How to configure SAML to access the THRON Platform – THRON Guide

Connect your corporate Identity Provider to THRON via SAML 2.0 and enable users to log in using their existing corporate credentials, without managing separate passwords.

Before you begin

Ensure you have the following prerequisites ready:

Corporate Identity Provider compatible with SAML 2.0 (e.g., Microsoft Azure AD, Microsoft ADFS, Okta)
An existing group in THRON to which new users will be automatically assigned upon first login
Admin access to the THRON Marketplace to install and configure the connector
Access to the IdP — configuration requires actions on both systems

Step 1 — Install the SAML connector in THRON

Go to the THRON Marketplace
Search for and install the SAML Connector
Open the connector configuration page — leave the fields empty for now
Retrieve the appId from the configuration page URL:
https://[clientId].thron.com/#/marketplace/management/app/[appId]

Keep the appId handy: you will need it in the next step to construct the URLs provided to your IdP.

Step 2 — Provide THRON parameters to your IdP

In your IdP console, create a new SAML application and configure the following parameters:

IdP Parameter	THRON value to enter
SSO URL / Reply URL / ACS URL	`https://[clientId]-view.thron.com/api/auth/resources/saml/callback/[clientId]/[appId]`
Entity ID / Relying Party Identifier	`https://[clientId].thron.com/[clientId]-[connectorName]`

Also define the attribute names that your IdP will pass to THRON for each user. You will need these in Step 3:

THRON Attribute	Typical name
Username	`username`
Email	`email`
First name	`firstname`
Last name	`lastname`

For provider-specific instructions, consult the official documentation: • Microsoft Azure AD — Configure SAML SSO • Microsoft ADFS — Relying Party Trust

Step 3 — Complete configuration in THRON

Return to the SAML Connector configuration page in the Marketplace and fill in the fields:

Field	What to enter
IdP Metadata URL	The public URL to your IdP's metadata XML file
Service Provider Entity ID	`https://[clientId].thron.com/[clientId]-[connectorName]` (same value used in your IdP in Step 2)
Username Attribute	Attribute name configured in your IdP
Email Attribute	Attribute name configured in your IdP
First Name Attribute	Attribute name configured in your IdP
Last Name Attribute	Attribute name configured in your IdP
Default Entry Group	The THRON group assigned to new users upon first login

Click Save.

If your IdP requires it, download the THRON metadata XML file directly from this configuration page and upload it to your IdP.

Recommended Configuration

Parameter	Suggested value	Rationale
Default Entry Group	Group with read-only permissions	Allows controlled privilege escalation at a later stage
Service Provider Entity ID	`https://[clientId].thron.com/[clientId]-saml`	Standard format, immediately identifiable

Step 4 — Test the login

Go to the THRON login page
Verify that the configured SSO button is present
Enter your corporate credentials and confirm
Upon first login, the user is automatically provisioned in THRON and assigned to the group configured in Step 3

Need help?

For technical issues, contact support@thron.com.

Platform and Settings