Secure Access Service Edge:Authentication management

Use cases

• When an enterprise onboards multiple applications, each with a different identity source, users need to use different identity sources to log in to the SASE App.

• Users are authenticated by using an OIDC authentication source. For convenience, you need to configure all applications that support the OIDC protocol to use the OIDC authentication source to log on to the SASE App.

• In a unified enterprise endpoint management environment, IT administrators want to improve efficiency and user experience by enabling employees to automatically log in to the SASE app without having to manually enter their username and password.

Prerequisites

• To enable authentication, you must first create an identity source and enable it. For more information, see Identity synchronization.

• To extend an LDAP identity source using the OIDC protocol, you must first connect to an LDAP identity source and enable it. For best practices on integrating LDAP, see Secure LDAP user access with Secure Access Service Edge.

  Note

  Because an OIDC authentication source does not provide an organizational structure, it must be associated with an identity source that does.

• The SASE App installed on your enterprise terminals must be version v4.8.5 or later.

Create an extension authentication source

An OIDC source uses the standard OIDC authorization code flow for federated authentication. Any identity provider that supports this flow, such as Okta, Azure AD, or a self-developed system, can act as an identity provider for SASE, allowing users to log on to the SASE App with their existing accounts. A device authentication source requires you to upload device information, which, when combined with a logon-free policy, enables client auto-sign-in.

1. Log on to the Secure Access Service Edge console.

2. In the left-side navigation pane, choose Identity Authentication > Identity Access.

3. On the Authentication Management tab, click Extended Authentication Source.

4. On the Extended Authentication Source page, click Add Extended Authentication Source.

5. In the Add panel, configure the extension authentication source by using the information in the following table.

   Parameter	Description
   Authentication Source Name	The name of the extension authentication source. The name must be 2 to 100 characters in length and can contain Chinese characters, letters, digits, hyphens (-), and underscores (_).
   Description	A description of the configuration. This description is displayed as the logon title in the SASE App to help users identify the identity source during logon.
   Extended Authentication Source Configuration > Authentication Source Type	For Authentication Source Type, the options are OIDC and Device Authentication. Device authentication is used for the client auto-sign-in feature. OIDC Authorization Mode: Defaults to authorization code flow and cannot be changed. Client ID: The identifier for the application making a request to SASE. This is the application identifier from your identity provider. Client secret: The key for the application making a request to SASE. This is the application secret from your identity provider. Important To rotate a compromised Client secret, delete the existing secret and add a new one. Scopes: The authorization scopes requested from the endpoint. Issuer: The OIDC Issuer discovery endpoint. SASE can parse this endpoint to automatically retrieve endpoint information. Device Authentication Click Download Import Template and fill in the information for the devices that will use the logon-free feature (Name, Phone Number, Email, Device MAC address, Device SN, and Device Hostname). After you complete the template, drag the file to the upload area or click browse and select to upload it. The file must be in .xlsx or .xls format and no larger than 100 MB. In the Associated IdP area, select the corresponding identity source. Upload the template to SASE by dragging the file or browsing to select it.
   Associated IdP	The supported types of associated identity providers vary by authentication source type. OIDC: Select an existing LDAP identity source. Only LDAP identity sources are supported. Device Authentication: Select an existing identity source.

6. Click OK.

   If you selected the OIDC authentication source type, you must also copy the value of the Redirect URI for SASE Authorization and configure it in your OIDC service.

Configure a logon-free policy

After enabling client auto-sign-in, the client signs in automatically. Devices that are not bound to an identity source connect as an anonymous identity, while data protection and endpoint protection policies still apply.

1. Log on to the Secure Access Service Edge console.

2. In the left-side navigation pane, choose Identity Authentication > Identity Access.

3. On the Authentication Management tab, click Single Sign-On Policy.

4. In the Client Auto-Sign-In Policy panel, enable the policy, configure the scope, and view the affected devices.

   Parameter	Description
   Enable Client Auto-Sign-In	Enables the client auto-sign-in policy.
   Scope of Automatic Sign-In	All Devices: Applies to all devices in the platform's terminal list, including manually imported company devices. After the policy takes effect, these devices will come online with an anonymous identity. Custom identity source authentication must be enabled. You can view enterprise terminal information by choosing Endpoint Management > Terminals in the left-side navigation pane. Authenticated Devices: Applies to all devices for which device authentication is configured in an extension authentication source. After the policy takes effect, these devices sign in as the device owner through auto-sign-in.
   Automatic Sign-In Status	The devices affected by this policy. You can click the device count to go to the Terminals page and view information about the affected devices.

5. Click OK.

6. On the Authentication Management tab, turn on the custom identity source switch.

   Note

   When you activate SASE, SASE creates a custom identity source for you by default. If you need to create another custom identity source, see Connect to a custom identity source.

   • If your enterprise uses an enterprise identity source, you must also enable it.

   • If your enterprise uses an OIDC extension authentication source, you must also enable its authentication status on the Authentication Management tab.

7. On a device that is within the logon-free scope, download and install the SASE App.

8. Open the SASE App, enter the enterprise authentication identifier, and click Ok. The SASE App will log on automatically.

Enable authentication status

Created and enabled identity sources, including OIDC extension sources, are displayed in a list. You can manage the authentication status of these sources and adjust their display order on the SASE App login page.

1. On the Authentication Management tab, locate the identity source that you created.

2. In the Authentication Status column, turn on the switch.

   This order determines how the identity sources appear on the SASE App login page.

   At the bottom of the SASE App login page, the enterprise identity source section displays icons for enabled identity sources (such as IDaaS and LDAP). The icon order is the order that users see when they log on. Drag the icon on the left side of the list to reorder the sources in the list.

Related topics

• To create user groups outside your enterprise organizational structure, see user group management.

• For specific instructions on client auto-sign-in, see Best practices for SASE client auto-sign-in.