Question - How to Implement SSO in PTC Windchill using Shibboleth as SP and Okta as IP

[Peter Schober]

Dan Harp via users <users at shibboleth.net> [2023-11-10 18:55 CET]:
> Looking at the shibd.log, I see these errors when there’s a login failure:
> 2023-11-09 14:00:03 WARN OpenSAML.MessageDecoder.SAML2SOAP [2] [default]: ignoring incorrect content type (application/x-www-form-urlencoded)
> 2023-11-09 14:00:03 ERROR Shibboleth.ArtifactResolution.SAML2 [2] [default]: error while processing request: Invalid content type for SOAP message.
[...]
> <SSO entityID="http://www.okta.com/xxx"
> postArtifact="true" template="bindingTemplate.html" outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">

Why should the application care (or mandate) how you configure SSO
with your IDP? That doesn't sound right. The communication with your
IDP needs to be what your SP and IDP agree on, the protected
application shouldn't know of care about any of this.
I.e., I'd try with just <SSO entityID="http://www.okta.com/xxx" />
and see how that changes things.

(That way you're not using the changed bindingTemplate but I haven't
really read through the docs I found[1] to understand whay that
matters.)

-peter

[1] https://support.ptc.com/help/windchill/r12.1.2.0/en/index.html#page/Windchill_Help_Center/WCAdvDeployGuide/WCAdvDepAuth_ConfigSAMLAuth.html