SAML SSO authentication
ThoughtSpot supports the Single Sign-On (SSO) authentication method with the Security Assertion Markup Language (SAML) authentication and authorization framework. With SAML SSO, users can authenticate to the SAML identity provider (IdP) at your federation to access the ThoughtSpot application, or the embedded ThoughtSpot content in an external web application. It also allows them to navigate seamlessly between different application interfaces with their existing credentials.
By default, local authentication is enabled. Use this article to learn how to configure a SAML integration with an external IdP. To configure SAML in an embedded environment, refer to SAML SSO authentication.
About SAML authentication
The SAML SSO authentication involves several entities and components.
SAML is an XML standard that allows secure exchange of user authentication and authorization data between trusted partners. It enables the following entities to exchange identity, authentication, and authorization information:
Identity Provider (IdP)
The Identity Management system that maintains the user identity information. IdP acts as a SAML authority and authenticates SSO users. ThoughtSpot supports SAML authentication framework with popular Identity Providers such as Okta, Azure Active Directory, PingFederate, Microsoft AD FS, and Onelogin. This is not an exhaustive list. To determine if ThoughtSpot supports your preferred IdP, talk to your ThoughtSpot contact.
After you complete the SAML configuration in ThoughtSpot that this article describes, refer to your Identity Provider’s SAML documentation for specific information on setting up SAML with that IdP.
Service Provider (SP)
The provider of a business function or application service; for example ThoughtSpot. The SP relies on the IdP to authenticate users before allowing access to its services.
A user whose identity information is managed by the IdP. The federated users have SSO credentials and authenticate to IdP to access various application services.
SAML assertion and attributes
Both SP-initiated and IdP-initiated authentication workflows rely upon assertions that are exchanged between the SAML endpoints through a web browser.
Some of the most commonly used elements are:
The user authentication and authorization information issued by the IdP. SAML assertions contain all the information necessary for a service provider to confirm if the user identity is valid.
Data in the XML format to establish interoperability between the IdP and SP. It contains the URLs of the endpoints, entity ID, and so on.
Assertion Services Consumer (ACS) URL
The endpoint URL to which the user’s browser sends the SAML response received from the IdP after authenticating a user.
A unique service name to identify the client application from which the SSO login request originates.
The attributes associated with the user; for example, username and email address.
Enable SAML authentication
You need admin privileges to enable SAML SSO authentication.
Configure the ThoughtSpot application instance on your IDP server.
Log into your ThoughtSpot application instance.
From the top navigation bar, select the Admin tab.
Select SAML from the side navigation bar that appears.
Click the Configure button in the middle of the screen.
Fill in the following parameters:
- ThoughtSpot Service Address: A fully qualified and resolvable domain name for the ThoughtSpot service. For example, thoughtspot.thoughtspot-customer.com.
- Port: Enter
443in this box. This is the port of the server where your ThoughtSpot instance is running.
- Unique Service Name: The unique key used by your Identity Provider to identify the client. For example, urn:thoughtspot:callosum:saml. You may know this as the Entity ID.
- Skew Time in Seconds: The allowed skew time, after which the authentication response is rejected and sent back from the IDP. 86400 is a popular choice. The default is 3600.
- Protocol: The connection protocol for ThoughtSpot. For example,
IDP Metadata XML File: The absolute path to your Identity Provider’s metadata file. This file is provided by your IDP. You need this file so that the configuration persists over upgrades. It is a best practice to set it up on persistent/HA storage (NAS volumes) or in the same absolute path on all nodes in the cluster. For example, idp-meta.xml. If your IDP needs an Assertion Consumer Service URL to create the metadata file, use
https://<hostname_or_IP>:443/callosum/v1/saml/SSO. Note that this URL is case-sensitive.Note: If your IdP does not allow you to import the IdP metadata XML file, you must map values manually. For the ThoughtSpot system to pick up certain attributes, you must map them to specific fields. Map the username you would like to use to
NameId, map the email id of the user to
- Automatically add SAML users to ThoughtSpot upon first authentication: Choose whether or not to add SAML users to ThoughtSpot when they first authenticate. If you choose ‘yes’, then new users will be automatically created in ThoughtSpot upon first successful SSO login. If you choose ‘no’, then SAML users will not be added in ThoughtSpot upon first successful SSO login. Instead, you must add users manually.
After you fill in all parameters, click OK.
When the configuration is complete, download ThoughtSpot’s metadata file,
spring_saml_metadata.xml. This file contains the public key you need if you want to encrypt your SAML assertions. To download this file, navigate to
https://<hostname-or-IP>/callosum/v1/saml/metadata/. The file automatically downloads.
Configure the IdP
To enable the IdP to recognize your host application and ThoughtSpot as a valid service provider, you must configure the IdP with required attributes and metadata.
ThoughtSpot supports SAML authentication with several identity and access management providers, such as Okta, Azure Active Directory, PingFederate, Microsoft AD FS, Onelogin and so on. If you want to use one of these providers as your IdP, make sure you read the SAML configuration steps described in the Identity provider’s documentation site.
To determine if ThoughtSpot supports your preferred IdP, contact ThoughtSpot support.
Complete your configuration of the IdP using the IdP’s SAML documentation. Upload or copy the contents of the
spring_saml_metadata.xml to your IdP server. This file contains the public key you need if you want to encrypt your SAML assertions. If you did not download the
spring_saml_metadata.xml file, navigate to
https://<your_ThoughtSpot_hostname-or-IP>/callosum/v1/saml/metadata/. The file automatically downloads.
NameIdattribute in OneLogin. Similarly, in Okta, you must map the username to
userPrincipalName. You must also map the email address of the user to the mail attribute, and the display name you would like to use to the correct display name attribute. If your IdP does not allow you to import the IdP metadata XML file, you must map these values manually.