{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Journeys","product":"Identity Management","type":"markdown"},"seo":{"title":"Authenticate Member","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com/"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"authenticate-member","__idx":0},"children":["Authenticate Member"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge-wrapper"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge","style":{"backgroundColor":"grey"}},"children":["Only for B2B identity"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge"},"children":["SSO"]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authenticates a member according to the authentication experience configured for their organization, and resolves which organization the session belongs to"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"description","__idx":1},"children":["Description"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This step authenticates a member of a B2B organization. The journey defines the orchestration; the configuration of the member's organization determines how the member authenticates at runtime. You build the journey once, and it serves every organization on the application without being tailored per organization."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this step together with ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/register_member_authenticators"},"children":["Register Member Authenticators"]}," to build member invite and login flows. It combines with any other journey step, including ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/get_info_from_client"},"children":["Collect Information"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"SSO journeys only"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This step runs in SSO journeys, on Mosaic-hosted experiences. It isn't available in SDK-driven journeys."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When triggered, the step:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Receives the organization email as an input."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Loads the configuration that applies to the organization."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authenticates the member according to the organization's authentication mode:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Standard"]},": presents the application's sign-in methods, followed by a second factor where the application requires MFA. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_b2b"},"children":["Configure B2B application settings"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Federated"]},": hands the member to the organization's Identity Provider, which replaces the application's sign-in options entirely. A member not yet associated with the organization is created only if just-in-time member creation is enabled; otherwise authentication fails. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_org_roles_auth"},"children":["Configure org roles & auth"]},"."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Determines whether the member belongs to more than one organization, and presents organization selection where they do."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sets the selected organization on the journey context."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"organization-selection","__idx":2},"children":["Organization selection"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Organization selection is presented only after the member has authenticated, so a user's organization membership is never exposed to an unauthenticated caller."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A member who selects a different organization authenticates again according to that organization's configuration. Re-authentication isn't required only when both the originally authenticated organization and the selected organization are in Standard mode."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Replaces Set Organization and Select Organization"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This step handles organization resolution and selection natively. The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/set_organization_context"},"children":["Set Organization"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/select_organization"},"children":["Select Organization"]}," steps are removed from the step catalog for new journeys."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"output-and-branches","__idx":3},"children":["Output and branches"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On success, the authenticated session is carried on the user access token in the journey context, and the selected organization is set on the journey context. The organization data is then available to subsequent steps via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@organizations.current()"]}," expressions, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@organizations.current().organization_id"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@organizations.current().name"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The step branches on success and failure. Failure is terminal and ends the session. Failures are reported using the platform conventions for authentication and external IdP errors—see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/error_handling_overview"},"children":["Journey errors"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configuration","__idx":4},"children":["Configuration"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"table"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization (Email)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The email associated with the organization being targeted. Collect it before this step—for example, using the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/get_info_from_client"},"children":["Collect Information"]}," step—and pass it to the step directly. It isn't taken from the journey context."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Error Output Variable"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Name of the variable that stores any errors returned by the step"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Failure Behavior"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Determines the behavior in case of failure, which either aborts the journey or proceeds to a failure branch of the control flow (default)."]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Journey event data"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This step can be configured to record step input and output data, or a custom payload, which is then surfaced in journey events in Journey Analytics for diagnostic purposes. For details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/event_reporting"},"children":["Additional data reporting"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example","__idx":5},"children":["Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Consider a login journey that serves every organization on your application. A ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/get_info_from_client"},"children":["Collect Information"]}," step presents a form that collects the member's organization email. In our example, the step ID is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loginForm"]}," and the schema contains ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authenticate Member"]}," step, the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization (Email)"]}," field is set to the form output, using ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loginForm.email"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["At runtime, members of an organization in Standard mode see the application's sign-in methods, while members of a federated organization are handed to their own Identity Provider. The same journey serves both."]}]},"headings":[{"value":"Authenticate Member","id":"authenticate-member","depth":1},{"value":"Description","id":"description","depth":2},{"value":"Organization selection","id":"organization-selection","depth":3},{"value":"Output and branches","id":"output-and-branches","depth":3},{"value":"Configuration","id":"configuration","depth":2},{"value":"Example","id":"example","depth":2}],"frontmatter":{"markdown":{"toc":{"depth":2}},"seo":{"title":"Authenticate Member"}},"lastModified":"2026-09-23T07:35:22.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/orchestration/journeys/authenticate_member","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}