Question - How to Implement SSO in PTC Windchill using Shibboleth as SP and Okta as IP

[Dan Harp]

Thanks for the suggestions, Peter.

Based on what you mentioned, I changed to this:
Attribute-map.xml
    <Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" id="NameID">
        <AttributeDecoder xsi:type="NameIDAttributeDecoder" caseSensitive="false" attributePrefix="AJP_"/>
    </Attribute>

Shibboleth2.xml
            <SSO entityID="http://www.okta.com/xxx">
                SAML2
            </SSO>

Still having the same issue tho, no change.

I'm looking at the SAML request that comes through when try logging into Okta and this is what it shows:
<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"> <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">dharp</saml2:NameID> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml2:SubjectConfirmationData InResponseTo="_83743c670ac554d3fc4848e119240df3" NotOnOrAfter="2023-11-10T21:12:04.623Z" Recipient="https://<fqdn>/Shibboleth.sso/Artifact/SOAP" /> </saml2:SubjectConfirmation> </saml2:Subject>

So perhaps the attribute-map.xml needs to change to correctly grab that data, but I'm not sure.

Thanks,
Dan Harp  | SYSTEM ADMIN - EDA



This email and any attachments may be confidential and/or legally privileged. It has been sent for the sole use of the intended recipient(s). If the reader of this message is not an intended recipient, you are hereby notified that any unauthorized review, use, disclosure, dissemination, distribution, or copying of this communication or any of its contents is strictly prohibited. If you are not the named recipient, or have otherwise received this communication in error, please delete it from your inbox, notify the sender immediately, and do not disclose the contents to any other person or use them for any purpose, or store them in any medium. Thank you for your cooperation.