Skip to main content
W
Wayne_Beck12-Amethyst
12-Amethyst
May 4, 2016
Solved

Partial AD configuration with Apache Windchill 10.2 M020

  • May 4, 2016
  • 2 replies
  • 4438 views

At my last company I setup what was called a partial AD connection.  Where I just authenticated agents AD.  I don't remember setting up a InfoEngine  to use this.  I am drawing a complete blank on how I did it and it is not in my notes.  Any input and help would be great.  I have read all the current information on the Help and community and still cannot figure it out.

Best answer by BineshKumar1

I see you want to use AD just for authentication and keep the users in Windchill Directory Server. You are right, you don't have to configure an additional JNDI adapter for this.

  1. Create Windchill users with the "username =  Active Directory SAMaccount name". You can provide a random password of your choice as this password will not be used. The email address needs to manually entered for each of the users. You can either create users manually or use load from file - https://support.ptc.com/appserver/cs/view/solution.jsp?n=CS23818.
  2. Add  Active Directory auth provider as the first provider entry in <Apache>\conf\extra\app-Windchill-AuthProvider.xml

<provider>

      <name>Corporate-AD</name>

      <ldapUrl>ldap://domain-controller.domain.com:3268/CN=Users,DC=company,DC=internal?sAMAccountName?sub?(objectClass=*)</ldapUrl>

      <bindDn>an=service_Account,CN=serviceaccount,DC=company,DC=internal</bindDn>

      <bindPwd>password</bindPwd>

  </provider>

  3. Open Windchill shell, navigate to ptc/HTTPServer and run the command, ant -f webAppConfig.xml regenWebAppConf. This will propagate the entries from above xml to conf file.

Few +ves of this approach are

We can keep the windchill user tables clean. Active Directory is extremely volatile, IT administrators would add/remove/move/rename users as per their need and often Windchill will not like it.  No issues with disconnected principals, unless you delete users from Windchill DS directly. To be compliant with licensing policy, you can  create a group in  WindchillDS and move all the separated user accounts to this group.

Few -ves of this approach are

To add a new account, every you need to manually create user in Windchill. If you configure JNDI adapter, this will be populated automatically. Another pitfall is, if you ever have to use CFR part 11, authenticated  workflow task completion, users will have to enter the password which you provide in Windchill, unless you have some third party tool for password synchronization

Thank you

Binesh Kumar

Medtronic-MITG

2 replies

T
23-Emerald IV
TomU23-Emerald IV
23-Emerald IV
May 5, 2016

A partial connection is where you only configure Apache to authenticate against Active Directory and leave InfoEngine pointed at the Windchill Directory Server.  Of course the user account will need to exist in both systems...

There are pros and cons to each method.  For our environment, I prefer the full integration (Apache and InfoEngine pointed to AD.)

B
BineshKumar11-VisitorAnswer
1-Visitor
May 5, 2016

I see you want to use AD just for authentication and keep the users in Windchill Directory Server. You are right, you don't have to configure an additional JNDI adapter for this.

  1. Create Windchill users with the "username =  Active Directory SAMaccount name". You can provide a random password of your choice as this password will not be used. The email address needs to manually entered for each of the users. You can either create users manually or use load from file - https://support.ptc.com/appserver/cs/view/solution.jsp?n=CS23818.
  2. Add  Active Directory auth provider as the first provider entry in <Apache>\conf\extra\app-Windchill-AuthProvider.xml

<provider>

      <name>Corporate-AD</name>

      <ldapUrl>ldap://domain-controller.domain.com:3268/CN=Users,DC=company,DC=internal?sAMAccountName?sub?(objectClass=*)</ldapUrl>

      <bindDn>an=service_Account,CN=serviceaccount,DC=company,DC=internal</bindDn>

      <bindPwd>password</bindPwd>

  </provider>

  3. Open Windchill shell, navigate to ptc/HTTPServer and run the command, ant -f webAppConfig.xml regenWebAppConf. This will propagate the entries from above xml to conf file.

Few +ves of this approach are

We can keep the windchill user tables clean. Active Directory is extremely volatile, IT administrators would add/remove/move/rename users as per their need and often Windchill will not like it.  No issues with disconnected principals, unless you delete users from Windchill DS directly. To be compliant with licensing policy, you can  create a group in  WindchillDS and move all the separated user accounts to this group.

Few -ves of this approach are

To add a new account, every you need to manually create user in Windchill. If you configure JNDI adapter, this will be populated automatically. Another pitfall is, if you ever have to use CFR part 11, authenticated  workflow task completion, users will have to enter the password which you provide in Windchill, unless you have some third party tool for password synchronization

Thank you

Binesh Kumar

Medtronic-MITG

W
Wayne_Beck12-AmethystAuthor
12-Amethyst
May 6, 2016

Thanks for the information.  While this is what I remember doing I am having no luck at it.  This is what I have.

   <provider>

      <name>Corporate-AD</name>

      <ldapUrl>ldap://domain-controller.domain.com:389/OU=Service Account,OU=Corporate,OU=Franklin Users,DC=franklin,DC=fele?sAMAccountName?sub?(objectClass=*)</ldapUrl>

      <bindDn>cn=wcadmin</bindDn>

      <bindPwd>willnottell</bindPwd>

   </provider>

B
BineshKumar11-Visitor
1-Visitor
May 6, 2016

If you provide OU=Service Account,OU=Corporate,OU=Franklin Users,DC=franklin,DC=fele in ldap URL, you are defining search base and apache will only search inside OU=Service Account for users. Going by the name, it is a place for service accounts. This shoud be changed to OU=Franklin Users,DC=franklin,DC=fele. Do you have cn=windchill account created in AD?

Terms & ConditionsCookie settingsAccessibility statement