Oracle access manager with Windchill help needed.

[bt]

 We are currently in process of setting up OAM with Windchill, could you please let me know if you were able to successfully implement ? If so is it possible to share the configurations need to be done from Windchill side and OAM side ?

              Currently we did configure the OAM for a POC work but doesnt seems to be working. When we enable OAM we are getting user not found from Corporate LDAP, if we disable OAM the user seems to have got it authented.

Regards

Baalajee.T

[BineshKumar1]

Hi Baalajee,

How are you integrating Apache with OAM? Are you using webpass? If you are using webpass, you should set the user header variables in your OAM so that the tomcat recieves the logged in user name. By the way, where are you getting the "User not found" error is it in the Apache logs or in the webpage after the login

[bt]

Thanks for the response, at the moment the OAM team is different from the application team and hence i m not sure on the configuration.I will check and let you know, from the Windchill side is there any settings that we need to make it enabled ?

I m getting the error when trying to give the credentials from UI. We are using Webgate for this.

[bt]

HI Binesh,

             We use webgate for integration Apache with OAM. User headers are being set for the same. Is there any specific header name which needs to be set ? Syntax etc ?.

Regards

Baalajee.T

[BineshKumar1]

So you have two ways of configuring webgate, the  basic which leverages the basic authentication prompt or single sign on using the form provided by OAM. The way webgate works is, it intercepts any requests against the protected resources and if it is not already authenticated by a cookie, it will direct you to login prompt . Once authenticated, you can configure webgate and OAM to set the variable REMOTE_USER to uid/samaccountname of the authenticated user.  If the resources are protected by webgate, then you need to remove Windchill authentication directives in the HTTP server, you can use protocolAuthOnly in the webapp properties and and run ant command to make this change. 

[bt]

Thanks a lot Binesh for the response. We tried the same from OAM after your suggestion and the windchill changes as below. We are still getting the same error. Any other suggestions ? Also do you know how the CadWorker integration will work with OAM(form-based auth). Does the functionality works properly without any issues ?

[ptcadmin@ftdcslainf642 conf]$ cat app-Windchill.properties
#Ant properties
#Tue Aug 15 12:24:09 CDT 2017
ajpWorker=ajpWorker
authRealm=Windchill
disableAJP=false
disableAuthentication=false
docBase=/opt/ptc/Windchill_11/Windchill/codebase
enableCustomErrorDoc=true
isCognosWebApp=false
protocolAuthOnly=false
proxyEntireWebApp=false

[BineshKumar1]

Set the value of protocolAuthOnly to true and run the command ant -f webAppConfig.xml regenWebAppConf. Based on what you said, I am not sure whether authentication is the issue here, even  if you leave the all authentication constraints on, you should get a second basic authentication prompt after you pass single sign on.   What exactly is the error message you have on the browser? Is it from apache or tomcat?

As for CAD worker, we have a cluster node running with basic authentication where we point our CAD workers to. But  if you don't have this setup, you can use  trusted host authentication. 

[bt]

Hi Binesh,

            Sorry got stuck in other work and could not respond. Getting the below error.

Exception:	wt.util.WTRuntimeException: (wt.session.sessionResource/2) wt.org.UserNotFoundException: User not found: unknown web name: "uid=if311,ou=other,ou=people,dc=cummins,dc=com". Nested exception is: (wt.session.sessionResource/2) wt.org.UserNotFoundException: User not found: unknown web name: "uid=if311,ou=other,ou=people,dc=cummins,dc=com".

From the authentication window. No second authentication prompt is being redirected.

Below is the information we got from OAM while debugging which the UID is being passed. The problem here is windchill is throwing full uid=if311,ou=other,ou=people,dc=cummins,dc=com instead of uid=if311 alone. Any help would be of gr8 use here.

Headers and Cookies to the Application

Found Cookies Name and Value

• Cookie : _ga= GA1.2.1919484121.1483625293
• Cookie : CoreID6= 59401250535914842563398&ci=90387216_60387216
• Cookie : OAMAuthnHintCookie= 0@1504120606

• Host=ftdcslaidmoam01.ftdc.cummins.com:14100
• Accept=image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
• Referer=https://login-alpha.cummins.com/auth/login.jsp
• Accept-Language=en-US
• User-Agent=Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
• Cookie=_ga=GA1.2.1919484121.1483625293; CoreID6=59401250535914842563398&ci=90387216_60387216; OAMAuthnHintCookie=0@1504120606
• Accept-Encoding=gzip, deflate, peerdist
• X-P2P-PeerDist=Version=1.1
• X-P2P-PeerDistEx=MinContentInformation=1.0, MaxContentInformation=2.0
• Cache-Control=no-cache
• SMUSER=if311
• uid=if311
• HTTP_REMOTE_USER=if311
• OAM_IMPERSONATOR_USER=
• OAM_REMOTE_USER=if311
• OAM_LAST_REAUTHENTICATION_TIME=Wed Aug 30 15:17:16 EDT 2017
• OAM_IDENTITY_DOMAIN=SunOne_LDAP_Userstore
• X-Forwarded-For=10.128.140.53
• X-Forwarded-Host=ftdcslainf642.ftdc.cummins.com
• X-Forwarded-Server=ftdcslainf642.ftdc.cummins.com
• Connection=Keep-Alive

failureurl: null oam_error_code: null

[BineshKumar1]

You need an OAM policy authorization which add header variable REMOTE_USER, what you have now is HTTP header not header variable

Actions
Authorization Success
Return Type Name Attribute
HeaderVar REMOTE_USER uid