Skip to content

Commit 01a04b0

Browse files
ranbelmarciocloudflare
ranbel
and
marciocloudflare
authored
[ZT] add Terraform IdP to implementation guide (#20238)
* update OTP * update generic oidc * update generic saml * update entra ID * add IdP TF tab to implementation guide * Update src/content/partials/learning-paths/zero-trust/configure-idp.mdx * Update src/content/partials/cloudflare-one/access/idp-integration.mdx Co-authored-by: marciocloudflare <[email protected]> --------- Co-authored-by: marciocloudflare <[email protected]>
1 parent f581bf5 commit 01a04b0

File tree

8 files changed

+117
-38
lines changed

8 files changed

+117
-38
lines changed

‎src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx‎

Lines changed: 42 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ pcx_content_type: how-to
33
title: Microsoft Entra ID
44
---
55

6-
import { Render } from "~/components";
6+
import { Render, Tabs, TabItem } from "~/components";
77

88
You can integrate Microsoft Entra ID (formerly Azure Active Directory) with Cloudflare Zero Trust and build policies based on user identity and group membership. Users will authenticate to Zero Trust using their Entra ID credentials.
99

@@ -93,6 +93,8 @@ More narrow permissions may be used, however this is the set of permissions that
9393

9494
### 3. Add Entra ID as an identity provider
9595

96+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
97+
9698
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Authentication**.
9799

98100
2. Under **Login methods**, select **Add new**.
@@ -114,6 +116,45 @@ More narrow permissions may be used, however this is the set of permissions that
114116

115117
To [test](/cloudflare-one/identity/idp-integration/#test-idps-in-zero-trust) that your connection is working, select **Test**.
116118

119+
</TabItem> <TabItem label="API">
120+
121+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
122+
| Type | Item | Permission |
123+
| ------- | ---------------- | ---------- |
124+
| Account | Access: Organizations, Identity Providers, and Groups | Edit |
125+
126+
2. Make a `POST` request to the [Identity Providers](/api/resources/zero_trust/subresources/identity_providers/methods/create/) endpoint:
127+
128+
```sh
129+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/identity_providers \
130+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
131+
--data '{
132+
"name": "Entra ID example",
133+
"type": "azureAD",
134+
"config": {
135+
"client_id": "<your client id>",
136+
"client_secret": "<your client secret>",
137+
"directory_id": "<your azure directory uuid>",
138+
"support_groups": true
139+
}
140+
}'
141+
```
142+
143+
</TabItem> <TabItem label="Terraform">
144+
145+
:::note[Provider versions]
146+
The following example requires Cloudflare provider version `>=4.40.0`.
147+
:::
148+
149+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
150+
- `Access: Organizations, Identity Providers, and Groups Write`
151+
152+
2. Configure the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) resource:
153+
154+
<Render file="access/entra-id-terraform" />
155+
156+
</TabItem> </Tabs>
157+
117158
#### UPN and email
118159

119160
If your organization's UPNs do not match users' email addresses, you must add a custom claim for email. For example, if your organization's email format is `[email protected]` but the UPN is `[email protected]`, you must create an email claim if you are configuring email-based policies.
@@ -264,18 +305,3 @@ You can require users to re-enter their credentials into Entra ID whenever they
264305
"scim_base_url": "https://<TEAM_NAME>.cloudflareaccess.com/populations/f174e90a-fafe-4643-bbbc-4a0ed4fc8415/scim/v2"
265306
}'
266307
```
267-
268-
## Example API Configuration
269-
270-
```json
271-
{
272-
"config": {
273-
"client_id": "<your client id>",
274-
"client_secret": "<your client secret>",
275-
"directory_id": "<your azure directory uuid>",
276-
"support_groups": true
277-
},
278-
"type": "azureAD",
279-
"name": "my example idp"
280-
}
281-
```

‎src/content/docs/cloudflare-one/identity/idp-integration/generic-oidc.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,16 +80,16 @@ Cloudflare Access has a generic OpenID Connect (OIDC) connector to help you inte
8080
}'
8181
```
8282

83-
</TabItem> <TabItem label="Terraform (v4)">
83+
</TabItem> <TabItem label="Terraform">
8484

8585
:::note[Provider versions]
8686
The following example requires Cloudflare provider version `>=4.40.0`.
8787
:::
8888

89-
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
89+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
9090
- `Access: Organizations, Identity Providers, and Groups Write`
9191

92-
2. Configure the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/zero_trust_access_identity_provider) resource:
92+
2. Configure the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) resource:
9393

9494
```tf
9595
resource "cloudflare_zero_trust_access_identity_provider" "generic_oidc_example" {

‎src/content/docs/cloudflare-one/identity/idp-integration/generic-saml.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,16 @@ To download the SAML metadata file, copy-paste the metadata endpoint into a web
5454
6. (Optional) Under **Optional configurations**, configure [additional SAML options](#optional-configurations).
5555
7. Select **Save**.
5656

57-
</TabItem> <TabItem label="Terraform (v4)">
57+
</TabItem> <TabItem label="Terraform">
5858

5959
:::note[Provider versions]
6060
The following example requires Cloudflare provider version `>=4.40.0`.
6161
:::
6262

63-
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
63+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
6464
- `Access: Organizations, Identity Providers, and Groups Write`
6565

66-
2. Configure the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/zero_trust_access_identity_provider) resource:
66+
2. Configure the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) resource:
6767

6868
```tf
6969
resource "cloudflare_zero_trust_access_identity_provider" "generic_saml_example" {

‎src/content/docs/cloudflare-one/identity/one-time-pin.mdx‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,35 @@ For example, if your team uses Okta but you are collaborating with someone outsi
2121
2. Under **Login methods**, select **Add new**.
2222
3. Select **One-time PIN**.
2323

24-
</TabItem> <TabItem label="Terraform (v4)">
24+
</TabItem> <TabItem label="API">
25+
26+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
27+
| Type | Item | Permission |
28+
| ------- | ---------------- | ---------- |
29+
| Account | Access: Organizations, Identity Providers, and Groups | Edit |
30+
31+
2. Make a `POST` request to the [Identity Providers](/api/resources/zero_trust/subresources/identity_providers/methods/create/) endpoint:
32+
33+
```sh
34+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/identity_providers \
35+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
36+
--data '{
37+
"name": "One-time PIN login",
38+
"type": "onetimepin",
39+
"config": {}
40+
}'
41+
```
42+
43+
</TabItem> <TabItem label="Terraform">
2544

2645
:::note[Provider versions]
2746
The following example requires Cloudflare provider version `>=4.40.0`.
2847
:::
2948

30-
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
49+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
3150
- `Access: Organizations, Identity Providers, and Groups Write`
3251

33-
2. Configure the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/zero_trust_access_identity_provider) resource:
52+
2. Configure the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) resource:
3453

3554
```tf
3655
resource "cloudflare_zero_trust_access_identity_provider" "onetimepin_login" {
@@ -72,12 +91,3 @@ By design, blocked users will not receive an email. The login page will always s
7291
Access only logs an authentication attempt after the user enters a code. If the user enters their email but never submits a code, the event will not appear in your [audit logs](/cloudflare-one/insights/logs/audit-logs/#authentication-audit-logs).
7392
:::
7493

75-
## Example API Config
76-
77-
```json
78-
{
79-
"config": {},
80-
"type": "onetimepin",
81-
"name": "my example idp"
82-
}
83-
```

‎src/content/partials/cloudflare-one/access/entra-id-terraform.mdx‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
{}
3+
---
4+
5+
6+
```tf
7+
resource "cloudflare_zero_trust_access_identity_provider" "microsoft_entra_id" {
8+
account_id = var.cloudflare_account_id
9+
name = "Entra ID example"
10+
type = "azureAD"
11+
config {
12+
client_id = var.entra_id_client_id
13+
client_secret = var.entra_id_client_secret
14+
directory_id = var.entra_id_directory_id
15+
support_groups = true
16+
}
17+
}
18+
```

‎src/content/partials/cloudflare-one/access/idp-integration-note.mdx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
params:
3+
- verb
4+
---
5+
6+
If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, {props.verb} the [generic OIDC](/cloudflare-one/identity/idp-integration/generic-oidc/) option. If they support SAML, {props.verb} the [generic SAML](/cloudflare-one/identity/idp-integration/generic-saml/) option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration.

‎src/content/partials/cloudflare-one/access/idp-integration.mdx‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,35 @@
22
{}
33
---
44

5+
import {Render, Tabs, TabItem} from "~/components"
6+
7+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
8+
59
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Authentication**.
610

711
2. In the **Login methods** card, select **Add new**.
812

913
3. Select the identity provider you want to add.
1014

11-
If you do not see your identity provider listed, these providers can typically still be enabled. If they support OIDC or OAuth, select the generic OIDC option. If they support SAML, select the generic SAML option. Cloudflare supports all SAML and OIDC providers and can integrate with the majority of OAuth providers. If your provider supports both SAML and OIDC, we recommend OIDC for ease of configuration.
15+
<Render file="access/idp-integration-note" product="cloudflare-one" params={{verb: "select" }}/>
1216

1317
4. Fill in the necessary fields to set up your identity provider.
1418

15-
Each identity provider will have different required fields for you to fill in. Step-by-step instructions are shown in the dashboard side panel.
19+
Each identity provider will have different required fields for you to fill in. Step-by-step instructions are shown in the dashboard side panel. Alternatively, refer to the [IdP-specific documentation](/cloudflare-one/identity/idp-integration/).
1620

1721
5. Once you have filled in the necessary fields, select **Save**.
22+
23+
</TabItem> <TabItem label="Terraform">
24+
25+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
26+
- `Access: Organizations, Identity Providers, and Groups Write`
27+
28+
2. Add an identity provider to Zero Trust using the [`cloudflare_zero_trust_access_identity_provider`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) resource. For example, to add a Microsoft Entra ID integration:
29+
30+
<Render file="access/entra-id-terraform" product="cloudflare-one" />
31+
32+
Each identity provider integration has different required attributes. You will need to obtain these attribute values from your identity provider. For more information, refer to the [IdP-specific documentation](/cloudflare-one/identity/idp-integration/).
33+
34+
<Render file="access/idp-integration-note" product="cloudflare-one" params={{verb: "use" }} />
35+
36+
</TabItem> </Tabs>

‎src/content/partials/learning-paths/zero-trust/configure-idp.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
---
55

6-
import { GlossaryTooltip, Render } from "~/components"
6+
import { GlossaryTooltip, Render} from "~/components"
77

88
An <GlossaryTooltip term="identity provider" link="https://www.cloudflare.com/learning/access-management/what-is-an-identity-provider/">identity provider (IdP)</GlossaryTooltip> stores and manages users' digital identities. You can integrate your existing identity provider with Cloudflare Zero Trust in order to manage user access to your private network. This requires configuration both in Cloudflare and with the identity provider itself.
99

@@ -16,4 +16,4 @@ To add an identity provider:
1616

1717
<Render file="access/idp-integration" product="cloudflare-one" />
1818

19-
Users will now be able to select this IdP when they are prompted to authenticate. To learn more about IdP configuration, refer to [SSO integration](/cloudflare-one/identity/idp-integration/).
19+
Users will now be able to select this IdP when they are prompted to authenticate.

0 commit comments

Comments
 (0)