Skip to content

Commit 8d653af

Browse files
ranbelranbel
committed
style guide revisions
1 parent aa23c33 commit 8d653af

File tree

1 file changed

+59
-59
lines changed

1 file changed

+59
-59
lines changed

‎src/content/docs/cloudflare-one/tutorials/extend-sso-with-serverless.mdx‎

Lines changed: 59 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,26 @@
11
---
2-
updated: 2024-08-13
2+
updated: 2024-09-30
33
category: 🔐 Zero Trust
44
difficulty: Advanced
55
pcx_content_type: tutorial
6-
content_type: 📝 Tutorial
7-
title: Augment Clouflare Access SSO capabilities with Cloudflare Workers
6+
title: Send SSO attributes to Access-protected origins with Workers
87
---
98

109
import { Render, GlossaryTooltip } from "~/components"
1110

12-
This tutorial will walk you through extending the single-sign-on (SSO) capabilities of [Cloudflare Access](/cloudflare-one/policies/access/) with Serverless using [Cloudflare Workers](/workers/). Specifically, this guide will demonstrate how to modify requests sent to your secured origin to include additional information from the Cloudflare Access authentication event.
11+
This tutorial will walk you through extending the single-sign-on (SSO) capabilities of [Cloudflare Access](/cloudflare-one/policies/access/) with our serverless computing platform, [Cloudflare Workers](/workers/). Specifically, this guide will demonstrate how to modify requests sent to your secured origin to include additional information from the Cloudflare Access authentication event.
1312

14-
Time to complete: **45 minutes**
13+
**Time to complete:** 45 minutes
1514

1615
## Authentication flow
1716

1817
[Cloudflare Access](/cloudflare-one/policies/access/) is an authentication proxy in charge of validating a user's identity before they connect to your application. As shown in the diagram below, Access inserts a [JWT](/cloudflare-one/identity/authorization-cookie/application-token/) into the request, which can then be [verified](/cloudflare-one/identity/authorization-cookie/validating-json/#validate-jwts) by the origin server.
1918

20-
![extendedflow](~/assets/images/cloudflare-one/applications/access-standard-flow.png)
19+
![Standard authentication flow for a request to an Access application](~/assets/images/cloudflare-one/applications/access-standard-flow.png)
2120

22-
You can extend this functionality by using a [Cloudflare Worker](/workers/) to insert additional HTTP headers into the request. In this example, we will add the [device posture attributes](/cloudflare-one/identity/devices/#enforce-device-posture) `firewall_activated` and `disk_encrypted`, but you can include any attributes that Cloudflare Access collects from the authentication event.
21+
You can extend this functionality by using a Cloudflare Worker to insert additional HTTP headers into the request. In this example, we will add the [device posture attributes](/cloudflare-one/identity/devices/#enforce-device-posture) `firewall_activated` and `disk_encrypted`, but you can include any attributes that Cloudflare Access collects from the authentication event.
2322

24-
![standardflow](~/assets/images/cloudflare-one/applications/access-extended-flow-serverless.png)
23+
![Extended authentication flow uses a Worker to pass additional request headers to the origin](~/assets/images/cloudflare-one/applications/access-extended-flow-serverless.png)
2524

2625
## Benefits
2726

@@ -42,65 +41,65 @@ This approach allows you to:
4241

4342
1. Create a new Workers project:
4443

45-
```sh
46-
npm create cloudflare@latest -- device-posture-worker
47-
```
44+
```sh
45+
npm create cloudflare@latest -- device-posture-worker
46+
```
4847

49-
<Render file="c3-post-run-steps" product="workers" params={{ one: "Hello World example", two: "Hello World Worker", three: "JavaScript" }} />
48+
<Render file="c3-post-run-steps" product="workers" params={{ one: "Hello World example", two: "Hello World Worker", three: "JavaScript" }} />
5049

5150
2. Change to the project directory:
5251

53-
```sh
54-
$ cd device-posture-worker
55-
```
52+
```sh
53+
$ cd device-posture-worker
54+
```
5655

5756
3. Copy-paste the following code into `src/index.js`. Be sure to replace `<your-team-name>` with your Zero Trust <GlossaryTooltip term="team name">team name</GlossaryTooltip>.
5857

59-
```js title="index.js"
60-
61-
import { parse } from "cookie";
62-
export default {
63-
async fetch(request, env, ctx) {
64-
// The name of the cookie
65-
const COOKIE_NAME = "CF_Authorization";
66-
const CF_GET_IDENTITY = "https://<your-team-name>.cloudflareaccess.com>/cdn-cgi/access/get-identity";
67-
const cookie = parse(request.headers.get("Cookie") || "");
68-
if (cookie[COOKIE_NAME] != null) {
69-
try {
70-
let id = await (await fetch(CF_GET_IDENTITY, request)).json()
71-
let diskEncryptionStatus = false;
72-
let firewallStatus = false;
73-
74-
for (const checkId in id.devicePosture) {
75-
const check = id.devicePosture[checkId];
76-
if (check.type === "disk_encryption") {
77-
console.log(check.type)
78-
diskEncryptionStatus = check.success;
79-
}
80-
if (check.type === "firewall") {
81-
console.log(check.type)
82-
firewallStatus = check.success;
83-
break;
84-
}
85-
}
86-
//clone request (immutable otherwise) and insert posture values in new header set
87-
let newRequest = await new Request(request)
88-
newRequest.headers.set("Cf-Access-Firewall-Activated", firewallStatus)
89-
newRequest.headers.set("Cf-Access-Disk-Encrypted", firewallStatus)
90-
91-
//sent modified request to origin
92-
return await fetch(newRequest)
93-
94-
} catch (e) {
95-
console.log(e)
96-
return await fetch(request)
97-
}
98-
}
99-
return await fetch(request)
100-
},
101-
};
58+
```js title="index.js"
59+
60+
import { parse } from "cookie";
61+
export default {
62+
async fetch(request, env, ctx) {
63+
// The name of the cookie
64+
const COOKIE_NAME = "CF_Authorization";
65+
const CF_GET_IDENTITY = "https://<your-team-name>.cloudflareaccess.com>/cdn-cgi/access/get-identity";
66+
const cookie = parse(request.headers.get("Cookie") || "");
67+
if (cookie[COOKIE_NAME] != null) {
68+
try {
69+
let id = await (await fetch(CF_GET_IDENTITY, request)).json()
70+
let diskEncryptionStatus = false;
71+
let firewallStatus = false;
72+
73+
for (const checkId in id.devicePosture) {
74+
const check = id.devicePosture[checkId];
75+
if (check.type === "disk_encryption") {
76+
console.log(check.type)
77+
diskEncryptionStatus = check.success;
78+
}
79+
if (check.type === "firewall") {
80+
console.log(check.type)
81+
firewallStatus = check.success;
82+
break;
83+
}
84+
}
85+
//clone request (immutable otherwise) and insert posture values in new header set
86+
let newRequest = await new Request(request)
87+
newRequest.headers.set("Cf-Access-Firewall-Activated", firewallStatus)
88+
newRequest.headers.set("Cf-Access-Disk-Encrypted", firewallStatus)
10289

103-
```
90+
//sent modified request to origin
91+
return await fetch(newRequest)
92+
93+
} catch (e) {
94+
console.log(e)
95+
return await fetch(request)
96+
}
97+
}
98+
return await fetch(request)
99+
},
100+
};
101+
102+
```
104103

105104
## 2. View the user's identity
106105

@@ -177,6 +176,7 @@ Below is an example of a user identity that includes the `disk_encryption` and `
177176
## 3. Route the Worker to your application
178177

179178
In `wrangler.toml`, [set up a route](/workers/configuration/routing/routes/) that maps the Worker to your Access application domain:
179+
180180
```toml
181181
route = { pattern= "app.example.com/*", zone_name="example.com"}
182182
```

0 commit comments

Comments
 (0)