Secure Access Service Edge:Connect a WeCom IdP to SASE

Limits

You can enable only one IdP or one IdP combination. An IdP combination contains multiple IdPs. If an IdP or IdP combination is enabled, you must disable the IdP or IdP combination before you can enable another IdP or IdP combination.

Configure a WeCom IdP

1. Log on to the SASE console. In the left-side navigation pane, choose Identity Authentication and Management > Identity Access.

2. On the IdP Management page, click the IdP Management tab. On the tab, click Add IdP. In the Add IdP panel, set the Authentication Type parameter to Single IdP and select WeCom from the the Enterprise IdP drop-down list. Then, configure the parameters to create a WeCom IdP. The following table describes the parameters.

   Parameter	Description
   Configuration Name	The name of the WeCom IdP. The name must be 2 to 100 characters in length and can contain letters, digits, hyphens (-), and underscores (_).
   Description	The description of the IdP. The description is displayed on the SASE client as the logon title. This provides users with the IdP information when they log on to the SASE client.
   IdP Configuration Status	Specifies whether to enable the IdP. Valid values: Enabled: If no IdP is enabled, you can enable the created IdP. Disabled: If another IdP is enabled, you can disable the created IdP. After you disable another IdP on the IdP Management tab, you can enable the created IdP. Important If you turn off IdP Configuration Status, users cannot access office applications by using the SASE client. Proceed with caution.

3. Click Obtain Authorization QR Code and use WeCom to scan the quick response (QR) code as an administrator.

4. After the authorization is complete, click View in List.

5. Configure the Schema parameter. Click OK.

   You must contact SASE technical support to obtain the value of the Schema parameter.

   After you configure a WeCom IdP, a self-managed SASE application is automatically created on WeCom. You must configure the visibility range of the self-managed SASE application on WeCom to ensure that the organizational structure in WeCom is synchronized to the self-managed SASE application. For more information, see How to configure the visibility range of third-party applications.

Disable a WeCom IdP

On the IdP Management tab, find the WeCom IdP that you want to manage and turn off the switch in the Status column.

View the information about a WeCom IdP

On the IdP Management tab, find the WeCom IdP that you want to manage and click Details in the Actions column.

Delete a WeCom IdP

On the IdP Management tab, find the WeCom IdP that you want to manage and click Delete in the Actions column.

Modify the information about a WeCom IdP

On the IdP Management tab, find the WeCom IdP that you want to manage and click Edit in the Actions column.

References

Configure a SASE IdP

If your enterprise does not use a third-party IdP, you can establish an organizational structure by using a custom IdP provided by SASE. For more information, see Configure a SASE IdP.

Connect a third-party IdP

If your enterprise uses one of the following IdPs to manage the organizational structure of the enterprise, you can connect the IdP to SASE: Lightweight Directory Access Protocol (LDAP), DingTalk, WeCom, Lark, and Identity as a Service (IDaaS).

• Connect an LDAP IdP to SASE

• Connect a DingTalk IdP to SASE

• Connect a Lark IdP to SASE

• Connect an IDaaS IdP to SASE

Configure an IdP combination

If your enterprise wants to use multiple IdPs to manage its organizational structure, you can configure an IdP combination by using SASE. For more information, see Configure an IdP combination.

Configure a user group

For more information, see Configure a user group.