Skip to content

Per Org Subdomain documentation #401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bryanthowell-ts wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Per Org Subdomain documentation #401

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7fc28ab
Update orgs.adoc
bryanthowell-ts Jan 26, 2026
1e146b0
Update embed-authentication.adoc
bryanthowell-ts Jan 26, 2026
6695b03
Update mcp-integration.adoc
bryanthowell-ts Jan 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions modules/ROOT/pages/embed-authentication.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,11 @@ a| Do not use this method if you don’t want the SDK to redirect your entire ap
* This authentication will fail if multifactor authentication (MFA) is enabled on your ThoughtSpot instance. Contact https://community.thoughtspot.com/customers/s/login/?ec=302&startURL=%2Fcustomers%2Fs%2Fcontactsupport[ThoughtSpot Support] for assistance.
|=====

[NOTE]
====
xref:orgs.adoc#per-org-subdomain[Per Org Subdomain] can be enabled to allow Orgs with different IdPs to be identified properly within the authentication flows triggered by the Visual Embed SDK.
====

== User accounts
Many ThoughtSpot features are tied to individual user accounts with a valid email address. xref:just-in-time-provisioning.adoc[Just-In-Time Provisioning] and user management REST APIs make it easy to create and update user accounts as part of the SSO process.

Expand Down
4 changes: 4 additions & 0 deletions modules/ROOT/pages/mcp-integration.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,10 @@ To secure communication between the MCP client and the ThoughtSpot instance, adm
* Client connection configuration: +
MCP Server integration also requires configuration on the client side, typically via a config file, to include the MCP Server addresses, credentials, and other details.

[NOTE]
====
xref:orgs.adoc#per-org-subdomain[Per Org Subdomain] can be enabled to allow Orgs with different IdPs to be identified properly within the authentication flows. Once enabled, use the appropriate URL with the Org subdomain within the MCP Server configuration to ensure all interactions happen within the context of the desired ThoughtSpot Org.
====

=== How it works

Expand Down
17 changes: 17 additions & 0 deletions modules/ROOT/pages/orgs.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,23 @@ The Org ID will be passed in the URL depending on the placement of `{ts-query-pa
* The `overrideOrgId` parameter may not work properly with trusted authentication (`AuthType.TrustedAuthToken`) or cookieless authentication (`AuthType.TrustedAuthTokenCookieless`), if `tokenAuthPerOrg` is already enabled on your ThoughtSpot instance.
====

==== Per Org Subdomain

[earlyAccess eaBackground]#Early Access#

"Per Org Subdomain" can be requested to be enabled via a support ticket. Once this feature is turned on, every Org will automatically have a subdomain generated on the pattern:

<org name>.<cluster name>.thoughtspot.cloud

Per Org Subdomain is used for identifying a specific Org to a login process for users who belongs to multiple Orgs on the same instance, bypassing the Org selection UI. In particular, OIDC flows for MCP Server or instances with multiple IdPs per Org can be benefit from using Per Org Subdomain.

Going to the the specific subdomain for an Org will trigger a redirect to the Org's configured IdP auto-redirect to IdP is configured for the cluster. Auto-redirect to SSO IdP is a separate cluster level config that must be requested via ticket to ThoughtSpot support.

[NOTE]
====
When using Per Org Subdomain, all org names need to be DNS friendly; otherwise, ThoughtSpot will throw errors. You should review your Org names prior to the request and make sure they don't have spaces or other strange characters.
====

== Feature availability on a multi-tenant instance

On an Orgs-enabled cluster, certain UI and API operations are allowed only at the cluster level. The following table lists the features and configuration operations allowed at the cluster or individual Org level.
Expand Down
Loading