The diagram below provides a conceptual overview of how you can use Cloud Secure Edge (CSE) via Identity Federation for Device Policies on SaaS Apps.

Normal Single-Sign-On Flow

sequenceDiagram
    autonumber
    participant UA as Web Browser
    participant SP as SaaS Application
    participant IDP as Identity Provider
    UA->>SP: Access application
    SP->>IDP: Generate SAML request
    IDP->>UA: Prompt user & password
    UA->>IDP: Submit credentials
    IDP->>UA: Prompt MFA
    UA->>IDP: Complete MFA
    IDP->>SP: Issue SSO token
    SP->>SP: Create user session
    SP->>UA: Set app session cookie
    UA->>SP: Access application

IDP-Routed Flow (with CSE)

sequenceDiagram
    autonumber
    participant UA as Web Browser
    participant SP as SaaS Application
    participant IDP as Identity Provider
    participant TP as CSE TrustProvider
    UA->>SP: Access application
    SP->>IDP: Generate SAML request
    IDP->>TP: IdP routing rule
    TP->>TP: Device and policy check
    TP->>TP: Passwordless authentication
    TP->>IDP: Issue Trust Token
    IDP->>UA: Prompt MFA (if required)
    IDP->>SP: Issue SSO token
    SP->>SP: Create user session
    SP->>UA: Set app session cookie
    UA->>SP: Access application

In the Normal Single-Sign-On flow, your SaaS application redirects to your Identity Provider to authenticate the user.

In the IDP-first authentication flow, you configure your Identity Provider to federate authentication requests to Cloud Secure Edge’s TrustProvider component. Since the Cloud Secure Edge (CSE) is now in the authentication flow, it is able to enforce zero-trust security policy. The net effect is that every login to a routed SaaS application is inspected by CSE, so device posture and group-based Zero Trust policies are applied before the user reaches the application.

The step-by-step flow is detailed in the diagram below:

sequenceDiagram
    autonumber
    participant U as User and Device
    participant APP as SaaS Application
    participant SSO as SSO Provider
    participant CC as CSE Command Center
    participant DM as CSE App
    U->>APP: Browser request to application
    APP->>SSO: Redirect to SSO
    SSO->>CC: Redirect to TrustProvider via IdP routing rules
    CC->>DM: Device check
    CC->>SSO: Redirect to SSO
    SSO->>U: SSO login page
    U->>SSO: User provides credentials
    SSO->>CC: Access token for TrustProvider
    CC->>CC: Generate TrustToken based on device status & access policy
    CC->>U: Access token
    U->>APP: Access SaaS app