Authenticate a member according to the organization's configured authentication policy
This step authenticates a member using the authentication methods configured for their organization. It runs in the application's login journey, set on the client under Login Experience — see Build the B2B journeys.
Use this step in the login flow. Pair it with Register Member Authenticators to bring members up to date with the Mosaic application's registration requirements. It combines with any other journey step, including Collect Information.
This step presents the authentication screens itself, so the journey has to run on pages hosted by Mosaic. The client must be set to run journeys, and its login screens must be the Mosaic-hosted ones rather than your own.
The step isn't available where the client serves your own login pages, or in SDK-driven journeys. For the client settings this depends on, see Choose the login experience.
When triggered, the step:
- Resolves the organization from Organization (Email or Domain).
- Loads that organization's authentication configuration, and authenticates the member with it:
- Where the organization inherits the application's configuration, presents the application's authentication methods. See Configure B2B authentication settings.
- Where the organization uses federated access, redirects the member to its SAML or OIDC Identity Provider (IdP). See Configure federated access.
- After authentication, prompts members with access to multiple organizations under the application to select one. Switching organizations requires re-authentication with the selected organization's configuration unless both organizations use the application's authentication methods.
- Sets the resolved or selected organization on the journey context.
For federated organizations, this step creates new members after successful IdP authentication only if just-in-time member creation is enabled.
For organizations using the application's methods, member creation must be handled separately. See Add sign-up to the login journey.
On success, the step follows the success branch and the selected organization is set on the journey context. The organization data is then available to subsequent steps via @organizations.current() expressions, for example @organizations.current().organization_id or @organizations.current().name.
On failure, the same error message is shown in the UI whether the member doesn't exist, hasn't registered the selected authentication method, or lacks a required attribute, preventing disclosure of these details.
An authentication error is returned through the step's error output variable, and the step follows the failure branch, and the session ends. Failures use the platform conventions for authentication and external Identity Provider errors—see Journey errors.
| Field | Description |
|---|---|
| Identifier source | Select how the step obtains the member's identifier: The user is not authenticated, perform this step according to the identifier in the following parameter (default): provide the value in the Identifier field (see below). The user is not authenticated, collect the identifier from the user at runtime: the step asks the member to enter the value during authentication, when needed. For federated login, the IdP supplies the identity. |
| Identifier type | Shown for both source options. Select the type of identifier supplied or collected: Email, Username, or Phone number. Not used for passkey authentication. |
| Identifier | Shown when Identifier source is set to The user is not authenticated, perform this step according to the identifier in the following parameter. Enter an AuthScript expression that returns a value matching Identifier type, such as clientData.userEmail for Email. |
| Organization (Email or Domain) | Required. The organization's domain or any email address at that domain. Determines the configuration used for the initial authentication. |
| Error output variable | Name of the variable that stores any errors returned by the step. Defaults to error. |
| Failure behavior | Determines the behavior in case of failure, which either aborts the journey or proceeds to a failure branch of the control flow (default). |
This step can be configured to record step input and output data, or a custom payload, which is then surfaced in journey events in Journey Analytics for diagnostic purposes. For details, see Additional data reporting.
For a configuration example, see Build B2B login journey.