When a SAML IDP returns an assertion containing device attributes, which Zscaler component consumes the attributes first, for policy creation?

In the SAML authentication flow within Zscaler architecture, the Identity Provider (IdP) generates a signed SAML assertion containing user and device attributes after successful user authentication. This assertion is sent back via the browser to Zscaler acting as the SAML Service Provider (SP). The Zscaler SAML SP is the initial Zscaler component that ingests, decrypts, and validates the incoming SAML assertion. It extracts the embedded device attributes and identity mappings, passing them downstream to the policy management framework and enforcement nodes. Because the Zscaler SAML SP acts as the single entry point for processing SAML metadata, it consumes these attributes first to enable policy definitions before traffic evaluation occurs across the Zero Trust Exchange.

A. Enforcement nodes consume policy directives derived from attributes, but do not directly ingest or process the raw SAML assertion first during authentication.

C. The Mobile Admin Portal is used by administrators to configure policies; it does not process live authentication SAML assertions directly from the IdP.

D. The Zero Trust Exchange encompasses the entire platform architecture, whereas the SAML SP is the specific sub-component that first ingests the SAML assertion.

1. Zscaler Config & Deployment Guide: "Configuring SAML for Zscaler Service Provider", Section: SAML Assertion Attribute Ingestion, Zscaler Help Portal.

2. Zscaler Technical Architecture Whitepaper: "Zero Trust Architecture and Identity Federation", Section: Identity Integration and SAML SP Processing.