Question

IFrame and SSO

0

I'm helping with a Mendix app that needs to display a Teamcenter application inside the app. The goal is to access the target page directly without manual credential entry. To achieve this, we're considering generating a token for Single Sign-On (SSO) with Teamcenter. However, we're unsure how to send this token to Teamcenter via an IFrame. Do you have any suggestions on how to approach this use case, or an alternative method for achieving SSO within the IFrame?

asked 2026-01-28

Luca Muraca

1 answers

Ahmet Kudu · Answer 1 · 2026-02-01

If the Teamcenter side is configured to accept and process a token passed via the URL, the process on the Mendix side can be detailed as follows:

First, you would need a REST integration on the Mendix side. This is typically done with a microflow (for example ACT_GenerateTCToken) that calls the Teamcenter SOA/REST service to request a short-lived SSO token for the currently logged-in user. This step only makes sense if Teamcenter officially supports issuing such tokens for browser-based login.

Next, you construct the Teamcenter URL dynamically by appending the generated token as a URL parameter, for example

https://tc-server/awc/#/?ssoToken=<generatedToken>.

This URL is then stored in an attribute that is used as the source of the iFrame.

After that, use a standard iFrame widget in Mendix and bind its URL to this dynamic attribute. Make sure the microflow runs on page load so the URL is refreshed every time, ensuring a new token and a clean session for each visit.

----------------------------------------------------

There are a few critical checkpoints to verify. Teamcenter must allow being embedded in an iFrame: the server must not return X-Frame-Options: DENY or SAMEORIGIN, and instead must allow your Mendix domain via Content-Security-Policy: frame-ancestors, otherwise the browser will block the page.Because this is a cross-domain iFrame, cookie settings are also important. Teamcenter session cookies must be set to SameSite=None; Secure, and everything must run over HTTPS. Without this, the session will not persist inside the iFrame even if authentication succeeds.