OpenID: How to configure access to the THRON Platform – THRON Guide

Connect your corporate Identity Provider to THRON in a few steps and allow your users to log in using their existing corporate credentials.

Before you begin

Ensure you have these elements ready:

Corporate Identity Provider based on OpenID Connect (e.g. Microsoft Azure AD, Okta, Google Workspace)
Three credentials from the IdP: OpenID URL, Client ID, Secret Key
An existing group in THRON to which new users will be automatically assigned upon their first login
Admin access to THRON PLATFORM with permissions to access Platform Settings → Single Sign On → OpenID
Single Sign On enabled on your tenant: OpenID is a non-standard option, not active by default. If you do not find it in the platform, contact your THRON dedicated account to enable it

Note: The OpenID connector assigns each user to a single group upon entry. You can add users to other groups later to refine their permissions.

Step 1 - Retrieve credentials from your IdP

The connector requires three values provided by your Identity Provider: OpenID URL, Client ID, and Secret Key. Where to find them depends on the provider in use: check your IdP documentation in the section dedicated to registering an OAuth 2.0 / OpenID Connect application.

THRON Field	Most common equivalent name in the IdP
OpenID URL	Discovery URL or Issuer URL
Client ID	Client ID
Secret Key	Client Secret

Step 2 - Configure the connector in THRON

Open THRON PLATFORM and click the settings icon next to the profile icon in the top right corner
Select Platform Settings
In the side menu, under Single Sign On, click on OpenID
Verify that the connector is enabled (status shown at the top of the section)
Fill in the required fields:

Field	What to enter
OpenID URL	Your provider URL (e.g. `https://login.microsoftonline.com/<tenantId>`)
Client ID	The client ID of the application registered in the IdP
Secret Key	The secret key generated in the IdP
IdP Parameters (Username, Email, First Name, Last Name)	The exact name of the claims returned by your IdP for each field, so THRON can correctly map user data upon first login
Login button name	The label visible to users (e.g. `Login with Company SSO`)
Default entry group	The THRON group new users will be assigned to upon first login

Click Save - the new SSO button will appear on the THRON login page.

Recommended configuration

Parameter	Suggested value	Why
Button name	`Login with [Company Name]`	Clear and recognizable for users
Entry group	Group with read-only permissions	Allows expanding permissions in a controlled manner later

Step 3 - Test login

Go to the THRON PLATFORM login page
Click the new SSO button (e.g. Login with Company SSO)
A popup will open with your IdP authentication form
Enter corporate credentials and confirm
The popup closes and the user accesses THRON PLATFORM directly

Upon first login, the user is automatically created in THRON and assigned to the group configured in Step 2.

Limitations

User removal is not automatic - removing a user from the IdP is not automatically reflected in THRON. Manual intervention or a dedicated integration is required.
No role/group mapping from IdP - roles and permissions configured in the IdP are not transferred to THRON. Permission management is handled entirely within THRON.
"Remember me" managed by IdP - persistent session behavior depends on the provider, not on THRON.
Independent THRON session - the THRON session is not synchronized with the IdP session; verification occurs only when the THRON session expires.
IdP logout without callback - logging out from the IdP does not automatically terminate the THRON session.
Available filters - the only supported user filters are username and externalId; filtering by other fields such as displayName is not supported.

## In-depth articles
- Configure Users and Groups

Need help?

For technical issues, write to support@thron.com.

Platform and Settings