Assign member roles automatically

When an organization uses a federated identity provider (IdP) for SSO, you can automate member role assignment by mapping IdP groups to Mosaic member roles. During authentication, Mosaic evaluates the groups included in the SAML assertion or OIDC token and assigns the corresponding member roles to the authenticated member.

This eliminates the need to manually assign member roles for each user and keeps role assignments in sync with your IdP's group structure.

Make sure the following are already configured:

• Member roles are defined for the application.
• Role groups are created and assigned to the organization.
• Federated access is configured for the organization using a SAML or OIDC identity provider.

When a member authenticates through a federated SAML or OIDC identity provider:

1. Mosaic extracts the configured groups attribute from the SSO response.
2. The returned group names are matched against the configured group-to-role mappings.
3. All matching Mosaic member roles are assigned to the authenticated member.
4. If no mappings match, the configured default member roles are assigned (if any).
5. The resolved member roles are included in the token automatically.

If no default roles are configured and no mapping matches, no member roles are assigned.

To configure group-to-role mappings:

1. In the Admin Portal, go to B2B Identity > Organizations > [your org] > Applications > [your app] > Authentication methods.
2. Under Federated access, expand Mapping federated IDP groups.
3. Enable the Group role mapping toggle.
4. Optionally, select a Default Mosaic member role to assign when none of the member's federated groups match a configured mapping.
5. In Groups attribute name, specify the attribute that contains the list of group names returned by your IdP (for example, the groups claim in an OIDC token or the equivalent SAML attribute).
6. Under Add your group role mapping, create one or more mappings:
   • Federated IDP group value—the group name returned by the external IdP.
   • Mosaic member role—the member role to assign when the group is present.
7. Click + to add more mappings, if needed.

A single federated IdP group can be mapped to one or more Mosaic member roles. You can add or remove mappings at any time.

The Default Mosaic member role field lets you specify a fallback. This role is assigned when none of the member's federated groups match a configured mapping.

If no default role is configured and no mapping resolves during authentication, no member roles are assigned.