Configure a SASE SSO policy

Prerequisites

You must have the redirect URL for your enterprise application.

Create a policy

1. Log on to the SASE console.

2. In the left-side navigation pane, choose Identity Authentication > Single Sign-on.

3. On the Single Sign-on page, click Create Policy.

4. In the Create Policy panel, configure the policy settings as described in the following table.

   Parameter	Description
   Policy Name	Enter a name for the policy. The name must be 2–100 characters long and can contain letters, digits, hyphens (-), underscores (_), and Chinese characters.
   Policy Status	Specifies whether to enable the policy. Valid values: Enabled: The policy takes effect only when it is enabled. Disabled: You can disable the policy and enable it later when needed. Important If you disable this policy, single sign-on will fail. Proceed with caution.
   API access authorization	Specifies the client_id and client_secret. To use single sign-on, you must enable API access and use these credentials for API authorization. Important Keep your client_secret secure. If you suspect it has been compromised, immediately delete the old secret and create a new one to rotate your credentials.
   Redirect URL	Enter the redirect_uri for your internal enterprise application. This URL is added to an allowlist to allow SASE to send a logon request after authentication is complete.
   Application Configuration	Provides the configuration details for your application. This includes the Issuer, Discovery Endpoint, Authorization Endpoint, Token Endpoint, Public Key Endpoint, and UserInfo Endpoint. Provide these values when configuring your identity provider.

5. Click OK.

   The new policy appears in the policy list.

Next steps

After creating the single sign-on policy, you must also complete the corresponding configuration in your identity provider. The specific steps vary depending on your identity provider.

If your company uses business applications integrated with IDaaS and you want to use SASE SSO, see Best practices for logging on to an IDaaS application by using SASE SSO.

After the identity provider is successfully connected, enterprise users can log on to the SASE client to access internal enterprise applications. For instructions, see Install and log on to the SASE client.

To further control user access permissions, you can use the private access feature. For more information, see Configure office applications.

Edit and delete a policy

You can perform the following operations as needed:

• Edit: Click Edit. In the Edit panel, you can view the information of the specified policy or modify the related configurations.

• Delete: Click Delete to remove the policy.

  Important

  Deleting a single sign-on policy prevents users from accessing internal enterprise applications. Proceed with caution.

Related documents

• For more information about using the SASE client, see Install and log on to the SASE client and Enable or disable security protection for private access.

• For detailed information about the private access feature, including how to configure network settings and office applications, see Configure network settings and Configure office applications.

• For best practices, see Best practices for logging on to an IDaaS application by using SASE SSO.