Complete solution addressing all three focus areas:
SSO Integration with Viewer:
The embedded viewer must be configured to participate in SSO authentication flow. Update visualization service configuration:
In pvz.properties:
wt.visualization.service.auth.sso.enabled=true
wt.visualization.service.auth.mode=SSO
Ensure viewer service shares the same SSO realm as main Windchill application. The viewer authentication endpoint must accept SAML assertions from your SSO provider.
CORS Configuration:
Configure CORS headers to allow viewer iframe authentication. This requires changes at multiple layers:
Apache Configuration (httpd.conf):
Header set Access-Control-Allow-Origin "https://windchill.company.com"
Header set Access-Control-Allow-Credentials "true"
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Windchill web.xml CORS Filter:
<filter>
<filter-name>CORSFilter</filter-name>
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
<init-param>
<param-name>cors.allowed.origins</param-name>
<param-value>https://windchill.company.com</param-value>
</init-param>
</filter>
Map this filter to viewer servlet paths in web.xml.
Trusted Sites Setup:
Browser configuration is critical for SSO with embedded content:
Internet Explorer Settings:
- Add https://windchill.company.com to Trusted Sites
- In Trusted Sites zone security settings:
- Enable “Access data sources across domains”
- Set “Logon” to “Automatic logon with current user name and password”
- Allow cookies from both first-party and third-party sources
Chrome/Edge Configuration:
Modern browsers require additional settings:
- Ensure all URLs use HTTPS (mixed content blocked)
- Configure SameSite cookie attributes
- Add site to browser’s trusted sites list via Group Policy
Complete Resolution Steps:
- SSO Cookie Configuration:
Update web.xml session cookie settings:
<session-config>
<cookie-config>
<secure>true</secure>
<http-only>false</http-only>
<same-site>None</same-site>
</cookie-config>
</session-config>
The SameSite=None with Secure=true allows cross-origin authentication in iframes.
2. **Viewer Service Authentication:**
Configure viewer to use parent window credentials:
- Enable credential delegation in pvz.properties
- Set viewer session timeout to match SSO timeout
- Configure viewer to accept Authorization header from parent
3. **HTTPS Enforcement:**
Ensure entire stack uses HTTPS:
- Main Windchill application: HTTPS only
- Visualization service: HTTPS only
- Apache front-end: HTTPS with valid SSL certificate
Mixed HTTP/HTTPS will cause authentication loops
4. **Browser Group Policy (for enterprise deployment):**
Push browser settings via GPO:
- Add Windchill to trusted sites automatically
- Configure security zone settings
- Enable cross-origin authentication
- Allow third-party cookies for specific domains
5. **Testing and Validation:**
Test with different scenarios:
- SSO user opening secure CAD file
- Check browser console for CORS errors
- Verify cookies are sent with viewer requests
- Test in different browsers (IE, Chrome, Edge)
- Validate with both public and secure files
**Troubleshooting Tips:**
- Enable detailed logging: log4j.logger.wt.visualization=DEBUG
- Use browser dev tools Network tab to inspect authentication requests
- Check if Authorization header is present in viewer requests
- Verify SAML assertion is passed to viewer service
- Monitor Apache access logs for CORS preflight OPTIONS requests
**Security Considerations:**
While opening CORS and cookie policies:
- Restrict Access-Control-Allow-Origin to specific domains (not wildcard *)
- Use HTTPS everywhere to protect credentials in transit
- Set appropriate session timeouts on viewer service
- Regularly review and update SSL certificates
- Monitor for unusual authentication patterns
After implementing these changes, restart Apache and Windchill application servers. SSO users should be able to open secure CAD files in the embedded viewer without authentication loops. The viewer will seamlessly use the parent window's SSO session for authentication.
---
*This draft is based on general Windchill knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.*