Question - How to Implement SSO in PTC Windchill using Shibboleth as SP and Okta as IP

[Peter Schober]

Dan Harp <Dan.Harp at daktronics.com> [2023-11-13 16:11 CET]:
> Based on what you mentioned, I changed to this:
> Attribute-map.xml
>     <Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" id="NameID">
>         <AttributeDecoder xsi:type="NameIDAttributeDecoder" caseSensitive="false" attributePrefix="AJP_"/>
>     </Attribute>

Well, I wrote (and The Fine Documentation of course mentions) this instead:

> FWIW, that documentation doesn't mention that you'd have to add
> attributePrefix="AJP_" to your ApplicationDefaults if you want the
> attributes to cross over to Tomcat.

I.e., the attributePrefix XML attribute needs to go into the
ApplicationDefaults XML element of your shibboleth2.xml configuration
file.

> Shibboleth2.xml
>             <SSO entityID="http://www.okta.com/xxx">
>                 SAML2
>             </SSO>
> 
> Still having the same issue tho, no change.

Really? So you're still getting those same errors you posted about?

> 2023-11-09 14:00:03 WARN OpenSAML.MessageDecoder.SAML2SOAP [2] [default]: ignoring incorrect content type (application/x-www-form-urlencoded)
> 2023-11-09 14:00:03 ERROR Shibboleth.ArtifactResolution.SAML2 [2] [default]: error while processing request: Invalid content type for SOAP message.

That would surprise me.

If you're no longer getting those errors I'd like to know just exactly
what issue you're referring to.
(Your SSO integration with PTC Windchill -- whatever that may be --
not yet working is generally something this community help you
with. But we can help you identify and fix issues in your Shib SP
configuration.)

> I'm looking at the SAML request that comes through when try logging
> into Okta and this is what it shows:
> [...]
> So perhaps the attribute-map.xml needs to change to correctly grab
> that data, but I'm not sure.

That's not a SAML Request (but part of a SAML Response) but other than
that I think your attribute map should be able to extract the NameID
from there. What does your transaction.log (mapped attributes) and
shibd.log ("skipping" attributes not mapped) show?

-peter