Cloud Secure Edge Docs

CSE Home>  Manage Users and Devices>  Passwordless Authentication

Passwordless Authentication

Enable users to log in via your Identity Provider without entering a username/password
Updated On: Aug 07, 2026
On This Page

How It Works

The diagram below provides a conceptual overview of how SonicWall Cloud Secure Edge (CSE) Passwordless Authentication flow works.

Normal Authentication Flow

sequenceDiagram
    autonumber
    participant BR as Browser
    participant TP as CSE TrustProvider
    participant IDP as Okta SSO
    BR->>TP: Access service
    TP->>TP: Check device cert
    TP->>IDP: Redirect to sign in
    IDP->>IDP: Check username & password
    IDP->>IDP: Verify MFA
    IDP->>TP: Issue SSO token
    TP->>TP: Check trust score and policies
    TP->>BR: Issue TrustProvider ID token

Passwordless Authentication Flow

sequenceDiagram
    autonumber
    participant BR as Browser
    participant TP as CSE TrustProvider
    participant IDP as Okta SSO
    BR->>TP: Access service
    TP->>TP: Check device cert
    TP->>IDP: Route to external OpenID Connect IdP
    IDP-->>TP: Redirect back
    TP->>TP: Exchange device cert for token
    TP->>IDP: Issue passwordless token
    IDP->>IDP: Verify MFA
    IDP->>TP: Issue SSO token
    TP->>TP: Check trust score and policies
    TP->>BR: Issue TrustProvider ID token

Normal Authentication

In the Normal Authentication Flow, CSE's (formerly Banyan's) TrustProvider component federates to your organization's Identity Provider (IdP). The user enters their SSO username and password (and Multi-factor Authentication (MFA), if applicable) at your IdP. Once the credentials (and MFA) are verified, the TrustProvider IDToken is issued.

Passwordless Authentication

In the Passwordless Authentication flow, CSE leverages the fact that the trusted Device Certificate includes the user's email address in the UserPrincipalName SAN extension field. To enable Passwordless Authentication, register the CSE-provided "App Client for Passwordless Authentication" as an External OpenID Connect IdP in your organization's Identity Provider.

When Passwordless is enabled, the device certificate that is presented during device trust will be used to extract the user who is attempting to authenticate. The identified user will be issued a TrustToken without requiring username and password. Instead, they only need to perform an MFA step if configured by the IdP.

Passwordless and Zero Touch Installation

With the desktop app 2.1+, Passwordless is supported for devices registered via zero-touch installation.

Devices registered via zero-touch installation can be registered to either a specific user or the default "Staged User". When a device is registered to the default "Staged User", the issued device certificate will not have the UserPrincipalName SAN extension field set. For Passwordless to work, CSE will silently swap the certificate with no UPN information to a certificate with the user's UPN during the first authentication flow. From then on, the CSE's Passwordless flow will be enabled.

Identity Provider Setup Guides

Okta
Onelogin
Azure AD

Chat