<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m trying to implement SSO in our PTC Windchill environment using Shibboleth as the Service Provider and our Identity Provider is Okta.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Has anyone successfully implemented SSO in Windchill using Shibboleth and Okta before? If so, is there an example I could go off of?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been able to get Shibboleth to call out to okta I try logging into Windchill, but once I log into Okta, I get this error message:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-ligatures:none"><faultcode>S:Server</faultcode><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-ligatures:none"><faultstring>Error processing request.</faultstring><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking at the shibd.log, I see these errors when there’s a login failure:<br>
2023-11-09 14:00:03 WARN OpenSAML.MessageDecoder.SAML2SOAP [2] [default]: ignoring incorrect content type (application/x-www-form-urlencoded)<o:p></o:p></p>
<p class="MsoNormal">2023-11-09 14:00:03 ERROR Shibboleth.ArtifactResolution.SAML2 [2] [default]: error while processing request: Invalid content type for SOAP message.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been working with our Okta admin on this, and we believe the issue is somewhere in the Shibboleth configs.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looks like its not even getting the login info to Windchill (which needs its own configuration for SSO but that’s another story) but if I can get the Shibboleth configs correct, I can figure out the Windchill stuff.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here’s the configs I’ve added into shibboleth from out of the box: (removed some data for security reasons)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Attribute-map.xml:<br>
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" id="NameID"><o:p></o:p></p>
<p class="MsoNormal"><AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$Name" defaultQualifiers="true"/><o:p></o:p></p>
<p class="MsoNormal"></Attribute><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Shibboleth2.xml:<o:p></o:p></p>
<p class="MsoNormal"><ApplicationDefaults entityID="<a href="https://%3cfqdn%3e/Shibboleth.sso/Metadata">https://<fqdn>/Shibboleth.sso/Metadata</a>"<o:p></o:p></p>
<p class="MsoNormal">REMOTE_USER="NameID" sessionHook="/Windchill/sso/shibboleth/sessionHook" cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<o:p></o:p></p>
<p class="MsoNormal">checkAddress="false" handlerSSL="true" cookieProps="https"<o:p></o:p></p>
<p class="MsoNormal">consistentAddress="false" ><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><SSO entityID="<a href="http://www.okta.com/xxx">http://www.okta.com/xxx</a>"
<o:p></o:p></p>
<p class="MsoNormal">postArtifact="true" template="bindingTemplate.html" outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<o:p></o:p></p>
<p class="MsoNormal">discoveryProtocol="SAMLDS" discoveryURL="<a href="https://ds.example.org/DS/WAYF">https://ds.example.org/DS/WAYF</a>"><o:p></o:p></p>
<p class="MsoNormal">SAML2<o:p></o:p></p>
<p class="MsoNormal"></SSO><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><MetadataProvider type="XML" validate="true" url="<a href="https://okta.xxx/sso/saml/metadata">https://okta.xxx/sso/saml/metadata</a>" maxRefreshDelay="7200"<o:p></o:p></p>
<p class="MsoNormal">backingFilePath="idp-metadata.xml"><o:p></o:p></p>
<p class="MsoNormal"></MetadataProvider><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The only other configs I’ve made to shibboleth are the bindingTemplate.html, which I pulled directly from PTC’s document on this (which could also be wrong but I’ve only been able to find one example which I’m using).
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any suggestions/examples would be appreciated<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<br>
Dan<o:p></o:p></p>
</div>
<br>
This email and any attachments may be confidential and/or legally privileged. It has been sent for the sole use of the intended recipient(s). If the reader of this message is not an intended recipient, you are hereby notified that any unauthorized review, use,
disclosure, dissemination, distribution, or copying of this communication or any of its contents is strictly prohibited. If you are not the named recipient, or have otherwise received this communication in error, please delete it from your inbox, notify the
sender immediately, and do not disclose the contents to any other person or use them for any purpose, or store them in any medium. Thank you for your cooperation.
</body>
</html>