How do I get SAMLRedirect working for cross-domain embedding on an IAMv2 instance? I get a 400 from the Okta layer despite adding my domain to SAML redirect domains. When it does work, the session cookie isn't persisted and I get 401 Setup: - Visual Embed SDK v1.50.1 - AuthType.SAMLRedirect - IAMv2 instance (EU region) - IdP: Microsoft Entra ID - Embedding domain hosted on AWS Amplify (different domain from TS instance) Security Settings configured: - CORS whitelisted domains: my-app-domain (no protocol) - CSP visual embed hosts: https://my-app-domain - SAML redirect domains: my-app-domain (no protocol, no trailing slash) - Partitioned cookies: Enabled Behavior: 1. SDK calls init() with SAMLRedirect 2. Redirects to identity-eu.thoughtspotlogin.cloud → 400 Bad Request 3. On occasion the flow does complete (Microsoft login appears, user authenticates), but after redirect back, /callosum/v1/session/isactive returns 401 — session cookie not set What works from the same domain: - TrustedAuthTokenCookieless auth works perfectly - Direct login to ThoughtSpot via browser works fine Questions: 1. Does the IAMv2 Okta layer need separate configuration to allow SAML from external embed domains? 2. Is SAMLRedirect supported for cross-domain embedding on IAMv2, or is cookieless auth the recommended approach? 3. If the session cookie isn't persisted after successful SAML login (even with partitioned cookies enabled), is there an alternative fix?

message has been deleted

Direct answer: based on the official docs,

AuthType.SAMLRedirect

is supported in the SDK, but ThoughtSpot’s guidance for cross-domain embedding is to prefer cookieless auth when browser cookie restrictions are in play. The docs do not describe any separate IAMv2/Okta-domain allowlist you must configure specifically for external embed domains beyond the normal SAML/IdP setup and ThoughtSpot security settings, so I can’t confirm a special IAMv2-only Okta layer requirement from the docs. For your case, the strongest documented explanation for the intermittent success + later

401

is that

SAMLRedirect

is still a cookie-based flow in the embedded app context, and cross-domain embedding is vulnerable to third-party cookie restrictions even with partitioned cookies enabled. ThoughtSpot explicitly recommends

AuthType.TrustedAuthTokenCookieless

for production cross-domain scenarios and says partitioned cookies are only a mitigation on browsers that support them. Safari does not support them at all, and browser behavior can still vary. Answers 1. Separate IAMv2 Okta-layer config? I couldn’t find anything in the official ThoughtSpot documentation that says IAMv2 requires a separate Okta/identity-layer allowlist for

SAMLRedirect

from external embed domains. What the docs do say is: -

SAMLRedirect

redirects the host application page to the IdP during

init

. - For SAML in embedded scenarios, the IdP must allow the authentication page/flow appropriately, and ThoughtSpot requires the usual security settings such as CORS and CSP visual embed hosts. So from the docs alone, I would treat the

identity-eu.thoughtspotlogin.cloud -> 400

as either: - an IdP / SAML configuration issue, or - a tenant-side IAM configuration issue that is not documented as a self-service embed-domain setting. 2. Is

SAMLRedirect

supported cross-domain on IAMv2?

Question, if I had the web app on a subdomain of my main domain say my domain was corporate-africa.com and had a url on a subdomain such as thoughtspot.corporate-africa.com would SAML Redirect work?