Skip to content

Commit 49c7414

Browse files
ranbelranbel
committed
device enrollment examples
1 parent 18da351 commit 49c7414

File tree

4 files changed

+170
-3
lines changed

4 files changed

+170
-3
lines changed

‎src/content/partials/cloudflare-one/access/create-service-token.mdx‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33

44
---
55

6+
import { Tabs, TabItem } from '~/components';
7+
8+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
9+
610
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Access** > **Service Auth** > **Service Tokens**.
711

812
2. Select **Create Service Token**.
@@ -16,5 +20,47 @@
1620
6. Copy the Client Secret.
1721

1822
:::caution
19-
This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must generate a new service token.
23+
This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must generate a new service token.
2024
:::
25+
26+
</TabItem> <TabItem label="Terraform">
27+
28+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
29+
- `Access: Service Tokens Write`
30+
31+
2. Configure the [`cloudflare_zero_trust_access_service_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/zero_trust_access_service_token) resource:
32+
33+
```tf
34+
resource "cloudflare_zero_trust_access_service_token" "example_service_token" {
35+
account_id = var.cloudflare_account_id
36+
name = "Example service token"
37+
duration = "8760h"
38+
}
39+
```
40+
41+
3. Output the Client ID and Client Secret to the Terraform state file:
42+
43+
```tf
44+
output "example_service_token_client_id" {
45+
value = cloudflare_zero_trust_access_service_token.example_service_token.client_id
46+
}
47+
48+
output "example_service_token_client_secret" {
49+
value = cloudflare_zero_trust_access_service_token.example_service_token.client_secret
50+
sensitive = true
51+
}
52+
```
53+
4. Apply the configuration:
54+
```sh
55+
terraform apply
56+
```
57+
58+
5. Read the Client ID and Client Secret:
59+
```sh
60+
terraform output example_service_token_client_id
61+
```
62+
```sh
63+
terraform output example_service_token_client_secret
64+
```
65+
66+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/warp/device-enrollment-mtls.mdx‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33

44
---
55

6-
import { GlossaryTooltip } from "~/components"
6+
import { GlossaryTooltip, Tabs, TabItem } from "~/components"
77

88
To check for an mTLS certificate:
99

10+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
11+
1012
1. [Add an mTLS certificate](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#add-mtls-authentication-to-your-access-configuration) to your account. You can generate a sample certificate using the [Cloudflare PKI toolkit](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-mtls-using-cloudflare-pki).
1113

1214
2. In **Associated hostnames**, enter your Zero Trust <GlossaryTooltip term="team domain">team domain</GlossaryTooltip>: `<team-name>.cloudflareaccess.com`
@@ -18,3 +20,49 @@ To check for an mTLS certificate:
1820
| Allow | Require | Common Name | `<CERT-COMMON-NAME>` |
1921

2022
4. On your device, add the client certificate to the [system keychain](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).
23+
24+
</TabItem> <TabItem label="Terraform">
25+
26+
1. Add the following permissions to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
27+
- `Access: Mutual TLS Certificates Write`
28+
- `Access: Apps and Policies Write`
29+
30+
2. Use the [`cloudflare_zero_trust_access_mtls_certificate`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/zero_trust_access_mtls_certificate) resource to add an mTLS certificate to your account:
31+
32+
```tf
33+
resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" {
34+
account_id = var.cloudflare_account_id
35+
name = "WARP enrollment mTLS cert"
36+
certificate = <<EOT
37+
-----BEGIN CERTIFICATE-----
38+
xxxx
39+
xxxx
40+
-----END CERTIFICATE-----
41+
EOT
42+
associated_hostnames = ["your-team-name.cloudflareaccess.com"]
43+
}
44+
```
45+
46+
3. Add the following policy to your [WARP enrollment Access application](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions):
47+
48+
```tf
49+
resource "cloudflare_zero_trust_access_policy" "warp_enrollment_employees" {
50+
application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
51+
account_id = var.cloudflare_account_id
52+
name = "Allow company emails"
53+
decision = "allow"
54+
precedence = 1
55+
56+
include {
57+
email_domain = ["company.com"]
58+
}
59+
60+
require {
61+
common_names = ["Common name 1", "Common name 2"]
62+
}
63+
}
64+
```
65+
66+
4. On your device, add the client certificate to the [system keychain](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).
67+
68+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/warp/device-enrollment.mdx‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33

44
---
55

6+
import { Tabs, TabItem } from '~/components';
7+
8+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
9+
610
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.
711
2. In **Device enrollment permissions**, select **Manage**.
812
3. In the **Rules** tab, configure one or more [Access policies](/cloudflare-one/policies/access/) to define who can join their device. For example, you could allow all users with a company email address:
@@ -12,8 +16,45 @@
1216

1317
:::note
1418

15-
Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.
19+
Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.
1620
:::
1721

1822
4. In the **Authentication** tab, select the [identity providers](/cloudflare-one/identity/idp-integration/) users can authenticate with. If you have not integrated an identity provider, you can use the [one-time PIN](/cloudflare-one/identity/one-time-pin/).
1923
5. Select **Save**.
24+
25+
</TabItem> <TabItem label="Terraform">
26+
27+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
28+
- `Access: Apps and Policies Write`
29+
30+
2. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_access_application) resource to create an application with type `warp`.
31+
32+
```tf
33+
resource "cloudflare_zero_trust_access_application" "warp_enrollment_app" {
34+
account_id = var.cloudflare_account_id
35+
session_duration = "18h"
36+
name = "Warp device enrollment"
37+
allowed_idps = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id]
38+
auto_redirect_to_identity = true
39+
type = "warp"
40+
app_launcher_visible = false
41+
}
42+
```
43+
44+
3. Use the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_access_policy) resource to define enrollment permissions.
45+
46+
```tf
47+
resource "cloudflare_zero_trust_access_policy" "warp_enrollment_employees" {
48+
application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
49+
account_id = var.cloudflare_account_id
50+
name = "Allow company emails"
51+
decision = "allow"
52+
precedence = 1
53+
54+
include {
55+
email_domain = ["company.com"]
56+
}
57+
}
58+
```
59+
60+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/warp/service-token-enrollment.mdx‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33

44
---
55

6+
import { Tabs, TabItem } from '~/components';
7+
8+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
9+
610
1. [Create a service token](/cloudflare-one/identity/service-tokens/#create-a-service-token).
711

812
2. Copy the token's **Client ID** and **Client Secret**.
@@ -17,4 +21,32 @@
1721
* `auth_client_id`: The **Client ID** of your service token.
1822
* `auth_client_secret`: The **Client Secret** of your service token.
1923

24+
</TabItem> <TabItem label="Terraform">
25+
26+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
27+
- `Access: Apps and Policies Write`
28+
29+
2. [Create a service token](/cloudflare-one/identity/service-tokens/#create-a-service-token) and copy its **Client ID** and **Client Secret**.
30+
31+
3. Add the following policy to your [WARP enrollment Access application](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions):
32+
33+
```tf
34+
resource "cloudflare_zero_trust_access_policy" "warp_enrollment_service_token" {
35+
application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
36+
account_id = var.cloudflare_account_id
37+
name = "Allow service token"
38+
decision = "non_identity"
39+
precedence = 2
40+
41+
include {
42+
service_token = [cloudflare_zero_trust_access_service_token.example_service_token.id]
43+
}
44+
}
45+
```
46+
4. In your MDM [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/), add the following fields:
47+
* `auth_client_id`: The **Client ID** of your service token.
48+
* `auth_client_secret`: The **Client Secret** of your service token.
49+
50+
</TabItem> </Tabs>
51+
2052
When you deploy the WARP client with your MDM provider, WARP will automatically connect the device to your Zero Trust organization.

0 commit comments

Comments
 (0)