Assign member roles automatically

When an organization uses a federated identity provider (IdP) for SSO, you can automate member role assignment by mapping IdP groups to Mosaic member roles. During authentication, Mosaic evaluates the groups included in the SAML assertion or OIDC token and assigns the corresponding member roles to the authenticated member.

This eliminates the need to manually assign member roles for each user and keeps role assignments in sync with your IdP's group structure.

Make sure the following are already configured:

• Member roles are defined for the application.
• Role groups are created and assigned to the organization.
• Federated access is configured for the organization using a SAML or OIDC identity provider.

When a member authenticates through a federated SAML or OIDC identity provider:

1. Mosaic extracts the configured groups attribute from the SSO response.
2. The returned group names are matched against the configured group-to-role mappings.
3. All matching Mosaic member roles are assigned to the authenticated member.
4. If no mappings match, the roles set in Default Mosaic member role are assigned, if any.
5. The resolved member roles are included in the token automatically.

If nothing is set there and no mapping matches, the member gets no member roles.

To configure group-to-role mappings:

1. In the Admin Portal, go to B2B Identity > Organizations > [your org] > Applications tab > [your app] > Settings > Authentication methods tab.
2. In the Federated access subtab, expand Mapping federated IDP groups.
3. Enable the Group role mapping toggle.
4. Optionally, in Default Mosaic member role, select one or more roles to assign when none of the member's federated groups match a configured mapping.
5. In Groups attribute name, specify the attribute that contains the list of group names returned by your IdP (for example, the groups claim in an OIDC token or the equivalent SAML attribute).
6. Under Add your group role mapping, create one or more mappings:
   • Federated IDP group value—the group name returned by the external IdP.
   • Mosaic member role—the member role to assign when the group is present. The list holds every role available to the organization for this application: the member roles it gets from its assigned role groups, and the organization-level roles marked (default), such as Organization admin. You can map an IdP group to either kind.
7. Click + to add more mappings, if needed.

A single federated IdP group can be mapped to one or more Mosaic member roles. You can add or remove mappings at any time.