{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Configure org authentication","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"configure-org-authentication","__idx":0},"children":["Configure org authentication"]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page is the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["detail"]}," for ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_setup-overview#step-7-configure-org-authentication"},"children":["Setup overview — Step 7: Configure org authentication"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Decide how each organization's members sign in: with the Mosaic application's authentication methods, or through the organization's own Identity Provider."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"understand-org-authentication","__idx":1},"children":["Understand org authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every organization on your application signs in one of two ways, and the choice belongs to the organization, not to a single member. By default it inherits the authentication configuration you defined for the application. The alternative is federated access, where the organization delegates sign-in to its own Identity Provider and its members never see your application's login form."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Continuing the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_main-concepts"},"children":["holiday booking platform"]}]}," example: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Retail travel agency"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["New York branch"]}," inherit the application's configuration, while ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Back-office / finance partner"]}," federates through its own corporate identity system."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"choose-how-members-sign-in","__idx":2},"children":["Choose how members sign in"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin Portal"]},", go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2B Identity"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organizations"]}," > [your org] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," tab > [your app] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication methods"]}," tab. Each organization signs in one of two ways, and they're alternatives, not additions:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mosaic authentication methods"]}," — the default. The organization inherits the application's authentication configuration and needs no further setup: its members authenticate with the methods defined at application level, exactly as defined there. An organization can't vary that configuration method by method. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_b2b#3-configure-b2b-authentication-settings"},"children":["Configure B2B authentication settings"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Federated access"]}," — the organization delegates sign-in to its own Identity Provider (IdP). This replaces the application's experience for that organization's members rather than layering on top of it."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can change this configuration at any time: the change will be immediate."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The organization's own admins can make the same choice from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication Methods"]}," in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_org_portal#authentication-methods"},"children":["Organization admin portal"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configure-federated-access","__idx":3},"children":["Configure federated access"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Enable federated access first"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Federated access can only be configured for an organization if it's enabled for the application. Turn on ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enable federated access"]}," in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > your app > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2B settings"]}," tab first — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_b2b#3-configure-b2b-authentication-settings"},"children":["Configure B2B authentication settings"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configure-the-identity-provider","__idx":4},"children":["Configure the Identity Provider"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin Portal"]},", go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2B Identity"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organizations"]}," > [your org] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," tab > [your app] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication methods"]}," tab, then select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Federated access"]},". Give the configuration a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Federated access name"]},", then choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SAML"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}," and provide the provider details. Obtain them from your Identity Provider's own documentation."]},{"$$mdtype":"Tag","name":"details","attributes":{},"children":[{"$$mdtype":"Tag","name":"summary","attributes":{},"children":[{"$$mdtype":"Tag","name":"b","attributes":{},"children":["OIDC provider fields"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"table"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity provider issuer URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The IdP's issuer URL."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID of the application registered in the IdP."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client secret"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client secret of that application."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email claim"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Name of the ID token claim that carries the member's primary email. Used to identify the member from the IdP's response."]}]}]}]}]}]}]},{"$$mdtype":"Tag","name":"details","attributes":{},"children":[{"$$mdtype":"Tag","name":"summary","attributes":{},"children":[{"$$mdtype":"Tag","name":"b","attributes":{},"children":["SAML provider fields"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"table"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity provider entity ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Uniquely identifies the SAML identity provider."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSO URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The SAML 2.0 endpoint where members go to sign in to your SSO solution."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Public certificates"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["X.509 certificate containing the public key used to validate the SAML response. Add more than one with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add certificate"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Default Redirect URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Where members are sent when no redirect URL is provided on SAML start."]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service provider entity ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Assertion consumer service (ACS) URL"]}," are read-only. Mosaic generates them when you save. Copy them into your Identity Provider."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"allow-sign-up-of-guest-users","__idx":5},"children":["Allow sign-up of guest users"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin Portal"]},", go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2B Identity"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organizations"]}," > [your org] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," tab > [your app] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication methods"]}," tab > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Federated access"]}," subtab. Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Public sign-up"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Allow sign-up of guest users"]}," is off by default. This setting overrides the application's ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_b2b#step-2-disable-public-sign-up"},"children":["public sign-up"]}," behavior for this organization. Federated access otherwise requires a member to already be associated with the application and organization, so a user who was never provisioned is refused even after authenticating successfully at the Identity Provider."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["On"]},": a user who authenticates at the IdP but isn't yet associated with the organization or application is created as a member, and authentication continues to completion."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Off"]},": that user isn't authenticated, and authentication fails with a distinct ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ts_error"]}," code."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Creation happens only after successful IdP authentication. Where external authentication fails, no member is created."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Not a general sign-up capability"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This setting applies to federated access only. It doesn't enable sign-up for the application as a whole — you build any sign-up logic into the journey."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"map-idp-groups-to-member-roles","__idx":6},"children":["Map IdP groups to member roles"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin Portal"]},", go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2B Identity"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organizations"]}," > [your org] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," tab > [your app] > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication methods"]}," tab > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Federated access"]}," subtab and expand ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mapping federated IDP groups"]},". Turn on ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Group role mapping"]}," to assign member roles automatically from the groups the Identity Provider returns. Roles resolve at every login, so a role change made at the IdP applies at the member's next sign-in."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the fields and how resolution works, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_map_idp_groups_to_roles"},"children":["Assign member roles automatically"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"who-can-change-it","__idx":7},"children":["Who can change it"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The decision belongs to the organization. Org admins set it in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_org_portal"},"children":["Organization admin portal"]}," where that portal is in use, and you can make the change on an organization's behalf from that same tab in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin Portal"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Changes are audited"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every change to an organization's authentication configuration is recorded as an admin activity, attributed to the admin and the organization: federated access being turned on or off, and its configuration being updated. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/platform/activities"},"children":["About Mosaic activity events"]},"."]}]},{"$$mdtype":"Tag","name":"style","attributes":{},"children":["\n    /* Blockquote intro block */\n    [data-component-name=\"Markdown/Markdown\"] blockquote {\n        border-left: 4px solid #BBC5FF !important;\n        border-radius: 2px;\n        background-color: #F1F2FF !important;\n        padding: 20px 10px 15px 10px;\n        margin: 10px 1px;\n    }\n\n"]}]},"headings":[{"value":"Configure org authentication","id":"configure-org-authentication","depth":1},{"value":"Understand org authentication","id":"understand-org-authentication","depth":2},{"value":"Choose how members sign in","id":"choose-how-members-sign-in","depth":2},{"value":"Configure federated access","id":"configure-federated-access","depth":2},{"value":"Configure the Identity Provider","id":"configure-the-identity-provider","depth":3},{"value":"Allow sign-up of guest users","id":"allow-sign-up-of-guest-users","depth":3},{"value":"Map IdP groups to member roles","id":"map-idp-groups-to-member-roles","depth":3},{"value":"Who can change it","id":"who-can-change-it","depth":3}],"frontmatter":{"markdown":{"toc":{"depth":2}},"navigation":{"previousButton":{"text":"Previous:","hide":false,"label":"Configure org roles","link":"/guides/user/b2b/b2b_configure_org_roles_auth"},"nextButton":{"text":"Next:","hide":false,"label":"Set members","link":"/guides/user/b2b/b2b_set_members"}},"seo":{"title":"Configure org authentication"}},"lastModified":"2026-10-21T10:11:50.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/b2b/b2b_org_authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}