Implementation of Client Credential Grant Type in PingFederate
Windchill can participate in a single sign-on (SSO) as a resource server to client applications that support the OAuth protocol. When configuring a non-interactive client that uses a machine identity, the Client Credentials grant flow is recommended. This topic describes the manual steps for configuring the OAuth Client Credential grant type to be used for secure access to Windchill as a resource server through Windchill Rest Services.
Pre-Requisites
All subsections here assume that both the Central Authorization Server (CAS), Windchill, and the client application have been configured for OAuth 2.0. Windchill must be configured as a Resource Server using OAuth. The Oauth Client must be registered as a Service Provider.
Configuration for Any Client Application Using Client
A common client registration application should be supported by IdP. This application validates and verifies the access token for all clients that are configured with client credentials and authorization code grant type. The registered client must allow both grant types, it is required to configure authorization code grant type to support ThingWorx Navigate. The user attribute defined should be same for all clients that are configured for Client Credentials and Authorization grant type. The clients that are configured for client credentials are required to use Service Principal name as user attribute. The clients that are configured with Authorization Grant type should use Username as user attribute. This user attribute should be available as claim in access token.
 |
Only opaque token formats are supported at this time, support for JWT tokens will be added in a future release.
|
• Example of Access Token of Client configured with Client Credential:
{
"Username":"<service principal name>",
"scope":"WINDCHILL_READ",
"active":true,
"token_type":"Bearer",
"exp":1715007926,
"client_id":"clientcredentialqa"
}
"Username":"<service principal name>",
"scope":"WINDCHILL_READ",
"active":true,
"token_type":"Bearer",
"exp":1715007926,
"client_id":"clientcredentialqa"
}
• Example of Access Token of client configured with Authorization Code:
{
"Username":"wcadmin",
"scope":"WINDCHILL_READ",
"active":true,
"token_type":"Bearer",
"exp":1715007926,
"client_id":"common_delegateoauth"
}
#Here username is a user attribute name defined in IDP.
"Username":"wcadmin",
"scope":"WINDCHILL_READ",
"active":true,
"token_type":"Bearer",
"exp":1715007926,
"client_id":"common_delegateoauth"
}
#Here username is a user attribute name defined in IDP.
Client Registration Steps in PingFederate
Follow the steps below in PingFederate for the client registration in CAS(PingFederate):
1. Create new client at > > > . Provide Client ID and Name.
2. Select Client Secret in client Authentication.
3. Generate client secret and copy it to secure location for further use.
4. Set grant type client credential.
5. Set default access token manager to default.
Access Token Request from the Authorized Application
The client web application server will need to exchange the authorization code to obtain an OAuth access token. This is done by making a POST request to the authorization server’s token endpoint. The request body contains the previously obtained authorization code. Note that the request body must have the application/x-www-form-urlencoded content type.
#URI
POST <URL_CAS_SERVER_TOKEN>
#Request Headers
Content-Type: application/x-www-form-urlencoded
#Request Body
grant_type= client_credentials&client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&scope=<scope>
#Example of the URI
POST https://<host>:<port>/as/token.oauth2
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code&client_id=sp1-oauth2-client&client_secret=sp1-oauth2-client_1234&scope= WINDCHILL_READ
#Example of the Response code
{
"scope": "WINDCHILL_READ",
"active": true,
"token_type": "Bearer",
"exp": 1714125449,
"client_id": "wcadmin"
"serviceprincipal": "wcadmin"
}
|
Request Parameter
|
Description
|
|---|---|
|
grant_type
|
The grant type for this flow is client_credentials.
|
|
CLIENT_ID
|
The client ID your generated in your CAS for this web application. See the “Creating OAuth Client Connections for Windchill” topic of PTC Identity and Access Management Help Center.
|
|
CLIENT_SECRET
|
This is the client secret you entered in the CAS when configuring this web application. See the “Creating OAuth Client Connections for Windchill” topic of PTC Identity and Access Management Help Center.
|
|
SCOPE
|
Must be WINDCHILL_READ when accessing Windchill or WRS
|