Single Sign-on Authentication
Windchill can be configured to participate in single sign-on (SSO) using SAML protocol for user authentication, or OAuth 2.0 protocol for delegated authorization.
For SAML authentication, PTC supports using Shibboleth Service Provider as a SAML client that is configured on the PTC HTTP Server to direct Windchill user authentication to a trusted identity provider. For more information, see Security Assertion Markup Language (SAML) Authentication.
If you have configured SAML authentication for Windchill and your site uses electronic signatures as part of its workflow process, then you can optionally configure the system to require users to provide their credentials before submitting an electronic signature. For more information, see eSignature Validation for SSO Configurations.
For OAuth delegated authorization, Windchill acts as a resource provider to applications or mashups built on the ThingWorx platform. If the user grants the application permission to access their Windchill data, then the application will present an access token to Windchill when requesting data owned by the user. PTC products affix scopes to access tokens to further protect and manage access to resources. In Windchill, scopes must be registered in the securityContext.properties file. For more information, see Establish a Central Authorization Server and Configure OAuth Delegated Authorization.
In the OAuth delegated authorization scenario, PTC supports using PingFederate as a central authorization server (CAS) to manage the trust relationship between PTC products participating in an SSO federation. The CAS issues access tokens and verifies their authenticity to trusted applications.
 |
PTC no longer provides PingFederate product or licenses on the PTC downloads page. Beginning April 1, 2022 new PTC products entitlements will not include a PingFederate license by default. New customers choosing to use PingFederate must contract directly with PingIdentity to purchase a PingFederate license. PTC customers, who were previously entitled prior to April 1st, 2022, can still request a PingFederate license by contacting PTC Technical Support, this includes requests for license renewals.
PTC Cloud customers will be provided a PingFederate license if required, as part of the provided PTC offering.
|
For installation instructions, refer to PingFederate documentation.
It is possible to configure Windchill to use both SAML authentication and OAuth delegated authorization, the scenarios are not exclusive of the other. If you have enabled OAuth delegated authorization using PingFederate as the CAS, you can optionally use PingFederate as an identity provider (IdP) in the SAML authentication scenario. You also have the option of using a different IdP in your SAML configuration, and using PingFederate as the CAS in the OAuth configuration. Optional configuration instructions for using PingFederate as an IdP are included in Security Assertion Markup Language (SAML) Authentication.
For a full description of supported SSO use cases and the configuration steps required for setting up an SSO federation between PTC products, refer to the PTC Product Platform Single Sign-on Guide.