How to Map User/User Attributes from SSO MS Azure to Windchill? (Instead of a Local LDAP)

Currently we have a simple SSO (Single Sign on) Solution based on PTC Help (and PTC Community)

• Microsoft Azure (Identity Provider)
• Shibboleth (Service Provider)
• Windchill with WindchillDS

The Solution requires a User Account to Exist in WindchillDS (Or Other LDAP) with matching Name to what is in Microsoft Azure.  Windchill displays SSO Log In and checks Password.  Passes and the Users is able to log in.

Server now going to CLOUD - and IT does not want a Tunnel to Active Directory.

QUESTION:  Has anyone Configured Windchill to Pull User Information from Microsoft Azure into Windchill?

Willing to Provide Assistance?

Random Thoughts:

* Possible Shibboleth XML changes to pass User Attribute Information in Windchill?

* Likely need a JNDI Adapter?  To make MS Azure Accounts visible?  Similar to an Active Directory Integration?