topic Re: Windchill PDM Link SSO solutions in Windchill

Windchill PDM Link SSO solutions

Alex1988 — Thu, 08 May 2025 14:11:14 GMT

We are looking into implementing SSO for our customer.

Initially we wanted to go with the simpler implementation using Shibboleth As SP and Microsoft Entra as IP.

What other solutions would there be with and would be the complexity level of their implementation?

Re: Windchill PDM Link SSO solutions

avillanueva — Thu, 08 May 2025 14:16:16 GMT

What version of Windchill do they have? That might make a difference.

Re: Windchill PDM Link SSO solutions

Jimwang — Mon, 12 May 2025 09:51:57 GMT

Take a look at the article https://www.ptc.com/en/support/article/CS314308

Re: Windchill PDM Link SSO solutions

Alex1988 — Fri, 30 May 2025 07:07:44 GMT

We have Windchill PDM Link 13.0.2.4. At the moment we went with the simple PTC supported solution with Shibboleth and Microsoft Entra.

It seems to work fine during testing. We would need just to manage the Windchill users like wcadmin or other accounts created.

Re: Windchill PDM Link SSO solutions

plmcore — Fri, 30 May 2025 07:22:05 GMT

Hi,

Are you using ProjectLink with external users? How you configured your workers for SSO as TrustedHost is not supported by PTC. If you can give some insight, that will be great

Best Regards

Re: Windchill PDM Link SSO solutions

avillanueva — Fri, 30 May 2025 11:04:19 GMT

CS372501 is no longer customer visible (not sure why) but it described a way to allow Basic login in conjunction with SSO. I tried it and it worked but broke Navigate so I dropped it. I ended up just creating accounts in Microsoft for wcadmin and the others to use SSO. If you use private browsing mode, you can manually login as those accounts.

Re: Windchill PDM Link SSO solutions

Jbailey47Q — Sat, 31 May 2025 15:39:10 GMT

Agreed on this.

Re: Windchill PDM Link SSO solutions

plmcore — Sun, 01 Jun 2025 18:52:37 GMT

Hi,

Project Link users are external users and will join using email id and they don't have any corporate AD entries. So we are not able to configure with corporate AD. As now we are creating them as windchill specific LDAP as local user. So sso will not work for them

Re: Windchill PDM Link SSO solutions

HelesicPetr — Tue, 03 Jun 2025 06:16:00 GMT

Hi @plmcore

It is an apache issue.

In the apache configuration you have to configure the apache to use a basic authentication for the the incoming requests based on some rule.for example server IP ...

PetrH

Re: Windchill PDM Link SSO solutions

plmcore — Tue, 03 Jun 2025 07:12:40 GMT

Hi,

Could you please clarify a little more details.. We have project link external users and they don't have any AD entry. We would like to enable SSO across windchill and thingworx including the worker. We do not want to use basic authentication as it is a risk

Re: Windchill PDM Link SSO solutions

HelesicPetr — Tue, 03 Jun 2025 07:16:15 GMT

I am talking about the basic auth and how to configure it to use parallelly with SSO.

You want to use SSO. so it is different issue.

PetrH

Re: Windchill PDM Link SSO solutions

Alex1988 — Mon, 23 Feb 2026 15:00:37 GMT

We did a simple implementation with Shibboleth and without pingFederate as in scenario 2 using the basic steps from PTC:

Security Assertion Markup Language (SAML) Authentication

Re: Windchill PDM Link SSO solutions

jbailey — Wed, 25 Feb 2026 01:26:03 GMT

If the version of Windchill is 13.0.2 or newer, I would consider OIDC vs SAML if using Entra, especially if they are looking to add OAuth down the road to other tools. If you are using SAML with Entra and need OAuth down the road - you need two Entra entities, one for SAML and one for OAuth. If you use the OIDC apache module (Included 13.0.2.x+) Entra will only need one entity for Windchill. It is a little detail, but minimizes the number of items a customer needs to manage in their Entra IdP. Configuration is straightforward and well documented (I implemented this as a customer before I joined PTC with ease). Additionally, it removes the need to install / maintain / secure additional software (Shibboleth).

Re: Windchill PDM Link SSO solutions

jbailey — Wed, 25 Feb 2026 01:30:31 GMT

Do you use Entra? From my understanding, if you do - You may need to have a federation with the external users' entra.

If you are using a local AD instance with no entra, you would have to have an IdP that does an ID first flow (you may have seen this with google, where you first provide your email so google knows your domain, to send you to your domain to authenticate first). So your local users would be sent to authenticate based on your AD, external users would be sent to an auth source based on some attribute on the user.