SSO User not Getting Authenticated in TWX

Question

Hi,

I configured TWX SSO using Okta as IdP.

All configurations I believe are correct, I can even login to TWX with SSO, I can open Composer and view mashups. But even though I've given SSOAdmins and SSOUsers (My group mappings in SSO) run time permission for Things, to view, run services, subscribe and etc.

When I log in through SSO I can't execute any service and nothing more. It's like the user gets in, but it does not get added to the UserGroups defined.

I've also given the UserGroups permissions on PlatformSubsystem, EntityServices.

Is there some kind of different way to grant permissions to SSO users?

I even tested creating a user and adding this user to my UserGroups, and at runtime everything runs fine, I can execute services and whatnot.

I believe the issue is happening when logging in, the logged SSO user is not getting added to the respective userGroup mappings.

Thanks!

CaShimiz · Accepted Answer

EDIT: The customer didn't set up the groups in AD properly, so that's why I wasn't getting added to the respective groups. He configured them correctly and then I was able to log in and the correct permissions were granted.

@Mukul_467346 thanks for the response. OKay, so As far as I know the AD group is mapped correctly on ThingWorx user group in SSO Authenticator.

The customer sent me the below group being the one mapped on the AD/Okta.

Can it be that my user is not on that referenced group in AD? But wouldn't that block me from logging in? Or would log but just not get added?

Also, I've given runtime permissions to the SSOUsers as well. When signing through SSO shouldn't my user be put on that default user group automatically?

Mukul_467346 · Answer

There is no different or special way to grant permission to users who are getting in using SSO way in ThingWorx. As you log in the AD user will be created (user creation enabled) in ThingWorx and you can grant permission to that user. I am not sure about your exact issue but as you said - the issue is your user is not getting mapped to the desired user group in ThingWorx. Did you correctly map your AD user group to ThingWorx user group in SSO authenticator? If yes, then I would also assume that your AD user group is also coming in SAML response from IDP. if any of the previous conditions are not correct, your user will not be mapped in the mentioned user group. If that's the case and you have granted permission to the user group, it will not work for those users. (as there is no user mapped in that user group).

Sign up

Please use your PTC eSupport account.

Welcome to the PTC Community

Please use your PTC eSupport account.

Scanning file for viruses.

This file cannot be downloaded