This page is the detail for Setup overview — Step 7: Configure org authentication.
Decide how each organization's members sign in: with the Mosaic application's authentication methods, or through the organization's own Identity Provider.
Every organization on your application signs in one of two ways, and the choice belongs to the organization, not to a single member. By default it inherits the authentication configuration you defined for the application. The alternative is federated access, where the organization delegates sign-in to its own Identity Provider and its members never see your application's login form.
Continuing the holiday booking platform example: Retail travel agency and New York branch inherit the application's configuration, while Back-office / finance partner federates through its own corporate identity system.
In the Admin Portal, go to B2B Identity > Organizations > [your org] > Applications tab > [your app] > Settings > Authentication methods tab. Each organization signs in one of two ways, and they're alternatives, not additions:
- Mosaic authentication methods — the default. The organization inherits the application's authentication configuration and needs no further setup: its members authenticate with the methods defined at application level, exactly as defined there. An organization can't vary that configuration method by method. See Configure B2B authentication settings.
- Federated access — the organization delegates sign-in to its own Identity Provider (IdP). This replaces the application's experience for that organization's members rather than layering on top of it.
You can change this configuration at any time: the change will be immediate.
The organization's own admins can make the same choice from Authentication Methods in the Organization admin portal.
Federated access can only be configured for an organization if it's enabled for the application. Turn on Enable federated access in Applications > your app > B2B settings tab first — see Configure B2B authentication settings.
In the Admin Portal, go to B2B Identity > Organizations > [your org] > Applications tab > [your app] > Settings > Authentication methods tab, then select Federated access. Give the configuration a Federated access name, then choose SAML or OIDC and provide the provider details. Obtain them from your Identity Provider's own documentation.
OIDC provider fields
| Field | Description |
|---|---|
| Identity provider issuer URL | The IdP's issuer URL. |
| Client ID | Client ID of the application registered in the IdP. |
| Client secret | Client secret of that application. |
| Email claim | Name of the ID token claim that carries the member's primary email. Used to identify the member from the IdP's response. |
SAML provider fields
| Field | Description |
|---|---|
| Identity provider entity ID | Uniquely identifies the SAML identity provider. |
| SSO URL | The SAML 2.0 endpoint where members go to sign in to your SSO solution. |
| Public certificates | X.509 certificate containing the public key used to validate the SAML response. Add more than one with + Add certificate. |
| Default Redirect URL | Where members are sent when no redirect URL is provided on SAML start. |
Service provider entity ID and Assertion consumer service (ACS) URL are read-only. Mosaic generates them when you save. Copy them into your Identity Provider.
In the Admin Portal, go to B2B Identity > Organizations > [your org] > Applications tab > [your app] > Settings > Authentication methods tab > Federated access subtab. Under Public sign-up, Allow sign-up of guest users is off by default. This setting overrides the application's public sign-up behavior for this organization. Federated access otherwise requires a member to already be associated with the application and organization, so a user who was never provisioned is refused even after authenticating successfully at the Identity Provider.
- On: a user who authenticates at the IdP but isn't yet associated with the organization or application is created as a member, and authentication continues to completion.
- Off: that user isn't authenticated, and authentication fails with a distinct
ts_errorcode.
Creation happens only after successful IdP authentication. Where external authentication fails, no member is created.
This setting applies to federated access only. It doesn't enable sign-up for the application as a whole — you build any sign-up logic into the journey.
In the Admin Portal, go to B2B Identity > Organizations > [your org] > Applications tab > [your app] > Settings > Authentication methods tab > Federated access subtab and expand Mapping federated IDP groups. Turn on Group role mapping to assign member roles automatically from the groups the Identity Provider returns. Roles resolve at every login, so a role change made at the IdP applies at the member's next sign-in.
For the fields and how resolution works, see Assign member roles automatically.
The decision belongs to the organization. Org admins set it in the Organization admin portal where that portal is in use, and you can make the change on an organization's behalf from that same tab in the Admin Portal.
Every change to an organization's authentication configuration is recorded as an admin activity, attributed to the admin and the organization: federated access being turned on or off, and its configuration being updated. See About Mosaic activity events.