For WSA SaaS Access Control, the Identity Provider is:

Question

Options

• AAn ICAP server that the WSA is configured to communicate with
• BIntegrated into the WSA.
• CDeployed by the SaaS service provider.
• DIntegrated into the Authentication Server.

• A
  3% (1)
• B
  90% (27)
• C
  7% (2)

Explanation

Option B is correct because Cisco WSA's SaaS Access Control feature has the Identity Provider (IdP) built directly into the appliance itself - the WSA acts as a SAML IdP, generating and signing assertions that are sent to SaaS applications (the Service Providers) to authenticate users without needing a separate external IdP system.

Why the distractors are wrong:

• A - ICAP is a content-inspection protocol used for things like DLP or antivirus offloading, completely unrelated to identity federation or SSO.
• C - The SaaS provider is the Service Provider (SP) in SAML terminology, not the IdP; it consumes authentication assertions, not creates them.
• D - An Authentication Server (e.g., LDAP/AD) provides credential verification, but the WSA itself takes on the IdP role in SaaS Access Control, not the auth server.

Memory tip: Think of the WSA as a "bouncer with a built-in ID stamp" - it checks users via the backend auth server, then issues its own SAML ticket (IdP function) directly to the SaaS app. The IdP stamp lives on the WSA, not anywhere else.

No community discussion yet for this question.