Windchill 10.2 Single Sign On

Integration with Active Directory is a two part configuration.

1. Add active directory as an auth provider in the web server so that it authenticates the user against AD.
2. Configure JNDI adapter to talk to Active Directory to retrieve user attributes(Full name, email and so on) after the user is authenticated.  Windchill keeps this data in a database table and synchronizes this information periodically.  If the user is removed or disabled, the user is marked as disconnected in Windchill.

Best practice is to create an LDAP group for all the Windchill users and filter user access to Windchill by LDAP filter against this group. This will keep the Windchill user table clean as well.

If you are okay managing user accounts both in AD and in local LDAP, you can implement just part#1. It is a hybrid approach many companies follow where they leverage AD for authentication where the rest of the information will be manually loaded in local LDAP.  Both approaches have its own pros and cons. I assume you are already using Windchill with local ldap, so this might be something which you can consider.

In any case, I can't think of any thing that will prevent you from proceeding with  AD integration unless the users wanted to have dedicated user name and password for Windchill