Windchill SSO with Entra ID Application Proxy Approach

[DeekshithV]

We are currently working to switch out Windchill systems from Basic authentication to Form Based (SSO) authentication. We are clear with the approach of using shibboleth as SP and Entra ID AD as IDP & CAS.

But our cyber security team suggested to use Entra ID Application Proxy method for the Windchill SSO which requires no changes to the Windchill application side.

Application Proxy - https://learn.microsoft.com/en-us/entra/identity/app-proxy/
https://learn.microsoft.com/en-us/entra/identity/app-proxy/how-to-configure-sso

Have anyone tried this approach for Windchill SSO? Can anyone suggest on this approach and how reliable it would be with Windchill and its associated integrations ?

[jbailey]

A couple of things to consider based on my SSO / SAML / Authentication experience (I have not looked into Entra ID Application Proxy before)

1) Regardless of how a user authenticates, InfoEngine still needs to connect to a back-end ldap v3 compliant - Do they have Entra ID DS? If not, you still need to connect to an enterprise AD on the back end.

2) I would think you would need to configure Apache to accept the username in the header (PTC recommends against this for security reasons), because Apache (as configured for basic authentication w/Windchill) I don't think will just accept a header with a username for authentication.

3) If you plan on using electronic signatures, Windchill creates a browser session with no auth header, then invokes authentication, and compares the authenticated user from the new browser to the WC logged in user to validate.

4) DTI, WGM, and Creo View all invoke authentication on launch ootb - you may run into issues here

[vnamboodheri]

Hello @DeekshithV, 

It looks like you have a response from a community member. If it helped to answer your question please mark the reply as the Accepted Solution. 

Of course, if you have more to share on your issue, please let the Community know so other community members can continue to help you.

Thanks,

Vivek N
Community Moderation Team.