{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Journeys","product":"Identity Management","type":"markdown"},"seo":{"title":"Authenticate Member","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"authenticate-member","__idx":0},"children":["Authenticate Member"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge-wrapper"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge","style":{"backgroundColor":"grey"}},"children":["Only for B2B identity"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge"},"children":["SSO"]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authenticate a member according to the organization's configured authentication policy"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"description","__idx":1},"children":["Description"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This step authenticates a member using the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_b2b#3-configure-b2b-authentication-settings"},"children":["authentication methods"]}," configured for their organization. It runs in the application's login journey, set on the client under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_build_journeys"},"children":["Build the B2B journeys"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this step in the login flow. Pair it with ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/b2b_register_authenticators"},"children":["Register Member Authenticators"]}," to bring members up to date with the Mosaic application's registration requirements. It combines with any other journey step, including ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/get_info_from_client"},"children":["Collect Information"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Requires Mosaic-hosted screens"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This step presents the authentication screens itself, so the journey has to run on pages hosted by Mosaic. The client must be set to run journeys, and its login screens must be the Mosaic-hosted ones rather than your own."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The step isn't available where the client serves your own login pages, or in SDK-driven journeys. For the client settings this depends on, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_app_client#choose-the-login-experience"},"children":["Choose the login experience"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"id":"organization-selection"},"children":[]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When triggered, the step:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Resolves the organization from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization (Email or Domain)"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Loads that organization's authentication configuration, and authenticates the member with it:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Where the organization ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["inherits the application's configuration"]},", presents the application's authentication methods. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_b2b#3-configure-b2b-authentication-settings"},"children":["Configure B2B authentication settings"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Where the organization uses ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["federated access"]},", redirects the member to its SAML or OIDC Identity Provider (IdP). See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_org_authentication#configure-federated-access"},"children":["Configure federated access"]},"."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["After authentication, prompts members with access to multiple organizations under the application to select one. Switching organizations requires re-authentication with the selected organization's configuration unless both organizations use the application's authentication methods."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sets the resolved or selected organization on the journey context."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"id":"member-creation"},"children":[]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Federated organizations - Member creation"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For federated organizations, this step creates new members after successful IdP authentication only if ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_org_authentication#allow-sign-up-of-guest-users"},"children":["just-in-time member creation"]}," is enabled."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For organizations using the application's methods, member creation must be handled separately. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/b2b_tutorial#add-sign-up-to-the-login-journey"},"children":["Add sign-up to the login journey"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"output-and-branches","__idx":2},"children":["Output and branches"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On success, the step follows the success branch and the selected organization is set on the journey context. The organization data is then available to subsequent steps via ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@organizations.current()"]}," expressions, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@organizations.current().organization_id"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@organizations.current().name"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On failure, the same error message is shown in the UI whether the member doesn't exist, hasn't registered the selected authentication method, or lacks a required attribute, preventing disclosure of these details."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An authentication error is returned through the step's error output variable, and the step follows the failure branch, and the session ends. Failures use the platform conventions for authentication and external Identity Provider errors—see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/error_handling_overview"},"children":["Journey errors"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"id":"where-the-member-identifier-comes-from"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configuration","__idx":3},"children":["Configuration"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"table"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifier source"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Select how the step obtains the member's identifier:",{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The user is not authenticated, perform this step according to the identifier in the following parameter"]}," (default): provide the value in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifier"]}," field (see below).",{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The user is not authenticated, collect the identifier from the user at runtime"]},": the step asks the member to enter the value during authentication, when needed. ",{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"br","attributes":{},"children":[]},"For federated login, the IdP supplies the identity."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifier type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Shown for both source options. Select the type of identifier supplied or collected: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Username"]},", or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Phone number"]},". Not used for passkey authentication."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifier"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Shown when ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifier source"]}," is set to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The user is not authenticated, perform this step according to the identifier in the following parameter"]},". Enter an AuthScript expression that returns a value matching ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifier type"]},", such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["clientData.userEmail"]}," for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organization (Email or Domain)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required. The organization's domain or any email address at that domain. Determines the configuration used for the initial authentication."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Error output variable"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Name of the variable that stores any errors returned by the step. Defaults to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Failure behavior"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Determines the behavior in case of failure, which either aborts the journey or proceeds to a failure branch of the control flow (default)."]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Journey event data"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This step can be configured to record step input and output data, or a custom payload, which is then surfaced in journey events in Journey Analytics for diagnostic purposes. For details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/event_reporting"},"children":["Additional data reporting"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example","__idx":4},"children":["Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For a configuration example, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/getting-started/b2b_tutorial#step-3-build-b2b-login-journey"},"children":["Build B2B login journey"]},"."]}]},"headings":[{"value":"Authenticate Member","id":"authenticate-member","depth":1},{"value":"Description","id":"description","depth":2},{"value":"Output and branches","id":"output-and-branches","depth":3},{"value":"Configuration","id":"configuration","depth":2},{"value":"Example","id":"example","depth":2}],"frontmatter":{"markdown":{"toc":{"depth":2}},"seo":{"title":"Authenticate Member"}},"lastModified":"2026-10-21T10:11:50.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/orchestration/journeys/b2b_authenticate_member","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}