Skip to main content
T
TanmeyTWX17-Peridot
17-Peridot
November 30, 2022
Solved

User Provisioning Exclusion List

  • November 30, 2022
  • 1 reply
  • 2933 views

Hi Experts,

 

I have Azure AD integrated with Thingworx using ThingworxSSOAuthenticator and I have added Administrator and one thingworx created local user in the exclusion list. But having SSO Authenticator enabled, Administrator/Other user doesn't login.

 

I am using Thingworx 9.3.

Best answer by nmutter

To answer your previous questions

- Do I need to create 'Administrator' user in AD also? -> you can do that if you want to login with user "Administrator". For this see the link I shared from PTC in my previous comment. But this is very complicated and not needed. As you can just make your own user <TanmeyTWX> (which has a valid login at AzureAD) a administrator by putting him in the "Administratros" group.

- Do I need to bypass microsoft AD authentication in case of Composer or Excluded users? How? -> Not possible, only SSO will work (or AppKey)

 

To clear up some things:

- If you activate SSO you cannot login with a username+password defined of a Thingworx user. You can ONLY login via SSO. From SSO the username is taken and mapped to a thingworx user (with the same username).

- Any user who should have access to the Composer or Admin permissions needs to be in the correct UserGroups (e.g. "Administrators") which grant these permissions.

- Putting users in the "Excluded list" only says that thingworx will not change their user or the groups he belongs to. Still the login is done via SSO.

- If SSO is active as a user you can only login via SSO - no other way. So the user to login with needs to be in the correct UserGroups to have the needed permissions in ThingWorx.

 

Maybe this makes it more clear? Maybe there is also another link missing...

1 reply

N
nmutter16-Pearl
16-Pearl
December 1, 2022

I'm not clear what your issue is. Can you elaborate?

 

Putting users in the list u specified will just say, if these users login they will not be modified in any way. Being on that list will not prevent them from login.  If login is not working there is a different issue. What error do these users get?

T
TanmeyTWX17-PeridotAuthor
17-Peridot
December 2, 2022

Here are the details.

 

1. I have 2 users in use. One is thingworx default 'Administrator' user and other is Azure AD authenticated user 'JohnFernandez'.

2. I have added 'Administrator' in the SSO provisioning user exclusion list.

3. Enabled SSO and restarted Apache.

4. Trying to Form login (https://myApp.dpm.com/Thingworx/FormLogin/myApp.Org) with 'JohnFernandez' user, it navigates to microsoft login and getting redirected to thingworx and finally logged-in.

5. Now trying to Composer login with 'Administrator' user but this also getting navigated to microsoft login for authentication instead of direct login into the composer. Why?

Do I need to create 'Administrator' user in AD also?

Do I need to bypass microsoft AD authentication in case of Composer or Excluded users? How?

 

Note: above form login url is just for reference.

 

N
nmutter16-Pearl
16-Pearl
December 2, 2022

I see. If you have SSO activated you can only login via SSO. Also the Administrator user has to do it with SSO. Besides SSO you can only use AppKeys to authenticate.

 

PTC also "recommends" to create the "Administrator" entity in your IdP: https://support.ptc.com/help/thingworx/platform/r9/en/index.html#page/ThingWorx/Help/Composer/Security/SSO/CreateThingWorxAdministratorAliasInIdP.html# but I never do that. I just put my own user in the "Administrators" group and put him on User Exclusion List.

 

As an example: If John should be a Administrator you would need to put "JohnFernandez" user in the "Administrators" group manually and put him in the "ExclusionList". So the user, when he logs in via SSO will not be modified - and stay in the "Administrators" group. You can also have automatic group mappings - if configured - mapping AzureAD groups to Thingworx groups.

 

Additional: Having SSO activated, the FormLogin page has no real functionality anymore as you will always authenticate with user+password at AzureAD - and also reset the password there. I always give the users the link to the target entry-mashup instead (of the FormLogin).

 

Hope that helps. Let me know 😉

Terms & ConditionsAccessibility statement