Course 2: Identity Services
1. Authentication and Authorization
• Authentication → Confirms user identity (who you are).
o Uses passwords, biometrics, MFA, etc.
• Authorization → Determines access rights (what you can do).
o Examples: RBAC, ABAC, MAC, DAC.
• Both processes protect systems and help monitor activity and enforce policies.
2. Identity Fundamentals
Zscaler focuses on SAML, SCIM, and OIDC.
SAML (Security Assertion Markup Language)
• Open standard for exchanging authentication and authorization data.
• Uses XML for identity information.
• Components:
o IdP (Identity Provider): Authenticates users (e.g., Okta, Microsoft Entra ID).
o SP (Service Provider): Provides access to resources (e.g., Salesforce, Zscaler).
o SAML Assertion: Contains authentication info from IdP to SP.
• Zscaler supports SAML 2.0 for authentication and SSO.
• Pros: Strong security (digital signatures, encryption, attribute-based access).
• Cons: Complex (XML handling, yearly cert maintenance).
• Common SPs: Okta, Microsoft AD FS, Entra ID, PingFederate.
SCIM (System for Cross-domain Identity Management)
• Standardized protocol for automated user provisioning/deprovisioning.
• Ensures consistent user data across connected systems.
• Example: When a new employee is added, SCIM automatically creates accounts in
connected apps (Office 365, Salesforce, etc.).
OIDC (OpenID Connect)
• Built on OAuth 2.0 for authentication and SSO.
• Uses JSON Web Tokens (JWT).
• Easier to maintain than SAML.
• Security is lower compared to SAML but ideal for mobile/web apps.
• Common SPs: Okta (via OIN App Integration or Custom App), Auth0, OneLogin, PingOne.
SAML vs OIDC Quick Comparison:
SAML OIDC
Used for enterprise apps Used for mobile/web apps
Uses XML Uses JSON Web Tokens
Harder to implement & maintain Easier to implement &
maintain
Stronger security (encryption, signatures, Lighter security
ABAC)
SP examples: Okta, Entra ID, AD FS SP examples: Auth0, OneLogin
3. Zscaler Identity Integration
• Users connect to the Zero Trust Exchange via browser or Zscaler Client Connector.
• Identity verification (via SAML IdP) is the first step before applying inspection, data
protection, and access policies.
• ZIA (Internet Access): Manages internet/SaaS access.
• ZPA (Private Access): Manages access to internal apps/resources.
• ZDX (Digital Experience): Monitors performance and user experience.
4. ZIdentity Overview
• Unified identity service for all Zscaler products.
• Centralized portal for identity management, authentication, and entitlement assignment.
• Key capabilities:
o SCIM + Just-in-Time (JIT) provisioning.
o Central role assignment.
o One-time authentication across services.
o Single connection to external IdP (e.g., Okta, Entra ID).
Key Features
• Single sign-on across all Zscaler services.
• MFA-supported authentication.
• Centralized admin role management.
• Automatic user synchronization (SAML JIT or SCIM).
• Restricted admin login via IP address.
• Audit reports for configuration and access changes.
Benefits
• Simplified management for admins and end users.
• One login for all roles and services.
• Centralized role assignments and entitlement visibility.
5. ZIdentity Admin Portal
• Used to configure and manage user access and entitlements.
Adding User Groups
• Logical grouping of users for easy role/service assignment.
• Each user can belong to up to 1,000 groups (limited per service).
• Example: ZIA supports up to 128 groups per user.
Admin Roles
• Predefined admin roles available for users or groups.
• Multiple roles can be assigned.
Entitlements
• Service Entitlements: For end users (non-admins).
• Administrative Entitlements: For admins managing configurations.
User & Session Attributes
• Define attributes for SSO and access control.
• Session attributes can enforce context-based access (via ZPA).
6. Policies and Audit Logs
Sign-on Policies:
• Define allow/deny access to Zscaler services.
• Conditional rules (location, group, IP).
• Not applicable to Super Admin (admin@<tenant>.[Link]).
Audit Logs:
• Capture configuration and management activities (user actions, timestamps, IPs).
• Retained for 6 months.
• Exportable as .csv.
7. Quiz Overview
• Objective: Assess understanding of identity services and ZIdentity.
• Passing Score: 80%.
• Attempts: Unlimited retries.
• Requirement: Must pass to proceed to next module.
• Feedback: Instant results after completion.
Key Pointers (Don’t Miss These)
• Zscaler supports SAML 2.0 for authentication and SCIM for provisioning.
• OIDC is simpler and preferred for web/mobile but has lower security.
• ZIdentity = single, unified identity framework for all Zscaler services.
• One IdP connection → unified user view across ZIA, ZPA, ZDX.
• Role assignment is done centrally in ZIdentity.
• Admin logins can be restricted by IP address.
• Audit logs = 6 months retention.
• SCIM automates lifecycle management.
• Single sign-on (SSO) for both admins and end users.
Summary
This module explains how Zscaler Identity Services secure and streamline user access within the
Zero Trust Exchange. It introduces key identity standards — SAML, SCIM, and OIDC — used for
authentication and provisioning, highlighting Zscaler’s recommendation of using SAML SSO and
SCIM for efficient identity management.
ZIdentity serves as the unified identity hub across all Zscaler products, simplifying user
provisioning, entitlement assignment, and authentication. It enables seamless SSO, MFA
enforcement, centralized admin management, and audit tracking — all through one connection to
an external IdP.
Administrators can manage user groups, roles, attributes, entitlements, and sign-on policies
through the ZIdentity portal, ensuring secure and efficient access control aligned with Zero Trust
principles.