sso/saml/metadata"
backingFilePath="metadatawindchill.xml" maxRefreshDelay="7200">
<!-- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/> -->
<MetadataFilter type="Signature" certificate="okta.cer" verifyBackup="false"/>
<!-- <DiscoveryFilter type="Exclude" matcher="EntityAttributes" trimTags="true"
attributeName="http://macedir.org/entity-category"
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
attributeValue="http://refeds.org/category/hide-from-discovery" /> -->
</MetadataProvider>

Note:  Commented out Required Valid and Signature Section since they through errors in Shibbolth Log.

Obviously this is my incorrect configuration.