Skip to content

Commit 1fcea74

Browse files
deadlypants1973deadlypants1973
authored
[CF1] identity-based selectors (#24154)
* [CF1] identity-based selectors * final updates
1 parent 6fc9a33 commit 1fcea74

File tree

1 file changed

+23
-23
lines changed
  • src/content/docs/cloudflare-one/policies/access

1 file changed

+23
-23
lines changed

‎src/content/docs/cloudflare-one/policies/access/index.mdx‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ For example, this configuration blocks every request to the application, except
5959

6060
Bypass does not enforce any Access security controls and requests are not logged. Bypass policies should be tested before deploying to production. Consider using [Service Auth](/cloudflare-one/policies/access/#service-auth) if you would like to enforce policies and maintain logging without requiring user authentication.
6161

62-
As Bypass does not enforce Access security controls, Bypass policies do not support identity-based [rule types](/cloudflare-one/policies/access/#rule-types). When making Bypass policies, you will not be able to apply certain identity-based [selectors](/cloudflare-one/policies/access/#selectors) (such as email, or IP).
62+
As Bypass does not enforce Access security controls, Bypass policies do not support identity-based [rule types](/cloudflare-one/policies/access/#rule-types). When making Bypass policies, you will not be able to apply certain identity-based [selectors](/cloudflare-one/policies/access/#selectors) (such as email).
6363

6464
:::
6565

@@ -133,28 +133,28 @@ To require only one country and one email ending:
133133

134134
When you add a rule to your policy, you will be asked to specify the criteria/attributes you want users to meet. These attributes are available for all Access application types, including [SaaS](/cloudflare-one/applications/configure-apps/saas-apps/), [self-hosted](/cloudflare-one/applications/configure-apps/self-hosted-public-app/), and [non-HTTP](/cloudflare-one/applications/non-http/) applications.
135135

136-
Identity-based attributes are only checked when a user authenticates to Access. Non-identity attributes are polled continuously, meaning they are-evaluated with each new HTTP request for changes during the [user session](/cloudflare-one/identity/users/session-management/). If you have configured [SCIM provisioning](/cloudflare-one/identity/users/scim/), you can force a user to re-attest all attributes with Access whenever you revoke the user in the IdP or update their IdP group membership.
137-
138-
| Selector | Description | Checked at login | Checked continuously<sup>1</sup> |
139-
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | -------------------------------- |
140-
| Emails | `[email protected]` | ✅ | ❌ |
141-
| Emails ending in | `@company.com` | ✅ | ❌ |
142-
| External Evaluation | Allows or denies access based on [custom logic](/cloudflare-one/policies/access/external-evaluation/) in an external API. | ✅ | ❌ |
143-
| IP ranges | `192.168.100.1/24` (supports IPv4/IPv6 addresses and CIDR ranges) | ✅ | ✅ |
144-
| Country | Uses the IP address to determine country. | ✅ | ✅ |
145-
| Everyone | Allows, denies, or bypasses access to everyone. | ✅ | ❌ |
146-
| Common Name | The request will need to present a valid certificate with an expected common name. | ✅ | ✅ |
147-
| Valid Certificate | The request will need to present any valid client certificate. | ✅ | ✅ |
148-
| Service Token | The request will need to present the correct service token headers configured for the specific application. | ✅ | ✅ |
149-
| Any Access Service Token | The request will need to present the headers for any [service token](/cloudflare-one/identity/service-tokens/) created for this account. | ✅ | ✅ |
150-
| Login Methods | Checks the identity provider used at the time of login. | ✅ | ❌ |
151-
| Authentication Method | Checks the [multifactor authentication](/cloudflare-one/policies/access/mfa-requirements/) method used by the user, if supported by the identity provider. | ✅ | ❌ |
152-
| Identity provider group | Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with [SCIM](/cloudflare-one/identity/users/scim/). | ✅ | ❌ |
153-
| SAML Group | Checks a SAML attribute name / value pair. This selector only displays if you use a [generic SAML](/cloudflare-one/identity/idp-integration/generic-saml/) identity provider. | ✅ | ❌ |
154-
| OIDC Claim | Checks an OIDC claim name / value pair. This selector only displays if you use a [generic OIDC](/cloudflare-one/identity/idp-integration/generic-oidc/) identity provider. | ✅ | ❌ |
155-
| Device posture | Checks [device posture signals](/cloudflare-one/identity/devices/) from the WARP client or a third-party service provider. | ✅ | ✅ |
156-
| Warp | Checks that the device is connected to WARP, including the consumer version. | ✅ | ✅ |
157-
| Gateway | Checks that the device is connected to your Zero Trust instance through the [WARP client](/cloudflare-one/connections/connect-devices/warp/). | ✅ | ✅ |
136+
Non-identity attributes are polled continuously, meaning they are-evaluated with each new HTTP request for changes during the [user session](/cloudflare-one/identity/users/session-management/). If you have configured [SCIM provisioning](/cloudflare-one/identity/users/scim/), you can force a user to re-attest all attributes with Access whenever you revoke the user in the IdP or update their IdP group membership.
137+
138+
| Selector | Description | Checked at login | Checked continuously<sup>1</sup> | Identity-based selector? |
139+
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | -------------------------------- | ------------------------ |
140+
| Emails | `[email protected]` | ✅ | ❌ | ✅ |
141+
| Emails ending in | `@company.com` | ✅ | ❌ | ✅ |
142+
| External Evaluation | Allows or denies access based on [custom logic](/cloudflare-one/policies/access/external-evaluation/) in an external API. | ✅ | ❌ | ✅ |
143+
| IP ranges | `192.168.100.1/24` (supports IPv4/IPv6 addresses and CIDR ranges) | ✅ | ✅ | ❌ |
144+
| Country | Uses the IP address to determine country. | ✅ | ✅ | ❌ |
145+
| Everyone | Allows, denies, or bypasses access to everyone. | ✅ | ❌ | ❌ |
146+
| Common Name | The request will need to present a valid certificate with an expected common name. | ✅ | ✅ | ❌ |
147+
| Valid Certificate | The request will need to present any valid client certificate. | ✅ | ✅ | ❌ |
148+
| Service Token | The request will need to present the correct service token headers configured for the specific application. | ✅ | ✅ | ❌ |
149+
| Any Access Service Token | The request will need to present the headers for any [service token](/cloudflare-one/identity/service-tokens/) created for this account. | ✅ | ✅ | ❌ |
150+
| Login Methods | Checks the identity provider used at the time of login. | ✅ | ❌ | ✅ |
151+
| Authentication Method | Checks the [multifactor authentication](/cloudflare-one/policies/access/mfa-requirements/) method used by the user, if supported by the identity provider. | ✅ | ❌ | ✅ |
152+
| Identity provider group | Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with [SCIM](/cloudflare-one/identity/users/scim/). | ✅ | ❌ | ✅ |
153+
| SAML Group | Checks a SAML attribute name / value pair. This selector only displays if you use a [generic SAML](/cloudflare-one/identity/idp-integration/generic-saml/) identity provider. | ✅ | ❌ | ✅ |
154+
| OIDC Claim | Checks an OIDC claim name / value pair. This selector only displays if you use a [generic OIDC](/cloudflare-one/identity/idp-integration/generic-oidc/) identity provider. | ✅ | ❌ | ✅ |
155+
| Device posture | Checks [device posture signals](/cloudflare-one/identity/devices/) from the WARP client or a third-party service provider. | ✅ | ✅ | ❌ |
156+
| Warp | Checks that the device is connected to WARP, including the consumer version. | ✅ | ✅ | ❌ |
157+
| Gateway | Checks that the device is connected to your Zero Trust instance through the [WARP client](/cloudflare-one/connections/connect-devices/warp/). | ✅ | ✅ | ❌ |
158158

159159
<sup>1</sup> For SaaS applications, Access can only enforce policies at the time
160160
of initial sign on and when reissuing the SaaS session. Once the user has

0 commit comments

Comments
 (0)