Authenticates a member according to the authentication experience configured for their organization, and resolves which organization the session belongs to
This step authenticates a member of a B2B organization. The journey defines the orchestration; the configuration of the member's organization determines how the member authenticates at runtime. You build the journey once, and it serves every organization on the application without being tailored per organization.
Use this step together with Register Member Authenticators to build member invite and login flows. It combines with any other journey step, including Collect Information.
This step runs in SSO journeys, on Mosaic-hosted experiences. It isn't available in SDK-driven journeys.
When triggered, the step:
- Receives the organization email as an input.
- Loads the configuration that applies to the organization.
- Authenticates the member according to the organization's authentication mode:
- Standard: presents the application's sign-in methods, followed by a second factor where the application requires MFA. See Configure B2B application settings.
- Federated: hands the member to the organization's Identity Provider, which replaces the application's sign-in options entirely. A member not yet associated with the organization is created only if just-in-time member creation is enabled; otherwise authentication fails. See Configure org roles & auth.
- Determines whether the member belongs to more than one organization, and presents organization selection where they do.
- Sets the selected organization on the journey context.
Organization selection is presented only after the member has authenticated, so a user's organization membership is never exposed to an unauthenticated caller.
A member who selects a different organization authenticates again according to that organization's configuration. Re-authentication isn't required only when both the originally authenticated organization and the selected organization are in Standard mode.
This step handles organization resolution and selection natively. The Set Organization and Select Organization steps are removed from the step catalog for new journeys.
On success, the authenticated session is carried on the user access token in the journey context, and the selected organization is set on the journey context. The organization data is then available to subsequent steps via @organizations.current() expressions, for example @organizations.current().organization_id or @organizations.current().name.
The step branches on success and failure. Failure is terminal and ends the session. Failures are reported using the platform conventions for authentication and external IdP errors—see Journey errors.
| Field | Description |
|---|---|
| Organization (Email) | The email associated with the organization being targeted. Collect it before this step—for example, using the Collect Information step—and pass it to the step directly. It isn't taken from the journey context. |
| Error Output Variable | Name of the variable that stores any errors returned by the step |
| Failure Behavior | Determines the behavior in case of failure, which either aborts the journey or proceeds to a failure branch of the control flow (default). |
This step can be configured to record step input and output data, or a custom payload, which is then surfaced in journey events in Journey Analytics for diagnostic purposes. For details, see Additional data reporting.
Consider a login journey that serves every organization on your application. A Collect Information step presents a form that collects the member's organization email. In our example, the step ID is loginForm and the schema contains email.
In the Authenticate Member step, the Organization (Email) field is set to the form output, using loginForm.email.
At runtime, members of an organization in Standard mode see the application's sign-in methods, while members of a federated organization are handed to their own Identity Provider. The same journey serves both.