Once the Mosaic application structure is mapped—Mosaic applications and clients—the next decision is how users log in through each client. During client creation, this is configured in step 3 of the + Add client wizard, Login Experience (see OIDC clients and SAML clients). After the client is created, you can view and update the same configuration from the client's Login Experience tab.
This page explains the login experience options and what each one implies, so you can choose before configuring a client. It doesn't include configuration steps: to set up a client, see Manage clients or the guide for your use case.
Step 2 of the + Add client wizard, Authentication flow, offers two paths (see OIDC clients and SAML clients):
- Protocol-based authentication (default): select OIDC or SAML and configure the settings for that protocol. The wizard then continues to Login Experience in step 3.
- Backend-based authentication: your customer-facing application authenticates users through Mosaic APIs or SDKs without an OIDC or SAML login flow. To use this path, turn off Does your login use OIDC or SAML authentication?. The wizard skips Login Experience and continues to Advanced settings and Client roles. The saved client is still an OIDC client.
For OIDC, selecting Native app as the client type doesn't change the remaining wizard flow. It identifies the customer-facing application type and affects relevant validation, such as the accepted redirect URI format.
When OIDC or SAML authentication is enabled, Login Experience sets what runs the authentication:
- Journey-orchestrated: a journey runs the login flow—authentication steps, branching, and risk checks. You must select an SSO client group and an SSO journey.
- Application-controlled: your application provides the login screens and controls the authentication sequence through Mosaic APIs or Authentication SDK. No SSO client group or journey is configured in this step.
Choose who hosts the screens when creating or editing the SSO client group. In the Add new SSO Client Group popup, Login screens offers:
- Hosted by Transmit Security: Mosaic hosts the login page and generates its URL for the group. For an OIDC setup using this option, see Launch OIDC SSO with the Mosaic-hosted experience.
- Self managed (Custom UI): you host the login page and provide its URL.
This setting applies to the group. Each client selects its own Journey and, for Mosaic-hosted screens, Style in Login Experience. Clients in the same group can use different journeys and styles while sharing the group's session policy. See Configure SSO client groups and Manage styles.
The client page includes a Login Experience tab. It shows the same choices as step 3, populated with the flow logic and, for a journey-orchestrated client, the SSO client group and journey selected during creation.
From this tab, you can switch the login flow logic between Application-controlled and Journey-orchestrated in either direction. For example, a client created as Application-controlled can move to Journey-orchestrated when journeys are adopted, without creating a new client. Switching to Journey-orchestrated requires selecting an SSO client group and an SSO journey, as during creation.
In the Admin Portal: Applications > Application > Clients > + Add client. Select User authentication client. In step 2, leave Does your login use OIDC or SAML authentication? enabled and select OIDC or SAML. In step 3, Login Experience, select the login flow logic. For Journey-orchestrated, also select the required SSO client group and journey. See Manage clients.