LLMs.txt directory

Before migrating to IAMv2

To set up your ThoughtSpot environment for IAMv2, complete the following procedures before your cluster is migrated. For an overview of IAMv2, see Identity and Access Management (IAMv2).

In keeping with IAM best practices, and due to user workflows for self-serve password resets, email addresses are mandatory for all users on TS cloud clusters for successful IAMv2 migration.

Usernames must not contain whitespace

IAMv2 does not support SSO usernames that contain whitespace characters. When ThoughtSpot migrates your cluster to IAMv2, the internal Okta service validates all user identifiers. If a SSO username contains a space — for example, because the SAML identity provider (IdP) is configured to send a user’s full name instead of their email address — IAMv2 rejects the login with the following error:

Transformed userId contained whitespace: '<username>'

This is a breaking change. SSO usernames that contain spaces work in the legacy IAM system but fail after migration to IAMv2.

Audit all usernames in your ThoughtSpot environment and confirm that no username contains a space. Specifically, SAML SSO users whose IdP attribute mapping sends a display name or full name as the login identifier.

To identify affected users, check the username values in Admin > Users and confirm that every username is in a valid format, such as an email address with no spaces. You can also modify user properties by sending a request to the POST /api/rest/2.0/users/{user_identifier}/update API.

Allowlist URLs

Users will be redirected to these URLs when they sign in.

If these URLs are not allowlisted, users will be unable to access your ThoughtSpot instance after migration to IAMv2.

  1. Update your Network/Firewall approved URL settings allowlist to include the following URLs:

  2. To verify accessibility to these URLs, browse to our validation cluster: validate-iamv2.thoughtspot.cloud.

    The ThoughtSpot Login page appears.

  3. Enter any credentials, which should result in a failure page. If you get this error, then you have access to the necessary URLs.

Related information