External IDP

External IDP connectors let you integrate your existing identity providers with Mosaic via journeys. They are primarily used in Just-In-Time (JIT) migration scenarios, where users are authenticated against your existing IDP and provisioned in Mosaic as they log in. Social providers (Google, Meta, Apple) can also be used to enable social login in your journeys.

Mosaic provides pre-built connectors for the following identity providers. Available authentication methods vary by provider and are exposed as journey steps.

To add an external IDP connector:

1. In the Admin Portal, navigate to Integration Hub > External IDP.
2. Select your identity provider.
3. Enable connector.
4. Enter a name for the connector.
5. Enable the authentication methods you want to use.
6. Complete the connector fields:

7. Click Test to verify the connection.
8. Click Save.

Mosaic supports OIDC and password authentication against Auth0.

• OIDC: Add the redirect URI from your application's client settings to the Allowed Callback URLs in your Auth0 application.
• Password: Enable the Password grant type in Advanced Settings > Grant Types. Also set the Default Directory to Username-Password-Authentication in Settings > API Authorization Settings—without this, the password grant fails.

Mosaic supports OIDC, password, and OTP (email and SMS) authentication against AWS Cognito.

In your Cognito app client settings, enable the authentication flows for the methods you plan to use:

• OIDC: Enable Authorization code grant in Hosted UI settings. Add the redirect URI from your application's client settings to the Allowed callback URLs.
• Password: Enable ALLOW_USER_PASSWORD_AUTH.
• OTP: Enable ALLOW_USER_AUTH. In the user pool's sign-in settings, also enable email or SMS OTP under Options for choice-based sign-in.

If you use OTP, ensure MFA is set to Optional or No MFA—setting it to Required is incompatible with OTP as a first-factor authentication method.

Mosaic supports OIDC, password, and TOTP authentication against Okta.

In Okta, create a Native application (ROPC requires the Native type, not Web). Enable the grant types for the methods you plan to use:

• OIDC: Enable the Authorization Code grant type. Add the redirect URI from your application's client settings as a sign-in redirect URI.
• Password: Enable the Resource Owner Password grant type (under Advanced > Other grants).
• TOTP: Enable the Interaction Code grant type (under Advanced > Other grants) and turn on Embedded widget sign-in support in Settings > Account.

For each method, ensure the Authorization Server access policy (Security > API > Authorization Servers) includes the corresponding grant type. Configure the Authentication policy assigned to the application to allow Password factor for password and OIDC, or Possession factor for TOTP.

Mosaic supports OIDC and password authentication against Microsoft Entra ID.

In Azure Portal, create an App registration under Microsoft Entra ID.

• OIDC: Configure redirect URIs under Authentication > Platform configurations. Add the redirect URI from your application's client settings.
• Password: Enable Allow public client flows under Authentication > Advanced settings. This is required for the ROPC flow—without it, password authentication fails. Note that MFA must not be enforced for users authenticating via ROPC, as the flow cannot handle interactive MFA challenges.

Create a client secret under Certificates & secrets and note the Tenant ID and Client ID from the application overview.

Mosaic supports OIDC, password, and TOTP authentication against Keycloak.

Create a confidential client in your Keycloak realm with Client authentication enabled. Configure the authentication flows for the methods you plan to use:

• OIDC: Enable Standard flow. Add the redirect URI from your application's client settings to the Valid redirect URIs.
• Password: Enable Direct access grants.
• TOTP: Create a custom Direct Grant authentication flow containing Username Validation and OTP executions (both Required), and bind it as the Direct grant flow. Users must have a TOTP authenticator enrolled before they can use this method.

Mosaic supports OIDC and password authentication against OneLogin.

Create an OpenID Connect application in your OneLogin admin console. Add the redirect URI from your application's client settings to the application's Redirect URIs.

Set the Token Endpoint Authentication Method in the application's SSO settings based on the methods you plan to use:

• OIDC: Set to Basic.
• Password: Set to POST.

These settings conflict—only one can be active per application. If you need both OIDC and password authentication, create two separate OneLogin applications and configure one connector for each.

Ensure users are assigned to the application.

Mosaic supports OIDC and password authentication against Ping Identity (PingOne).

Create an OIDC application in your PingOne environment.

• OIDC: Add the redirect URI from your application's client settings to the application's redirect URIs.
• Password: Enable the Resource Owner Password Credentials grant type for the application.

Mosaic supports OIDC authentication with Google, enabling Sign in with Google in your journeys.

In the Google Cloud Console, create an OAuth 2.0 client (type: Web application). Add the redirect URI from your application's client settings to the Authorized redirect URIs.

Mosaic supports OIDC authentication with Meta, enabling social login with Facebook accounts in your journeys.

In Meta for Developers, create an app and configure the Facebook Login product. Add the redirect URI from your application's client settings to the Valid OAuth Redirect URIs.

Mosaic supports OIDC authentication with Apple, enabling Sign in with Apple in your journeys.

In the Apple Developer portal, create a Services ID for Sign in with Apple. Add the redirect URI from your application's client settings to the Return URLs. You also need a private key to generate the client secret.

Once configured, use the connector in your migration journey. See Set up JIT migration for a step-by-step guide.