All Products
Search

This Product

    Secure Access Service Edge:Integrate SASE with the new version of IDaaS

    Document Center

    Secure Access Service Edge:Integrate SASE with the new version of IDaaS

    Last Updated:Jul 17, 2026

    Connect SASE (Secure Access Service Edge) to Identity as a Service (IDaaS) so that enterprise users can sign in to the SASE client with their IDaaS accounts. You can then centrally manage user access in SASE and secure your corporate data.

    Use cases

    SASE manages employee access to internal networks and the internet to protect corporate data. If you already use IDaaS to manage your organizational structure and user information, you can connect SASE with IDaaS so that users can sign in to the SASE client with their IDaaS accounts. This eliminates the need for a separate SASE identity management system and reduces maintenance costs.

    Prerequisites

    • You have activated SASE and installed the SASE client. For more information, see Billing overview of SASE.

    • You have activated EIAM and created a new-version instance. For more information, see Create an instance for free.

    • You have added an Alibaba Cloud SASE application to your new-version EIAM instance. For more information, see Create an application.

      When you create the Alibaba Cloud SASE application, IDaaS enables single sign-on (SSO) by default, sets the application account to the IDaaS account name, sets the authorization scope to manual authorization, and automatically generates a SAML metadata file. You can modify these settings.

      If you need SASE to retrieve the list of corporate department structures from IDaaS to apply security policies in batches based on the department structure, you must configure the general configuration, account synchronization, and API access information for the Alibaba Cloud SASE application in the Application Identity Management console. For more information, see Basic Configuration, Account Synchronization - Event Callback, and Enable API Access for the Application.

      When you configure API access, you must grant the Query Account Information and Query Organization Information permissions. Otherwise, SASE cannot retrieve your organizational structure.

      Note

      On the SASE console, obtain the URL for Receiving Synchronization Requests from the panel for adding an IDaaS IdP. You need this address to configure account synchronization.

    After completing the prerequisites, save the following information:

    • SAML Metadata File: Automatically generated by IDaaS when you create the Alibaba Cloud SASE application (on the single sign-on tab).

    • Instance ID: The ID of the new-version EIAM instance that you created.

    • Application ID: The ID of the Alibaba Cloud SASE application that you added to the new-version EIAM instance.

    • client_id (API authentication ID): Automatically generated by IDaaS when you create the Alibaba Cloud SASE application (on the General Configuration tab).

    • client_secret (API authentication secret): Automatically generated by IDaaS when you create the Alibaba Cloud SASE application (on the General Configuration tab).

    • Public Key Endpoint: Automatically generated by IDaaS when you create the Alibaba Cloud SASE application (on the Account Synchronization tab).

    • Encryption/Decryption Key: Automatically generated by IDaaS when you create the Alibaba Cloud SASE application (on the Account Synchronization tab).

    Step 1: Establish a connection between SASE and IDaaS

    Create an IDaaS identity provider (IdP) to connect SASE to IDaaS.

    1. Sign in to the SASE console. In the left-side navigation pane, choose Identity Authentication > Identity Access.

    2. On the Identity synchronization tab, click Create IdP.

    3. In the Create IdP panel, select IDaaS, and then click Configure.

    4. In the Basic Configurations wizard, set the following parameters. Then click OK.

      Parameter

      Description

      Example

      IdP Name

      A unique name for the IDaaS IdP.

      The name must be 2 to 100 characters in length and can contain Chinese characters, letters, digits, hyphens (-), and underscores (_).

      IDaaS_test

      Description

      A description for the IdP.

      This description appears as the sign-in title on the SASE client.

      IDaaS IdP Sign-in

      IdP Status

      Configure the status for the identity source. The valid values are:

      • Enabled: The identity source is enabled after it is created.

      • Closed: The identity source is disabled after it is created.

        Important

        If you disable an identity source, end users cannot use the SASE app to access internal applications. Proceed with caution.

      Enabled

      IDaaS Version

      The IDaaS version to use.

      New Version

      Regional Instance

      The region of the instance.

      China or International

      SAML Metadata File

      Upload the SAML metadata file.

      None

      Grant Read Permissions on Organizational Structure

      Specifies whether SASE can read the organizational structure from IDaaS.

      • Yes: Enter the Alibaba Cloud SASE application information from IDaaS to retrieve the organizational structure. You must set the following parameters:

        • Instance ID

        • Application ID

        • client_id

        • client_secret

        • Public Key Endpoint

        • Encryption/Decryption Key

          Note

          After configuration, you can apply security policies based on the organizational structure. The system uses this structure for policy application only and does not access individual employee details.

      • No: Read access to the organizational structure is not authorized.

      Authorize Read Access to Organizational Structure: Yes

      • Instance ID: idaas_gzcsi7qu2pyhxqjtibzmeh****

      • Application ID: app_mkhn54lnexe6hitkzl7a2m****

      • client_id: app_mkhn54lnexe6hitkzl7a2m****

      • client_secret: CSCb****************************************qk

      • Public Key Endpoint: https://eiam-api-cn-hangzhou.aliyuncs.com/v2/idaas_ulr2tayafld4gkx7tcdx6cv6mi/app_msl63usakau653bj2r5qvafadq/provisioning/****

      • Encryption/Decryption Key:0797d3ec35c49472ca4d7ccc8ef0375948cf123e9cd6882333a2a0778773****

    5. If you set Grant Read Permissions on Organizational Structure to No, click Ok to complete the configuration.

      If you selected Yes, you can click Connectivity Test. After the test is successful, click Next.

    6. In the Synchronization Settings wizard, configure the synchronization scope and field mappings for the organizational structure, and then click Ok.

      Parameter

      Description

      Organizational Structure Synchronization

      The synchronization scope for the organizational structure.

      • Synchronize All: Synchronizes the entire organizational structure from IDaaS to SASE.

      • Partially Synchronize: Synchronizes only selected organizational units.

      Field Synchronization Mapping

      Maps fields from your IDaaS organizational structure to the corresponding fields in SASE.

      Note

      If the built-in Local Field After Mapping options in the SASE system do not meet your business needs, click View Extended Fields in the upper-right corner of the list. In the View Extended Fields panel, you can add, edit, or delete extended fields.

    Step 2: Verify the connection

    1. Open the SASE client you installed.

    2. Enter the enterprise verification ID and click OK.

      You can log on to the Secure Access Service Edge console. In the navigation pane on the left, on the Settings page, obtain the Enterprise Authentication Identifier.

    3. On the IDaaS sign-in page that appears, enter your IDaaS username and password, and then click Submit.

      A successful sign-in confirms that SASE and IDaaS are properly connected.