Skip to content

Commit 60b0402

Browse files
ranbelranbel
authored
[ZT] Register WARP with minimal user interaction (#25035)
* add instant auth * overview * example of browser popup * add protocol launcher instructions * update team name formatting * fix link * apply review feedback
1 parent 723a6be commit 60b0402

File tree

3 files changed

+189
-1
lines changed

3 files changed

+189
-1
lines changed

‎src/assets/images/cloudflare-one/connections/warp-protocol-handler.png‎

63.6 KB
Loading

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/protocol-handler.mdx‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Register WARP with minimal user interaction
4+
sidebar:
5+
order: 4
6+
label: Automated WARP registration
7+
---
8+
9+
import { Render, GlossaryTooltip, Tabs, TabItem } from "~/components";
10+
11+
Administrators can automate WARP registration on managed devices and minimize the number of clicks required from an end user.
12+
13+
During the default WARP enrollment process, end users typically need to complete several steps in order to login:
14+
15+
1. Review Terms and Conditions in the WARP client GUI and acknowledge your company's use of Cloudflare WARP.
16+
2. Select their identity provider from the Cloudflare Access login screen.
17+
3. Complete the authentication steps required by the identity provider.
18+
4. Interact with a browser popup requesting permission to launch the WARP client.
19+
20+
This guide covers how to eliminate steps 1, 2 and 4 from your WARP deployment.
21+
22+
:::note[Service token authentication]
23+
If you are looking to eliminate all user interaction, you can [enroll devices using service tokens](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token). Because users are not required to log in to an identity provider, identity-based policies and logging will not be available on these devices.
24+
:::
25+
26+
On iOS and Android / ChromeOS, end users will still be asked questions required by their platform such as accepting notifications or installing the VPN Profile.
27+
28+
## Turn off onboarding screens
29+
30+
To skip the Terms and Conditions screens that are usually presented to users, set the [`onboarding` parameter](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to `false` in your [MDM deployment file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/). Here is an example `mdm.xml` file:
31+
32+
```xml
33+
<dict>
34+
<key>organization</key>
35+
<string>your-team-name</string>
36+
<key>onboarding</key>
37+
<false/>
38+
</dict>
39+
```
40+
41+
## Turn on Instant Auth
42+
43+
If you are only using one identity provider for device enrollment, turn on **Instant Auth** in your [device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions). This allow users to skip the Cloudflare Access login page and go directly to your SSO login event.
44+
45+
## Allow browser to launch WARP
46+
47+
You can configure your browser to automatically launch the Cloudflare WARP application after a successful login and skip the **Open Cloudflare WARP.app** popup.
48+
49+
![Browser popup requesting permission to open WARP](~/assets/images/cloudflare-one/connections/warp-protocol-handler.png)
50+
51+
### Chromium-based browsers
52+
53+
Chromium-based browsers such as Google Chrome and Microsoft Edge have a policy setting called [AutoLaunchProtocolsFromOrigins](https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#autolaunchprotocolsfromorigins). This setting takes in two parameters: a protocol for the browser to launch and the origins that are allowed to launch it. For the browser to launch WARP, you need to set the protocol to `com.cloudflare.warp` and the origin to your <GlossaryTooltip term="team domain">Zero Trust team domain</GlossaryTooltip> (`https://<your-team-name>.cloudflareaccess.com`).
54+
55+
<Tabs>
56+
<TabItem label="Windows">
57+
On Windows, you can configure `AutoLaunchProtocolsFromOrigins` by adding a new registry key.
58+
59+
To add the registry key manually:
60+
1. Open Registry Editor as Administrator.
61+
2. Navigate to the policies folder for your browser:
62+
- Google Chrome: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome`
63+
- Microsoft Edge: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge`
64+
:::note
65+
You may need to create the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome` folder if it does not already exist.
66+
:::
67+
3. Create a new string value:
68+
- **Value Name**: `AutoLaunchProtocolsFromOrigins`
69+
- **Value Data**: `[{"allowed_origins": ["https://<your-team-name>.cloudflareaccess.com/"], "protocol": "com.cloudflare.warp"}]`
70+
71+
Be sure to replace `<your-team-name>` with your actual <GlossaryTooltip term="team name">Zero Trust team name</GlossaryTooltip>.
72+
73+
Instead of using the Registry Editor, the registry key can also be created using a Group Policy Object (GPO), PowerShell script, or with an MDM such as [Intune](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/intune/#update-mdm-parameters).
74+
75+
</TabItem>
76+
<TabItem label="macOS">
77+
78+
On macOS, you can configure `AutoLaunchProtocolsFromOrigins` by deploying a property list (plist) file for the browser. The exact instructions will vary depending on your [MDM](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/). The general procedure is as follows:
79+
80+
1. Create a new plist file with the following name (case sensitive):
81+
- Google Chrome: `com.google.Chrome.plist`
82+
- Microsoft Edge: `com.microsoft.Edge.plist`
83+
84+
2. Using a text editor, add the following content to your plist:
85+
86+
```xml
87+
<key>AutoLaunchProtocolsFromOrigins</key>
88+
<array>
89+
<dict>
90+
<key>allowed_origins</key>
91+
<array>
92+
<string>https://<your-team-name>.cloudflareaccess.com</string>
93+
</array>
94+
<key>protocol</key>
95+
<string>com.cloudflare.warp</string>
96+
</dict>
97+
</array>
98+
```
99+
100+
Be sure to replace `<your-team-name>` with your actual <GlossaryTooltip term="team name">Zero Trust team name</GlossaryTooltip>.
101+
102+
3. Some MDMs require converting the `.plist` to a `.mobileconfig` before pushing it to a device. You can use a [file converter](https://github.com/timsutton/mcxToProfile) or modify the following example `com.google.Chrome.mobileconfig`:
103+
104+
```xml
105+
<?xml version="1.0" encoding="UTF-8"?>
106+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
107+
<plist version="1.0">
108+
<dict>
109+
<key>PayloadIdentifier</key>
110+
<string>com.google.chrome</string>
111+
<key>PayloadRemovalDisallowed</key>
112+
<true/>
113+
<key>PayloadScope</key>
114+
<string>System</string>
115+
<key>PayloadType</key>
116+
<string>Configuration</string>
117+
<key>PayloadUUID</key>
118+
<string>8FCBDCA7-87B3-4610-A01A-B0FE4C5B57C8</string>
119+
<key>PayloadOrganization</key>
120+
<string></string>
121+
<key>PayloadVersion</key>
122+
<integer>1</integer>
123+
<key>PayloadDisplayName</key>
124+
<string>Google Chrome Policy</string>
125+
<key>PayloadContent</key>
126+
<array>
127+
<dict>
128+
<key>PayloadType</key>
129+
<string>com.apple.ManagedClient.preferences</string>
130+
<key>PayloadVersion</key>
131+
<integer>1</integer>
132+
<key>PayloadIdentifier</key>
133+
<string>com.normandale</string>
134+
<key>PayloadUUID</key>
135+
<string>8FCBDCA7-87B3-4610-A01A-B0FE4C5B57C8</string>
136+
<key>PayloadEnabled</key>
137+
<true/>
138+
<key>PayloadDisplayName</key>
139+
<string>Custom: (com.google.Chrome)</string>
140+
<key>PayloadContent</key>
141+
<dict>
142+
<key>com.google.Chrome</key>
143+
<dict>
144+
<key>Forced</key>
145+
<array>
146+
<dict>
147+
<key>mcx_preference_settings</key>
148+
<dict>
149+
<key>AutoLaunchProtocolsFromOrigins</key>
150+
<array>
151+
<dict>
152+
<key>allowed_origins</key>
153+
<array>
154+
<string>https://<your-team-name>.cloudflareaccess.com</string>
155+
</array>
156+
<key>protocol</key>
157+
<string>com.cloudflare.warp</string>
158+
</dict>
159+
</array>
160+
</dict>
161+
</dict>
162+
</array>
163+
</dict>
164+
</dict>
165+
</dict>
166+
</array>
167+
</dict>
168+
</plist>
169+
```
170+
4. Upload the `.plist` or `.mobileconfig` file to your preferred MDM.
171+
5. Deploy the configuration profile to your devices.
172+
173+
For more information on configuring browser policies on macOS, refer to the [Google Chrome](https://support.google.com/chrome/a/answer/9020077?hl=en&ref_topic=7650028&sjid=15337530832025656704-NA) or [Microsoft Edge](https://learn.microsoft.com/en-us/deployedge/configure-microsoft-edge-on-mac) documentation.
174+
175+
</TabItem>
176+
</Tabs>
177+
178+
179+
180+
181+
182+
183+

‎src/content/partials/cloudflare-one/warp/device-enrollment.mdx‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,12 @@ import { Tabs, TabItem } from '~/components';
1919
Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.
2020
:::
2121

22-
4. In the **Login methods** tab, select the [identity providers](/cloudflare-one/identity/idp-integration/) users can authenticate with. If you have not integrated an identity provider, you can use the [one-time PIN](/cloudflare-one/identity/one-time-pin/).
22+
4. In the **Login methods** tab:
23+
24+
a. Select the [identity providers](/cloudflare-one/identity/idp-integration/) users can authenticate with. If you have not integrated an identity provider, you can use the [one-time PIN](/cloudflare-one/identity/one-time-pin/).
25+
26+
b. (Optional) If you plan to only allow access via a single IdP, turn on **Instant Auth**. End users will not be shown the Cloudflare Access login page. Instead, Cloudflare will redirect users directly to your SSO login event.
27+
2328
5. Select **Save**.
2429

2530
</TabItem> <TabItem label="Terraform (v5)">

0 commit comments

Comments
 (0)