An authentication profile is a Versa configuration object that defines how users or devices are authenticated – the method (LDAP, RADIUS, SAML, Versa Directory, or certificate-based), caching behavior, and session and cookie expiration. Authentication rules reference it, and Secure Access portals and gateways attach it directly to decide who gets network access.
Key takeaways
- Defines the authentication method, caching mode, and session expiry.
- Supports LDAP, RADIUS, SAML, Versa Directory, and certificate-based auth.
- Authentication rules and NGFW policy reference a configured profile.
- SASE Secure Access portals and gateways attach a profile directly.
- Tenants set a default profile, with overrides per email domain.
On this page: Why it mattersHow it worksTypesAuthentication Profiles & VersaFAQ
Why are authentication profiles important?
Every access decision in a Versa deployment starts with knowing who is asking. An authentication profile turns “verify this user” into a concrete, repeatable procedure: which directory or identity provider to check, how long to trust the answer before checking again, and what happens when the check fails. Without it, authentication would have to be hard-coded per rule or per device, with no consistent session, cache, or cookie behavior across an organization.
Its importance also comes from covering every access surface with one model. The same profile object underlies NGFW user-identification policy, SSE user and device authentication rules, and SASE Secure Access portals and gateways – so a security team defines identity sources once (LDAP, SAML, RADIUS, Versa Directory, or certificates) and reuses them everywhere access decisions are made, rather than reimplementing directory integration per feature.
What is an authentication profile?
An authentication profile is a named object that an authentication method points to, and that authentication rules or policies reference in turn. Configuring one is a chain: define the identity source (an LDAP server, a SAML identity provider, a RADIUS server, or a certificate authentication profile), wrap it in an authentication method, then build the authentication profile around that method, adding a cache expiration time and – on SSE – a cookie expiration time and caching mode.
Cache and cookie settings control how long a successful authentication is trusted before the user must re-authenticate: cache expiry defaults to 10 minutes, and SSE cookie expiry defaults to 720 minutes, taking precedence over cache expiry once configured. A tenant can designate a default authentication profile for its users, with additional profiles assigned per email domain for organizations that federate identity differently by domain.
Types of authentication profiles
Five identity sources back an authentication profile. LDAP validates against Active Directory or an OpenLDAP server, using bind credentials and a base DN to scope the search. RADIUS checks credentials against an external RADIUS server; Versa supports one RADIUS profile per enterprise. SAML federates to an external identity provider – Okta, Microsoft Entra ID, Google IAM, PingIdentity, or Office 365 – for browser-based single sign-on. Versa Directory authenticates against a locally uploaded list of users and groups, with only one profile allowed per enterprise. Certificate-based profiles (device and user) validate a certificate presented during SASE client registration or gateway connection, instead of a password.
Most enterprises combine types: an LDAP or SAML profile alongside a certificate-based profile is a common pairing, since Versa allows certificate authentication to run together with directory or federated authentication rather than as a replacement for it.
Authentication Profiles & Versa
Authentication profiles surface across three areas of the platform. In NGFW user and group policy, a profile ties an authentication method – SAML, Kerberos, LDAP, RADIUS, certificate, or local database – to user-identification rules that decide whether traffic is authenticated before policy applies. In SSE, user and device authentication profiles set the default authentication profile for a tenant’s SSE clients, with per-domain overrides for organizations that route different email domains to different identity providers.
For SASE remote access, certificate-based authentication for SASE clients shows the full chain end to end: a certificate authentication profile feeds an authentication method, the method attaches to an authentication profile, and that profile is then associated with both the Secure Access portal and the Secure Access gateway – so the same identity check governs client registration and every subsequent gateway connection.
Frequently asked questions
What authentication methods can an authentication profile use?
An authentication profile can be built on LDAP, RADIUS, SAML, Versa Directory, or certificate-based authentication using device or user certificates. Later releases allow combining certificate-based authentication with an LDAP or SAML profile on the same enterprise, so both checks can apply.
What is the difference between an authentication profile and an authentication method?
An authentication method wraps a single identity source – an LDAP server profile, a SAML profile, a certificate authentication profile, and so on. An authentication profile is the higher-level object that authentication rules and policies actually reference; it points to one or more methods.
How long does a Versa authentication session last before re-checking?
It depends on the profile’s cache and cookie expiry settings. Cache expiry defaults to 10 minutes; SSE cookie expiry defaults to 720 minutes and, once configured, takes precedence over cache expiry for how long a session is trusted before re-authentication.
Can one tenant use different authentication profiles for different users?
Yes. A tenant sets a default user and device authentication profile for its SSE clients, and can define additional profiles per email domain – so users in different domains authenticate against different LDAP, SAML, or other identity sources under the same tenant.
Does an authentication profile work with certificate-based authentication?
Yes. Certificate-based authentication profiles validate a device or user certificate presented during SASE client registration or gateway connection, and Versa supports pairing certificate-based profiles with LDAP or SAML profiles on the same enterprise, rather than treating them as mutually exclusive authentication choices.
More on Authentication Profiles
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages covering SSE and SASE identity and access capabilities, including authentication profile support. | How Versa packages secure access and Zero Trust services, where authentication profiles gate user and device access. | Versa’s training portal: courses covering identity, SSE, and SASE configuration, including authentication and access rules. |
Related terms
If you’re reading about authentication profiles, these are worth looking at next.
| Lightweight Directory Access Protocol | Base Distinguished Name | One-Time Password |
|---|---|---|
| The directory protocol many authentication profiles validate against, using bind credentials and a base DN to scope searches. | The LDAP search scope an authentication profile’s LDAP settings use to limit which part of the directory a user lookup covers. | A single-use code used as an additional authentication step, layered on top of an authentication profile’s primary method. |