LLMs.txt directory

Org-scoped IdP connections and login page rendering

This feature is currently in Beta. Some behaviors and UI controls may change before general availability. To enable this feature, contact ThoughtSpot Support.

Org-scoped IdP connections give each Org in your ThoughtSpot cluster its own isolated authentication configuration. When per-org subdomain is enabled, the login page for each org’s subdomain URL renders only the IdP connections that belong to that org. Connections from other orgs have no effect.

See Prerequisites for version requirements, the per-org subdomain dependency, and how these affect login page behavior.

Previously, IdP connections were evaluated cluster-wide at login time. If any org in the cluster had an IdP connection configured, ThoughtSpot’s login page automatically triggered an IdP discovery redirect, regardless of which org the user was trying to reach.

This caused two significant problems:

  • First-time login failures
    Okta and similar IdPs only allow SSO login after a user has previously completed an IdP-initiated flow. New users were redirected into a flow they couldn’t complete, effectively blocking access.

  • Cross-org interference
    Adding an IdP connection in one org could unintentionally change the login experience for another org, even though the two orgs are independent.

Org-scoped IdP connections eliminate both issues.

Prerequisites

Before enabling org-scoped IdP connections, note the following requirements:

  • IAMv2 must be enabled on the cluster.
    Org-scoped IdP connections are supported only on IAMv2-enabled clusters with orgs enabled.

  • Org-scoped IdP connections must be enabled by ThoughtSpot.
    Contact ThoughtSpot Support to enable this feature. When enabled, the Admin portal Authentication page gains a Show all IdP connections on login page toggle and per-connection Set as Default controls.

  • Per-org subdomain is required for org-level login page isolation.

    Without per-org subdomain, org-scoped IdP connections have limited effect: the cluster URL always renders the Primary org’s IdP connections only, regardless of which org the user intends to reach. Non-primary orgs do not get a dedicated login page.

    With per-org subdomain enabled, each org gets a dedicated subdomain URL (for example, https://<org-name>.<cluster-name>.thoughtspot.cloud) that renders only that org’s IdP connections. The shared cluster URL continues to render the Primary org’s IdP connections.

    The org-scoped IdP feature behavior by mode:

    Per-org subdomain Behavior when org-scoped IdP connections are enabled

    Disabled

    Cluster URL renders Primary org (Org 0) IdP connections only. Non-primary orgs do not get a dedicated login page.

    Enabled

    Each org’s subdomain URL renders that org’s IdP connections only. The shared cluster URL renders the Primary org’s IdP connections. Non-primary org connections are never evaluated on the cluster URL.

    Per-org subdomain is available from ThoughtSpot version 26.10 or later on ThoughtSpot Cloud deployments.

    To enable per-org subdomain, open a Salesforce support ticket requesting Per Org Subdomain or contact ThoughtSpot Support. The request requires a DNS update and updated IdP callback URIs for each subdomain.

    For details, see Multiple IdPs with the per Org subdomain configured.

How it works

When org-scoped IdP connections are enabled, the login page is rendered based on the IdP connections configured for the org associated with the URL being accessed. The automatic IdP discovery redirect is disabled as part of this change. ThoughtSpot no longer auto-redirects users based on cluster-wide IdP detection.

IdP connections in the org Login page behavior

None

Standard username and password login

One

That IdP connection is displayed directly on the login page

More than one

Controlled by admin configuration (see Configuring org-scoped IdP connections below). When Show all IdP connections is off and multiple connections exist, Okta’s IdP Discovery widget (the "enter username" prompt) may appear for users on those connections.
When per-org subdomain is enabled, IdP connections from other orgs are never evaluated or rendered on an org’s subdomain login page. When per-org subdomain is disabled, the cluster login page always renders the Primary org’s IdP connections, regardless of which org the user intends to reach.

Configuring org-scoped IdP connections

Contact ThoughtSpot Support to enable org-scoped IdP connections. After enablement, the following controls are available in the Admin portal.

  1. Navigate to Admin settings.

  2. Click Security and select SSO configuration for the org.

    Two controls are available:

    • Show all IdP connections
      Toggle on to display all IdP connections configured for the org on the login page. Toggle off to show only the default connection. When this is off and the org has multiple connections, Okta’s IdP Discovery widget may appear for users on those connections.

    • Default IdP connection
      Select which connection is treated as the default. This is the connection shown when Show all IdP connections is off.

Limitations

  • This feature requires IAMv2 and per-org subdomain to be enabled. Per-org subdomain is available from version 26.10 or later on ThoughtSpot Cloud deployments.

  • UX for multi-connection selection on the login page is subject to refinement before general availability.

  • Validation tooling for detecting misconfigured org IdP setups is not yet available.

  • When per-org subdomain is disabled, non-primary orgs do not get a dedicated login page regardless of their IdP configuration.

Related topics