Secure Access Service Edge:Secure LDAP user access with SASE

Use cases

SASE helps you manage employee access to internal networks and the internet, protect corporate data, and meet your daily business security needs. If you already use LDAP to manage user information, you can connect SASE to your LDAP system. This allows users to log in to the SASE client by using their LDAP accounts. You no longer need to maintain a separate identity management system for SASE, which reduces your user information maintenance costs.

Procedure

Step 1: Connect SASE to LDAP data

Establish a connection between SASE and LDAP data to synchronize the organizational information of security groups from LDAP to SASE.

1. Log on to the SASE console.

2. In the left-side navigation pane, choose Identity Authentication > Identity Access.

3. On the Identity synchronization tab, click Create IdP.

4. In the Create IdP pane, select LDAP, and then click Configure.

5. In the Basic Configurations wizard, configure the parameters in the following table and click Next.

   Parameter	Description	Example
   IdP Name	The name of the identity provider (IdP). The name must be 2 to 100 characters in length and can contain Chinese characters, letters, digits, hyphens (-), and underscores (_).	LDAP-IdP
   Description	The description of the configuration. This description is displayed as the login title on the SASE client to help you identify the identity provider when you log in.	LDAP
   IdP Status	Configure the status for the identity source. The valid values are: Enabled: The identity source is enabled after it is created. Closed: The identity source is disabled after it is created. Important If you disable an identity source, end users cannot use the SASE app to access internal applications. Proceed with caution.	Enabled
   Type	The directory type. Valid values: Microsoft Active Directory: The directory service for Windows. OpenLDAP: An open-source implementation of the Lightweight Directory Access Protocol.	Microsoft Active Directory
   Server Address	The address of the Microsoft Active Directory or LDAP server. You can specify up to five server addresses.	10.10.XX.XX
   Server Port Number	The port number of the Microsoft Active Directory or LDAP server.	389 Note If you do not know the port number, contact your administrator.
   Access Authentication Server from Connector	If the LDAP authentication service is deployed in an internal network, you can use a connector to enable communication. Select a connected connector instance. For information about how to configure a connector, see Use a SASE connector.	Select an existing connector.
   SSL Connection	Specifies whether to enable SSL for the connection to the server. Valid values: Yes: Encrypts data transmission to ensure data security. No: Does not encrypt data transmission.	No
   Base DN	The Base DN for user authentication. After you set this value, SASE authenticates all accounts under this node. Authenticated accounts can log in to the SASE client. The length of this field is 2 to 100 characters. Important If the users and groups to be authenticated are not under the same LDAP node, you must specify the User Base DN and Group Base DN in the Advanced Settings section.	CN=Organizational-Unit,CN=Schema
   Organizational Structure Synchronization	Enter the administrator DN and password to retrieve the organizational structure from the IdP. Important After configuring this feature, you can apply security policies to user groups based on the organizational structure. The system does not read individual user information when you apply security policies.	DN of administrator user1: CN=user1,OU=SecurityGroup,DC=sasetest,DC=com Administrator password: 123456****
   Logon Username Attribute	The attribute used for the logon username. You must define this attribute within your organization to ensure a consistent username format. You can select a default LDAP attribute (such as cn, name, givenName, displayName, userPrincipalName, or sAMAccountName) or enter another custom attribute to use as the Logon Username Attribute. Note The userPrincipalName attribute includes a domain suffix. If you select userPrincipalName as the Logon Username Attribute, users must enter the full name with the domain suffix when they sign in, for example, user***@aliyundoc.com.	cn
   Group Name Attribute	The attribute that is used as the group name. You must define this attribute within your organization to ensure a consistent group name format. You can select a default LDAP attribute (such as cn, name, or sAMAccountName) or enter another custom attribute to use as the Group Name Attribute.	cn
   Group Mapping Attribute	The attribute that defines the user-to-group membership. Default value: memberOf. Note This parameter is optional. If you specify a value, it must match the Group Mapping Attribute configured in your LDAP server.	memberOf
   Group Filter	An LDAP search filter for retrieving specific groups. This filter lets you manage access permissions for different groups. Examples of common LDAP filters: (&(objectClass=organizationalUnit)(objectClass=organization)): Returns all groups where objectClass is both organizationalUnit and organization. (|(objectClass=organizationalUnit)(objectClass=organization)): Returns all groups where objectClass is either organizationalUnit or organization. (!(objectClass=organizationalUnit)): Returns all groups where objectClass is not organizationalUnit. For more information about LDAP filter syntax, see the official LDAP documentation LDAP Filters.	(|(objectClass=organizationalUnit)(objectClass=organization)(objectClass=group))
   User Filter	An LDAP search filter to retrieve specific users or user types. Examples of common LDAP filters: (&(objectClass=person)(objectClass=user)): Returns all enterprise users where objectClass is both person and user. (|(objectClass=person)(objectClass=user)): Returns all enterprise users where objectClass is either person or user. (!(objectClass=person)): Returns all enterprise users where objectClass is not person. For more information about LDAP filter syntax, see the official LDAP documentation LDAP Filters.	(objectClass=person)
   Automatic Synchronization	If you enable Automatic Synchronization, the system automatically synchronizes information from LDAP. If you do not enable Automatic Synchronization, you must manually synchronize the organizational structure. For more information, see View synchronization records.	Enabled
   Synchronize User Information	If you enable Synchronize User Information, the system automatically synchronizes user information from LDAP based on the Automatic Synchronization Cycle. Note If the Automatic Synchronization feature is not enabled, the Synchronize User Information function is not performed.	Enabled
   Automatic Synchronization Cycle	Set the Automatic Synchronization Cycle. You can set the automatic synchronization to occur every 1 to 24 hours.	24 hours

6. In the Synchronization Settings wizard, configure the synchronization scope and field mappings, and then click Next.

   Parameter	Description
   Organizational Structure Synchronization	The scope for synchronizing the organizational structure. Synchronize All: Synchronizes the entire LDAP organizational structure to the SASE system. Partially Synchronize: Allows you to select specific organizational units to synchronize.
   Field Synchronization Mapping	Configure the mapping between LDAP organizational structure fields and SASE synchronization fields. Note If the built-in Local Field After Mapping in the SASE system do not meet your business needs, you can click View Extended Fields in the upper-right corner of the list. You can then add, edit, or delete extended fields in the View Extended Fields panel.

7. In the Logon Settings wizard, configure the logon methods for different devices as described in the following table.

   Parameter	Description
   PC Logon Method	Supports Logon with Account and Password and Password-free Logon. When users use logon with account and password, you can enable Two-factor Authentication. Valid values: OTP-based Authentication: If you enable this option, you must select an OTP Mode. The following modes are supported: Allows the SASE mobile client to display a token: SASE has a built-in OTP, and employees must install the SASE mobile client app. Allow third-party app token: Standard OTP authenticator apps such as the Alibaba Cloud app are supported. Ensure that the clock on the OTP client is synchronized. Allow corporate token: To use a self-developed corporate OTP, complete the configuration with the assistance of technical support. Verification Code-based Authentication: Supports verification codes sent by SMS message or email. Ensure that a mobile number or email address is specified for each user in the IdP. When you use password-free logon, you must first download and log on to the SASE mobile app, and then scan a QR code for authentication.
   Mobile Device Logon Method	Supports Logon with Account and Password and Fingerprint or Face Recognition. When users use logon with account and password, you can enable Two-factor Authentication. Valid values: OTP-based Authentication: Before you enable OTP-based Authentication, you must enable OTP-based authentication for PCs and select Allow Tokens on Third-party Applications or Allow Enterprise-owned Tokens. The token configuration for mobile devices is the same as the configuration for PCs. Verification Code-based Authentication: Before you enable Verification Code-based Authentication, ensure that a mobile number or email address is specified for each user in the IdP. When you use fingerprint or face recognition, you still need to enter your username and password the first time you log in to the SASE App.

8. After completing the configuration, click Logon Test at the bottom of the pane. After the test is successful, click Ok to save the configuration.

   Note

   If your configuration data is incorrect, SASE displays a relevant error message. If the message Failed to connect to the LDAP server. Please contact the administrator. is displayed after you test the connection, you need to check whether the server address and port number are entered correctly and whether the server network is normal.

Step 2: Verify the connection

After you complete the configuration, follow these steps to verify the connection.

1. Open your SASE App.

2. Enter the enterprise verification ID and click OK.

   You can log on to the Secure Access Service Edge console. In the navigation pane on the left, on the Settings page, obtain the Enterprise Authentication Identifier.

3. Enter your username and password and click Log On.

   A successful logon indicates that the connection is established.