TeamcenterKnowledge

SSO Setup

SSO Setup: SSL/TLS on Teamcenter 2606

Teamcenter has no direct OIDC support. Its SSO path runs through Teamcenter Security Services (TcSS) in federation mode, and the TcSS install guide states Teamcenter must be configured with both SSL and SSO before installation. SSL was the half nobody had done. This pillar records how it was done, on the local Hyper-V demo tier (guest SIEMENSDC), and how it was proven.

Status: EXERCISED 2026-08-15. Every claim on these pages came back from a tool call against the live tier. Where something was reasoned rather than run, it says so.

What changed, in one table

Surface Before After
Active Workspace http://192.168.222.100:3000 https://siemensdc/ (443)
Deployment Center http://siemensdc:8070/deploymentcenter/ https://siemensdc:8070/deploymentcenter/
Teamcenter web tier (Jetty) http://SIEMENSDC:8080/tc unchanged, still plaintext (see below)

Both changes are swaps, not additions. Plain HTTP no longer exists on either surface, and that is not a configuration preference in either case: it is how the two products behave.

  • The Active Workspace gateway binds one port and serves it as HTTP or HTTPS, never both.
  • Deployment Center, per its own guide, "refuses all HTTP connections" once HTTPS is enabled.

The starting state, measured

There was no HTTPS listener on the guest at all. Ports 443 and 8443 were absent. Port 3000 was the Node gateway in plaintext, port 8080 the Java web tier, port 8070 Deployment Center.

Read these in order

  1. The local certificate authority: why an existing CA was reused rather than minting a new one, and what the server certificate actually carries.
  2. Certificate trust, client and server side: the part that costs the most time, because a JVM does not read the Windows certificate store and nothing warns you.
  3. Active Workspace over TLS: the web tier touches, and why Active Workspace here is a Node gateway rather than Tomcat.
  4. Deployment Center over TLS: a different stack (Jetty 12) needing a keystore rather than a PEM pair, plus a properties trap that silently does nothing.
  5. Every file created, and why: the full inventory, including backups and how to reverse each change.
  6. Proving it works: the controls. A success alone cannot tell "trusted" from "validation silently disabled".

What this does NOT establish

Stated plainly, because a caveat presented as fact is worse than an open question:

  • Nobody has watched the TcSS gate bind. SSL was delivered because the install guide documents it as a prerequisite, not because anyone has seen the TcSS installer or the OIDC flow refuse to run without it.
  • The Teamcenter web tier on 8080 is still plaintext. It was assessed, not changed. See Active Workspace over TLS.
  • No full Deployment Center deploy cycle has been run over TLS. The UI and the REST layer are proven; a complete deployment is not.