This process has two phases:

Configuring Ping Federate at the Identity Provider (IdP) for Windchill
Configuring the Syndeia Windchill Microservice for OAuth2 Device Code Grant

Table of Contents

minLevel	1
maxLevel	6
outline	false
type	list
printable	false

Introduction

...

Introduction

PTC recommends that client applications communicate with PTC Windchill via its REST API, the Windchill REST Services (WRS). WRS supports both Basic Authentication with Windchill username and password and OAuth2 using a variety of Grant flows. This is especially true if Windchill is configured for SSO with SAML2 using Ping Federate IdP. Refer to the following link for using WRS with OAuthhttps://support.ptc.com/help/windchill_rest_services/r2.2/en/index.html#page/windchill_rest_services/r2.2/en/index.html#page/windchill_rest_services/oauth_for_wrs.html.

This document is a high-level overview for configuring PTC Windchill for delegated OAuth with Ping Federate such that applications can use WRS .

...

- it is not a substitute for PTC literature.

Table of Contents

minLevel	2
maxLevel	6
outline	false
style	default
type	list
printable	false

...

Part 1 - Install and Configure Ping Federate as the IdP for Windchill

docker compose up a PingFederate instance - which is available at Docker Hub
set the Server Base URL in PingFederate to be the intended corporate-internal FQDN for the PingFederate service
Create an IdP Adapter in PingFederate
Create an LDAP Data Source in PingFederate
Create an OAuth Client App in PingFederate, named “rs_client”
1. See Solution Guide: Adding a new OAuth2 Client
Configure the OAuth Token Manager for the rs_client OAuth Client App
1. See Creating PingFederate OAuth Clients for PTC Products
Configure an OAuth Setting Scope Management Scope of “WINDCHILL” in PingFederate
Configure Access Token Mappings
Configure IdP Adapter Grant Mapping
Before doing anything more, use Postman (or equivalent REST client or cURL) to verify that it can request and receive OAuth tokens after doing user MFA Authorization-Code Grant flow with the new (or existing) PingFederate OAuth client.

Part 2 -

...

Configure Windchill and Ping Federate for Windchill OAuth

See the Explanation of PTC’s Windchill Authentication Architecture, below.

See Configure OAuth Delegated Authorization in Tomcat Windchill
1. Be advised that PTC formally states that all authentication choices are “customer optional” and are not formally supported.
  - This is complex and beyond the scope of Syndeia - however if your team is at a loss of adequate SMEs, our team has done this several times and we can advise your available staff - we do not recommend leaving this complex task to generalists.
The two files that you will edit on your Windchill server are
1. <Windchill>\codebase\WEB-INF\security\config\securityContext.properties
2. <Windchill>\codebase\WEB-INF\web.xml

Expand

title	An Explanation of PTC's Windchill Authentication Architecture

“Windchill” is beyond a simple PLM, it is a technology stack consisting of Identity Management, Token Management, Single-sign on Session Management, Database Management, Organization Management, and, behind all that, Product Management.

Windchill delegates Oauth2 authentication for a subset of its API routes to Apache HTTPd, Tomcat Servlet Engine, Ping Federate, LDAP, and a Tomcat Spring Bean.

It is the Tomcat Spring Bean which is responsible for receiving an incoming HTTP Request from Apache HTTPd via AJP and Tomcat that has an HTTP Authorization Bearer token and for then performing the token introspection with the Ping Federate service to determine if the token is valid and to extract the effective Windchill user identity from the token before forwarding that HTTP Request on into the Windchill application.

PTC delivers their technology stack as a complex and complicated collection of template deployments, property files, XML configuration files, and Ant scripts.

During installation of the Windchill stack, the installing administrator executes several ant scripts to weave configuration properties into the template files to yield the eventual effective configuration files which inform the running HTTPd and Tomcat services.

A Tomcat servlet ecosystem consists of a web server (like Apache HTTPd) and one or more Tomcat “engines” (or instances) each of which may have multiple “hosts” where each “host” runs multiple “contexts”. Each “context” can be configured to offer service from multiple servlet contexts.

(Modern microservices developers can think of a “servlet context” as a “microservice” - except for the difference that modern microservices are supposed to be more pure in limiting their scope than was the practice for servlets.)

The Windchill PDMLink application is a Tomcat servlet context that is found in <WINDCHILL_DRIVE>/Windchill/codebase/WEB-INF.

The servlet filter in this servlet context that is responsible to receive an Oauth2-token-bearing HTTP Request, to extract the token, to verify the token with the Token Server (PingFederate), to extract the effective Windchill user id, and to forward the request into Windchill is found in the security folder of this WEB-INF directory. There is a securityContext.xml file and a securityContext.properties file.

Because PTC does not assume that all its customers will offer OAuth2 access for their Windchill APIs, the servlet’s Context’s configuration file, web.xml, does not include the necessary filter, filter-mapping, servlet, and servlet-mapping elements.

Installation involves adding the necessary property strings to the securityContext.properties file and then adding the missing XML fragments to the web.xml file in the right locations to assure that incoming HTTP requests flow through the right filter chains and are routed to the right servlets by the right servlet-mapping elements.

PTC documentation states how to configure the Windchill servlet context for OAuth2 authentication. (The advice above merely explains which Tomcat configuration to modify and is intended to explain why the modifications are made).

Part 3 -

...

Configure Windchill OAuth Client in Ping Federate for Device Code Auth Grant Flow

Assuming that Windchill already has Ping Federate as its IdP:

...

We can advise your cybersecurity staff in understanding the necessities here.

Part 4 -

...

Configure Syndeia Cloud Windchill Service

Configure the Syndeia Cloud windchill-impl application
1. Alter its conf/application.conf according to the expansion region below this list
  1. Code Block
    cd /opt/icx/syndeia-cloud-current && sudo vi application.conf
Restart the Syndeia Windchill microservice
1. sudo systemctl restart sc-windchillNote that it is web-gateway that offers the frontend code, you must also redeploy that service but the prep-step (0) above accomplishes that
Restart the Syndeia Web Gateway microservice
1. sudo systemctl restart sc-webgateway

Contact Intercax.com/help if your team needs assistance in editing any configuration files for specific microservices

Expand

title	Application.conf Properties for a Windchill OAuth2 IdP

Code Block

# This section is used to provide OAuth configurations for Windchill repositories integrated with this Syndeia deployment
# It is possible to add OAuth configuration for more than one Windchill repository,
# for example, the section below contains OAuth configuration for two Windchill repositories - "http://wc11.example.com/Windchill" and "http://wc12.example.com/Windchill"
# The repository url of the Windchill repository, enclosed in double quotes (""), acts as the key of the OAuth configuration for that Windchill repository
# for example, "http://wc11.example.com/Windchill" is the key of one of the two OAuth configurations provided in the below section
external.auth.oauth {
  # windchill repository url
  "http://wc11.example.com/Windchill" {
    # device code endpoint configured in IdP
    deviceCodeEndpoint = "https://my.idp.example.com:9031/as/device_authz.oauth2"

    # token endpoint configured in IdP
    tokenEndpoint = "https://my.idp.example.com:9031/as/token.oauth2"

    # an identifier for Syndeia configured in IdP
    client_id = "example_client_id"

    # client secret for Syndeia configured in IdP
    client_secret = "example_client_secret"

    # scope of the access to Windchill server to be requested by Syndeia
    scope = "EXAMPLE_SCOPE"
  }
  "http://wc12.example.com/Windchill" {
    # device code endpoint configured in IdP
    # deviceCodeEndpoint = "https://my.another.idp.example.com:9031/as/device_authz.oauth2"
    deviceCodeEndpoint = "https://ping-federate.intercax.com:9031/as/device_authz.oauth2"

    # token endpoint configured in IdP
    # tokenEndpoint = "https://my.another.idp.example.com:9031/as/token.oauth2"
    tokenEndpoint = "https://ping-federate.intercax.com:9031/as/token.oauth2"

    # an identifier for Syndeia configured in IdP
    # client_id = "example_client_id"
    client_id = "rs_client"

    # client secret for Syndeia configured in IdP
    # client_secret = "example_client_secret"
    client_secret = "SJfj4TrHgG7pGPkpODzavnf6TiuPp6DGSTQTotGR8kyZV06QgOoCmjr99TvrTFkT"

    # scope of the access to Windchill server to be requested by Syndeia
    # scope = "EXAMPLE_SCOPE"
    scope = "WINDCHILL"
  }
  # add oAuth configuration for more windchill repositories here ...
}

(0) Receive the deliverables, deploy the deliverables to containerization platforms, assess routine operation - before attempting to exercise new capabilities.

...

(If necessary) Install and Configure an instance of PingFederate as the IdP for Windchill

docker compose up a PingFederate instance - which is available at Docker Hub
set the Server Base URL in PingFederate to be the intended corporate-internal FQDN for the PingFederate service
Create an IdP Adapter in PingFederate
Create an LDAP Data Source in PingFederate
Create an OAuth Client App in PingFederate, named “rs_client”
1. See Solution Guide: Adding a new OAuth2 Client
Configure the OAuth Token Manager for the rs_client OAuth Client App
1. See Creating PingFederate OAuth Clients for PTC Products
Configure an OAuth Setting Scope Management Scope of “WINDCHILL” in PingFederate
Configure Access Token Mappings
Configure IdP Adapter Grant Mapping
Before doing anything more, use Postman to verify that it can request and receive OAuth tokens after doing user MFA Authorization-Code Grant flow with the new (or existing) PingFederate OAuth client.

...

(If necessary) Configuring Windchill and Ping Federate for Windchill OAuth

See the Explanation of PTC’s Windchill Authentication Architecture, below
See Configure OAuth Delegated Authorization in Tomcat Windchill
1. Be advised that PTC formally states that all authentication choices are “customer optional” and are not formally supported.
  1. This is complex and beyond the scope of Syndeia - however if your team is at a loss of adequate SMEs, our team has done this several times and we can advise your available staff - we do not recommend leaving this complex task to generalists.
The two files that you will edit on your Windchill server are
1. <Windchill>\codebase\WEB-INF\security\config\securityContext.properties
2. <Windchill>\codebase\WEB-INF\web.xml

...

Assuming that Windchill already has Ping Federate as its IdP:

Configure the “Oauth Client” in Ping Federate for Windchill with the additional “OAuth / Device Code Auth Grant Flow”
1. The least necessary change is just “ALLOWED GRANT TYPE :: Device Authorization Grant (YES)”
2. See the “Allowed Grant Types” figure below
However, IF Lockheed has not yet configured Windchill for OAuth (with PingFederate)
1. Then Lockheed should have their Windchill Team configure their Windchill service for delegated access control through PingFederate (See Step 2)

Configure the Syndeia Cloud windchill-impl application

Alter its conf/application.conf according to the expansion region below this list

Code Block

language	bash

cd /opt/icx/syndeia-cloud-current && sudo vi application.conf

...

Restart the Syndeia Windchill microservice

sudo systemctl restart sc-windchill
Note that it is web-gateway that offers the frontend code, you must also redeploy that service but the prep-step (0) above accomplishes that
Contact Intercax.com/help if your team needs assistance in editing configuration files for specific microservices

Expand

title	Application.conf Properties for a Windchill OAuth2 IdP

Code Block

# This section is used to provide OAuth configurations for Windchill repositories integrated with this Syndeia deployment
# It is possible to add OAuth configuration for more than one Windchill repository,
# for example, the section below contains OAuth configuration for two Windchill repositories - "http://wc11.example.com/Windchill" and "http://wc12.example.com/Windchill"
# The repository url of the Windchill repository, enclosed in double quotes (""), acts as the key of the OAuth configuration for that Windchill repository
# for example, "http://wc11.example.com/Windchill" is the key of one of the two OAuth configurations provided in the below section
external.auth.oauth {
  # windchill repository url
  "http://wc11.example.com/Windchill" {
    # device code endpoint configured in IdP
    deviceCodeEndpoint = "https://my.idp.example.com:9031/as/device_authz.oauth2"

    # token endpoint configured in IdP
    tokenEndpoint = "https://my.idp.example.com:9031/as/token.oauth2"

    # an identifier for Syndeia configured in IdP
    client_id = "example_client_id"

    # client secret for Syndeia configured in IdP
    client_secret = "example_client_secret"

    # scope of the access to Windchill server to be requested by Syndeia
    scope = "EXAMPLE_SCOPE"
  }
  "http://wc12.example.com/Windchill" {
    # device code endpoint configured in IdP
    # deviceCodeEndpoint = "https://my.another.idp.example.com:9031/as/device_authz.oauth2"
    deviceCodeEndpoint = "https://ping-federate.intercax.com:9031/as/device_authz.oauth2"

    # token endpoint configured in IdP
    # tokenEndpoint = "https://my.another.idp.example.com:9031/as/token.oauth2"
    tokenEndpoint = "https://ping-federate.intercax.com:9031/as/token.oauth2"

    # an identifier for Syndeia configured in IdP
    # client_id = "example_client_id"
    client_id = "rs_client"

    # client secret for Syndeia configured in IdP
    # client_secret = "example_client_secret"
    client_secret = "SJfj4TrHgG7pGPkpODzavnf6TiuPp6DGSTQTotGR8kyZV06QgOoCmjr99TvrTFkT"

    # scope of the access to Windchill server to be requested by Syndeia
    # scope = "EXAMPLE_SCOPE"
    scope = "WINDCHILL"
  }
  # add oAuth configuration for more windchill repositories here ...
}

Expand

title	An Explanation of PTC's Windchill Authentication Architecture