Set up machine-to-machine access for a partner service

Follow the steps below to configure this scenario. The linked guides provide additional field descriptions and implementation details.

Real-life example: Acme Retail runs a web shop where customers sign in through a browser redirect. A CRM partner syncs customer profiles every night: the partner's backend calls the Mosaic user APIs with its own client credentials, and no customer signs in.

Use case: a partner service that calls Mosaic APIs. The partner service authenticates using its own credentials and calls APIs without a user signing in.

Resulting structure: one Mosaic application with two clients: a redirect-based web client for your web app, assigned to an SSO client group, and a separate Service client for the partner's machine-to-machine (M2M) integration. The service client has client roles granting the required Mosaic API permissions and doesn't use an SSO client group.

Have the following ready:

• Your web app's redirect URI (OIDC) or ACS URL and Entity ID (SAML).
• The Mosaic APIs the partner calls and the permissions each one requires. See the API reference.

In the Admin Portal, go to Applications and create a Mosaic application, or open the Mosaic application you already use for your web app. See Create Mosaic applications.

Configure the authentication methods your users will use in the Mosaic application's Authentication methods tab. See Customize login methods.

Add both clients to the same Mosaic application: the partner's client access token authorizes operations within this Mosaic application. Operations across all Mosaic applications of the tenant require a management app; see Management apps.

The web client is journey-orchestrated, so it needs an SSO client group. Every journey-orchestrated client must select an SSO client group, even when no other client shares its session. The service client doesn't use a group.

1. Create the SSO client group. In Applications > Application > Clients > SSO client groups, select + Add SSO client group for the web client, and configure:

   • SSO client group name: a name that identifies the group.
   • Login screens: Hosted by Transmit Security for Mosaic-hosted pages, or Self managed (Custom UI) for a page you host.
   • Login page URL: for self-managed screens, the address of the page you host. For hosted screens, Mosaic generates the URL; to show users a URL on your own domain, enter a custom login page URL. See Configure custom domains.
   • Session timeout: how long the group's session stays valid. Default: 14 days, up to 1 year.

   Save the group. See Configure SSO.

2. Create the SSO journey. In B2C or B2B Identity > Journeys, select Add blank journey and choose SSO-Journey. Build the login flow with the authentication methods configured in Step 1, then save the journey. You can also reuse an existing SSO journey. The Journeys section of Configure SSO explains where SSO journeys are created and how clients select them.

For a step-by-step example using Mosaic-hosted screens and email OTP, follow Create an SSO journey with the Mosaic-hosted experience. Adapt the journey by adding or replacing steps to match your authentication methods and login requirements.

In Applications > Application > Clients, select + Add client, choose User authentication client, and complete the wizard in the tab that matches the web app's protocol.

In Applications > Application > Clients, select + Add client, choose Service client, and complete the wizard:

1. General: enter a name that identifies the partner.
2. Advanced settings:
   • Authentication method: select Client Secret, Private key JWT, mTLS (self-signed), or mTLS (CA-signed), and configure the keys or certificates required by that method. See Service client advanced settings.
   • Token timeout configuration: review the token lifetimes.
3. Client roles: select or create roles that grant only the permissions the partner needs. If you don't select a role, the client implicitly receives the App Admin role, so always select a restricted role for a partner. See Manage client roles.

Save the client and provide the partner with its client ID and the credentials or configuration required by the selected authentication method. See Configure service clients.

Integrate your web app with its own client, using the tab that matches its protocol.

If the SSO client group uses Self managed (Custom UI), build the login page with the Mosaic Platform SDK, which runs the SSO journey, and host it at the group's Login page URL. See Build your SSO page.

Have the partner integrate its service client:

1. The partner obtains a client access token from the token endpoint with the client_credentials grant. See Get client access tokens. For other authentication methods, see Authenticate with private key JWT or Authenticate using mTLS.
2. The partner calls Mosaic APIs with the access token as a Bearer token.

To test login, use a user who belongs to this Mosaic application. Create one from Users > + Add Users, enter an email address, and select this Mosaic application. See Manage users. A login method based on email OTP can sign this user in; for passwords or passkeys, the user must register the credential first.

• Users sign in to the web app through its redirect-based client.
• The partner's client access token includes the ts_roles and ts_permissions claims of the assigned roles.
• Partner requests to APIs covered by the roles succeed. Requests that require other permissions are denied.
• Partner requests involve no user sign-in and no SSO session.