{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Choose your login experience","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"choose-your-login-experience","__idx":0},"children":["Choose your login experience"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/apps_and_clients"},"children":["Mosaic application structure"]}," is mapped—Mosaic applications and clients—the next decision is how users log in through each client. During client creation, this is configured in step 3 of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add client"]}," wizard, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," (see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_oidc_client#step-3---login-experience"},"children":["OIDC clients"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_saml_client#step-3---login-experience"},"children":["SAML clients"]},"). After the client is created, you can view and update the same configuration from the client's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," tab."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Note"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page explains the login experience options and what each one implies, so you can choose before configuring a client. It doesn't include configuration steps: to set up a client, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_clients"},"children":["Manage clients"]}," or the guide for your ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/use_cases"},"children":["use case"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configure-the-authentication-flow","__idx":1},"children":["Configure the authentication flow"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Step 2 of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add client"]}," wizard, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication flow"]},", offers two paths (see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_oidc_client#step-2---authentication-flow"},"children":["OIDC clients"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_saml_client#step-2---authentication-flow"},"children":["SAML clients"]},"):"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protocol-based authentication (default)"]},": select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SAML"]}," and configure the settings for that protocol. The wizard then continues to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," in step 3."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Backend-based authentication"]},": your customer-facing application authenticates users through Mosaic APIs or SDKs without an OIDC or SAML login flow. To use this path, turn off ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Does your login use OIDC or SAML authentication?"]},". The wizard skips ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," and continues to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced settings"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]},". The saved client is still an OIDC client."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For OIDC, selecting ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Native app"]}," as the client type doesn't change the remaining wizard flow. It identifies the customer-facing application type and affects relevant validation, such as the accepted redirect URI format."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"login-flow-logic","__idx":2},"children":["Login flow logic"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When OIDC or SAML authentication is enabled, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," sets what runs the authentication:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]},": a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/concepts/journeys_overview"},"children":["journey"]}," runs the login flow—authentication steps, branching, and risk checks. You must select an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_config_service#client-groups"},"children":["SSO client group"]}," and an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSO journey"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application-controlled"]},": your application provides the login screens and controls the authentication sequence through Mosaic APIs or Authentication SDK. No SSO client group or journey is configured in this step."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"login-screens-for-journey-orchestrated-login","__idx":3},"children":["Login screens for journey-orchestrated login"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Choose who hosts the screens when creating or editing the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSO client group"]},". In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add new SSO Client Group"]}," popup, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login screens"]}," offers:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Hosted by Transmit Security"]},": Mosaic hosts the login page and generates its URL for the group. For an OIDC setup using this option, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_quickstart_hosted_ui_oidc"},"children":["Launch OIDC SSO with the Mosaic-hosted experience"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Self managed (Custom UI)"]},": you host the login page and provide its URL."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This setting applies to the group. Each client selects its own ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey"]}," and, for Mosaic-hosted screens, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Style"]}," in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]},". Clients in the same group can use different journeys and styles while sharing the group's session policy. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_config_service#client-groups"},"children":["Configure SSO client groups"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/platform/hosted_ui_styles"},"children":["Manage styles"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"after-creating-the-client","__idx":4},"children":["After creating the client"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The client page includes a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," tab. It shows the same choices as step 3, populated with the flow logic and, for a journey-orchestrated client, the SSO client group and journey selected during creation."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Switch the login flow logic"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["From this tab, you can switch the login flow logic between ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application-controlled"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]}," in either direction. For example, a client created as Application-controlled can move to Journey-orchestrated when journeys are adopted, without creating a new client. Switching to Journey-orchestrated requires selecting an SSO client group and an SSO journey, as during creation."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"where-to-configure-it","__idx":5},"children":["Where to configure it"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the Admin Portal: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > Application > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add client"]},". Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User authentication client"]},". In step 2, leave ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Does your login use OIDC or SAML authentication?"]}," enabled and select OIDC or SAML. In step 3, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]},", select the login flow logic. For ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]},", also select the required SSO client group and journey. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_clients"},"children":["Manage clients"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"whats-next","__idx":6},"children":["What's next?"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/apps_and_clients"},"children":["Plan your integration structure"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_clients"},"children":["Manage clients"]}]}]}]},"headings":[{"value":"Choose your login experience","id":"choose-your-login-experience","depth":1},{"value":"Configure the authentication flow","id":"configure-the-authentication-flow","depth":2},{"value":"Login flow logic","id":"login-flow-logic","depth":2},{"value":"Login screens for journey-orchestrated login","id":"login-screens-for-journey-orchestrated-login","depth":2},{"value":"After creating the client","id":"after-creating-the-client","depth":2},{"value":"Where to configure it","id":"where-to-configure-it","depth":2},{"value":"What's next?","id":"whats-next","depth":2}],"frontmatter":{"title":"Login experience","seo":{"title":"Choose your login experience"}},"lastModified":"2026-10-16T09:43:07.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/login_experience","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}