Choose a setup for your use case

Choose the scenario that matches how users should sign in or how a service should access your APIs. Compare the expected behavior and Mosaic setup, then follow the setup guide in the last column.

These examples use a single tenant. In the tables, Mosaic application means the user pool and configuration container in the Admin Portal. Your web apps, mobile apps, and services connect to it through clients.

Set up login for one web or mobile app.

Use case	Expected behavior	Mosaic setup overview	Setup guide
Set up login for a web app with Mosaic-hosted pages	Users are redirected to a Mosaic-hosted login page, then return to your web app after authentication.	One Mosaic application One user authentication client configured for OIDC (Web app, with the web app's redirect URI) or SAML (with the web app's ACS URL and Entity ID) Journey-orchestrated login with an SSO journey and an SSO client group configured for Mosaic-hosted login	Go to use case
Set up backend-based login for a web app	Users sign in within your web app. Your backend authenticates them through the Mosaic backend authentication APIs, without redirecting them to a separate login page.	One Mosaic application One user authentication client configured for backend-based authentication: turn off Does your login use OIDC or SAML authentication? No SSO client group required for this flow	Go to use case
Set up login for a mobile app	Users sign in through a browser redirect or directly within the mobile app, depending on your integration.	One Mosaic application One user authentication client for the mobile app, either redirect-based or in-app For browser redirects: OIDC, Native app, and the mobile app's redirect URI; select an SSO client group and journey for Journey-orchestrated login For in-app authentication: the backend-based API or SDK flow, without an SSO client group	Go to use case

Choose how your apps share user accounts and whether users sign in separately or use SSO.

Use case	Expected behavior	Mosaic setup overview	Setup guide
Share user accounts across web and mobile apps	Users use the same account and credentials on web and mobile. Both apps apply the same authentication policies. The mobile app doesn't share a browser session with the web app.	One Mosaic application with two clients: one for the web app, one for the mobile app Shared Mosaic application-level authentication settings Each client can be redirect-based or backend-based No browser SSO between the two clients: if both are journey-orchestrated, each uses its own SSO client group	Go to use case
Enable SSO between web apps	Users sign in to one web app and can access the other without signing in again while the shared session remains valid.	One Mosaic application One user authentication client per web app, configured for OIDC or SAML One shared SSO client group Journey-orchestrated login on each client, with the shared group and an SSO journey selected	Go to use case
Share user accounts across apps with separate logins	Users use the same account and credentials across apps, but sign in to each app separately.	One Mosaic application containing all clients One user authentication client per app integration For journey-orchestrated login: a separate SSO client group for each app, with an SSO journey selected on each client For backend-based API or SDK login: no SSO client group	Go to use case
Share user accounts with SSO within separate groups of apps	Users use the same account across all apps. Signing in gives them SSO access within one group; other groups require a separate login.	One Mosaic application containing all clients One user authentication client per app integration One SSO client group for each set of apps that should share browser sessions Journey-orchestrated clients select their assigned SSO client group and an SSO journey Mobile clients use their chosen redirect-based or in-app flow; in-app clients do not join browser SSO	Go to use case
Keep user accounts and credentials separate across apps	Users have a separate account and credentials for each app. Signing in to one app does not sign them in to another.	A separate Mosaic application for each isolated user pool; for two apps, create two Mosaic applications Each Mosaic application has its own clients and authentication settings Journey-orchestrated clients select their Mosaic application's SSO client group and an SSO journey	Go to use case

Give a partner service access on behalf of a user or through its own credentials.

Use case	Expected behavior	Mosaic setup overview	Setup guide
Allow a partner service to act on behalf of a user	The partner service accesses resources on behalf of a signed-in user and participates in the same browser SSO session.	One Mosaic application and one SSO client group Every channel modeled as a client: web app, mobile app, and the partner, each with its own user authentication client All clients assigned to the same SSO client group, with journey-orchestrated login	Go to use case
Set up machine-to-machine access for a partner service	The partner service authenticates using its own credentials and calls APIs without a user signing in.	One Mosaic application A redirect-based web client for your web app, in an SSO client group A separate Service client for the partner's M2M integration, with its own authentication method and credentials Client roles granting the required Mosaic API permissions No SSO client group for the service client	Go to use case

• Read Plan your integration structure for the identity and session boundaries behind these setups.
• Read Choose your login experience before configuring a user authentication client.