Moloco Commerce Media (MCM) Campaign Manager provides enterprise-grade authentication and security through Single Sign-On (SSO) and Multi-Factor Authentication (MFA). These features can be used independently or together to meet your organization's security requirements.

Overview

MCM supports three authentication channels depending on your Campaign Manager deployment:

Key principle: SSO and MFA operate on separate axes. Platforms using SSO can also enable MFA for non-SSO users within the same platform. SSO users rely on their Identity Provider's MFA; Moloco's native MFA applies only to users authenticating through Moloco Auth.

Single Sign-On (SSO)

What It Is

SSO enables Platform users to log in to the Standalone Campaign Manager using their organization's Identity Provider (IdP), rather than managing separate Moloco credentials. This aligns user lifecycle management with your existing IT infrastructure.

Supported Identity Providers

MCM supports SAML 2.0-based SSO with the following IdPs:

• Okta
• Microsoft Entra ID (formerly Azure AD)
• OneLogin

Other SAML 2.0-compliant IdPs may also work, provided they support SHA-256 signing and the emailAddress NameID format. Contact your Moloco representative to validate compatibility.

How It Works

MCM uses a Service Provider-initiated (SP-initiated) SSO flow:

1. User navigates to the Campaign Manager login page.
2. User enters their email address.
3. If the email domain is configured for SSO, the user is redirected to their corporate IdP.
4. After successful authentication at the IdP, the user is redirected back to the Campaign Manager with a SAML assertion.
5. MCM validates the assertion and grants access.

For non-SSO email domains, the standard email/password login form is displayed.

⚠️

Important!

Only SP-initiated login is supported. IdP-initiated login is not supported. We recommend hiding the MCM application from end-user app portals within your IdP to avoid confusion.

Scope and Behavior

• Platform-level users only. SSO applies to Platform-role users. Advertiser and Agency users continue to use Moloco Auth (email/password).
• All-or-nothing per Platform. When SSO is enabled, all Platform-role users must authenticate via SSO. Mixed authentication (some Platform users via SSO, others via password) is not supported.
• Multiple IdPs per Platform. Organizations with subsidiary properties can configure multiple IdP entries. For example, users with both @company.com and @subsidiary.com email domains can use SSO on the same Platform.
• Invitation required. SSO authentication does not auto-provision users. Users must be explicitly invited by a Platform Owner before they can log in via SSO.
• Authorization remains internal. User roles and permissions are managed within the Campaign Manager, not derived from IdP or SAML attributes.

📘

Note

It is possible to remove access from a user either by removing their account from Campaign Manager or by removing them from the IdP list.

SSO Configuration

SSO is configured per Platform through the admin settings in the Standalone Campaign Manager.

STEP 1: Configure Your Identity Provider

Create a SAML 2.0 application in your IdP using the following settings:

⚠️

Common misconfiguration:

Leaving the Name ID format as "Unspecified" (the default in some IdPs) or setting the Application Username to something other than Email will cause SSO login failures because the SAML response will not contain the user's email in the expected format.

See the IdP-specific setup instructions section below for detailed steps.

STEP 2 : Provide SAML Metadata to MOLOCO

Once your IdP is configured, you must share the SAML Metadata with your Moloco representative to finalize the integration.

IdP-Specific Setup Instructions

📘

Okta

1. In the Okta Admin Console, create a new SAML 2.0 integration.

2. Set "Visible in portal" to No (IdP-initiated login is not supported).

3. Configure the SAML settings:

• Single sign-on URL (ACS): https://<your-platform-domain>/saml/consume

• Audience URI (SP Entity ID): https://<your-platform-domain>

• Name ID format: Select EmailAddress (do not leave as "Unspecified").

• Application username: Select Email.

4. Navigate to the Sign On tab and copy the Metadata URL to provide during configuration.

🚧

Microsoft Entra ID (formerly Azure AD)

1. Go to Enterprise Applications > + New application > Create your own application. Choose "Integrate any other application you don't find in the gallery."

2. Under Single sign-on, select SAML.

3. Configure the Basic SAML Configuration:

• Identifier (Entity ID): https://<your-platform-domain>

• Reply URL (Assertion Consumer Service URL): https://<your-platform-domain>/saml/consume

4. Under Attributes & Claims, add a claim with the NameID format set to emailAddress and the source attribute set to user.mail.
5. Set "Visible to users" to No.
6. Under SAML Certificates, copy the App Federation Metadata URL.

🔢

OneLogin

1. In OneLogin, search for and add the SAML Custom Connector (Advanced) application.
2. Set "Visible in portal" to No.
3. Configure:

• Audience (Entity ID): https://<your-platform-domain>
• Recipient / ACS URL: https://<your-platform-domain>/saml/consume

4. Go to More Actions and download the SAML Metadata (XML) file.

Switching Authentication Methods

SSO configuration is mutable - you can switch between Moloco Auth and SSO, or update your IdP at any time:

📘

Disabling SSO

• SSO can only be disabled by Moloco internal staff. To revert your platform to email and password authentication, please contact your Moloco representative.
• Users from previously SSO-enabled domains will fall back to password-based login. Users who do not have a Moloco password set can use the "Reset Password" flow to create one. Users from previously SSO-enabled domains will fall back to password-based login. Users who do not have a Moloco password set can use the "Reset Password" flow to create one.

Impact on Tools and Integrations

Multi-Factor Authentication (MFA)

What It Is

MFA adds an additional verification step to the login process for users authenticating via Moloco Auth. MCM uses time-based one-time password (TOTP) MFA, compatible with standard authenticator apps.

Supported Authenticator Apps

Any TOTP-compatible authenticator app (RFC 6238), including:

• Google Authenticator
• Authy
• Duo Mobile
• Microsoft Authenticator
• 1Password, Bitwarden, and other password managers with TOTP support

MFA Modes

Platform Owners can configure MFA in one of three modes:

How to Enable MFA

Navigate to Admin > Authentication Settings and select the desired MFA mode (Off, Optional, or Enforced).

Enrollment

Enforced Mode

1. User enters their email and password.
2. If the user has not yet enrolled in MFA, they are prompted to set up their authenticator app.
3. User scans a QR code or manually enters a secret key in their authenticator app.
4. User enters the 6-digit TOTP code to confirm enrollment.
5. Recovery codes are displayed for the user to save securely.
6. User gains access to the Campaign Manager.

Optional Mode

1. User logs in normally with email and password.
2. User navigates to Settings > MFA Configuration.
3. User follows the same QR code / secret key setup flow.
4. User can toggle MFA on or off, or delete their MFA configuration at any time.

Login (After Enrollment)

1. User enters their email and password.
2. User is prompted for a 6-digit TOTP code from their authenticator app.
3. On successful verification, the user gains access.

Trusted Devices ("Remember This Device")

To reduce login friction, MFA supports a "Remember this device" feature, configurable from Developer > Authentication Settings of Campaign Manager:

• After successful MFA verification, users can mark the current device as trusted.
• Trusted devices skip the MFA challenge on subsequent logins.
• Platform Owners can enable or disable the trusted device feature and set the trust duration (14 or 30 days).
• Users can manage up to 5 trusted devices and revoke them at any time from Settings (If the limit is exceeded, the oldest trusted device is automatically removed)
• Trusted devices are automatically revoked when a user enrolls a new authenticator.

Recovery and Reset

Error Handling and Lockout

• After 5 consecutive failed TOTP attempts, the user is locked out for 15 minutes.
• A message is displayed: "Too many failed attempts. Please try again later or reset MFA."
• A link to the MFA reset flow is provided.

Switching MFA Modes

MFA Scope and Exclusions

MFA is not enforced for the following scenarios:

📘

Note for SSO Platform Owners:

Even though SSO users do not use Moloco's MFA, Platform Owners who are SSO-authenticated can still see and manage the MFA configuration in Admin > Authentication Settings to control the experience for non-SSO users on their platform.

Using SSO and MFA Together

Platforms can adopt both SSO and MFA simultaneously for a hybrid security posture:

• Platform-role users authenticate via SSO. Their MFA is governed by the corporate IdP's policies (e.g., Okta MFA, Microsoft Entra Conditional Access).
• Advertiser and Agency users on the same Platform authenticate via Moloco Auth. They can be required to use Moloco's TOTP-based MFA (via Enforced mode) or given the option (via Optional mode).

This hybrid setup ensures that all users - regardless of authentication method - have a multi-factor authentication option available to them.

Best Practices

For SSO

For MFA

For API Keys and Secrets

1. Use a secure storage solution (e.g., AWS Secrets Manager, Azure Key Vault, Google Cloud Secret Manager) to store API keys and SSO secrets.
2. Follow the principle of least privilege when granting access to keys and secrets.
3. Do not store unencrypted secrets in source control or embed them in client-side code.
4. Regularly rotate API keys and revoke any that are no longer in use or may be compromised.

Frequently Asked Questions

1. Can a Platform use both SSO and Moloco Auth for Platform-level users?

No. When SSO is enabled for a Platform, all Platform-role users must log in via SSO. Mixed authentication for Platform-level users is not supported.

2. Does enabling SSO affect Advertiser users?

No. Advertiser and Agency users continue to use Moloco Auth (email/password), with optional MFA.

3. Is MFA compatible with SSO?

Yes. SSO users rely on their IdP's MFA. Non-SSO users on the same Platform can use Moloco's TOTP-based MFA. The two systems do not conflict.

4. What happens if a user loses access to their authenticator app?

Users can log in using a recovery code received during MFA enrollment. They can also initiate a self-service MFA reset from the login screen, or request their Platform Owner to reset their MFA from the Admin panel.

5. Can Platforms change their MFA configuration at any time?

Yes. Platform Owners can toggle between Off, Optional, and Enforced at any time via Admin > Authentication Settings. Switching between Optional and Enforced preserves existing enrollments.

6. Does MFA affect API access?

No. API access uses API keys and is not subject to MFA.

7. What happens to SSO users' access if SSO is disabled?

Users fall back to password-based login. Users who never set a Moloco password will need to use the "Forgot Password" flow to create one.

8. Can I use an IdP other than Okta, Microsoft Entra, or OneLogin?

Potentially yes. Any SAML 2.0-compliant IdP that supports SHA-256 signing and the emailAddress NameID format should work. Contact your Moloco representative to validate compatibility.

9. Does enabling SSO affect the Bulk Operations Tool or MCM CLI?

Yes. Accounts under SSO-enforced email domains cannot use email/password authentication for these tools. Use API keys or a non-SSO account instead.

10. Does this apply to the Widgetized Campaign Manager?

No. The Widgetized Campaign Manager uses its own SSO URL mechanism (HMAC-SHA256 signed URLs) managed by the Platform. The SAML SSO and MFA features described in this guide apply to the Standalone Campaign Manager only. See the Widgetized Campaign Manager documentation for details on its authentication model.