Skip to content

Commit eb2cadc

Browse files
ranbelranbel
authored
[ZT] SCIM support for all IdPs (#18182)
* update supported idps * update partial params * check user registry * jumpcloud scim * break up jumpcloud steps * add generic instructions * remove extra line * add link to google workspace * add scim link to oidc idps * add scim link to named IdPs * remove scim from google workspace * group memberships must match
1 parent eec9f25 commit eb2cadc

File tree

17 files changed

+240
-85
lines changed

17 files changed

+240
-85
lines changed

‎src/content/docs/cloudflare-one/identity/idp-integration/centrify-saml.mdx‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ pcx_content_type: how-to
33
title: Centrify (SAML)
44
---
55

6-
Centrify secures access to infrastructure, DevOps, cloud, and other modern enterprise so you can prevent the #1 cause of breaches – privileged access abuse.
6+
Centrify secures access to infrastructure, DevOps, cloud, and other modern enterprise so you can prevent the number one cause of breaches: privileged access abuse.
77

8-
## Set up Centrify (SAML)
8+
## Set up Centrify as a SAML provider
99

10-
To set up SAML with Centrify as your identity provider:
10+
## 1. Create an application in Centrify
1111

1212
1. Log in to your **Centrify** admin portal and select **Apps**.
1313

@@ -59,15 +59,21 @@ To set up SAML with Centrify as your identity provider:
5959

6060
20. Select the **Manual Configuration** option.
6161

62-
21. In Zero Trust, go to **Settings** > **Authentication**.
62+
### 2. Add Centrify to Zero Trust
6363

64-
22. Under **Login methods**, select **Add new**.
64+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Authentication**.
6565

66-
23. Select SAML.
66+
2. Under **Login methods**, select **Add new**.
6767

68-
24. Copy and paste the corresponding information from Centrify into the fields.
68+
3. Select **SAML**.
6969

70-
25. Select **Save**.
70+
4. Copy and paste the corresponding information from Centrify into the fields.
71+
72+
5. (Optional) To enable SCIM, refer to [Synchronize users and groups](/cloudflare-one/identity/idp-integration/generic-saml/#synchronize-users-and-groups).
73+
74+
6. (Optional) Under **Optional configurations**, configure [additional SAML options](/cloudflare-one/identity/idp-integration/generic-saml/#optional-configurations).
75+
76+
7. Select **Save**.
7177

7278
To test that your connection is working, go to **Authentication** > **Login methods** and select **Test** next to the login method you want to test.
7379

‎src/content/docs/cloudflare-one/identity/idp-integration/centrify.mdx‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ Centrify secures access to infrastructure, DevOps, cloud, and other modern enter
77

88
## Set up Centrify as an OIDC provider
99

10+
### 1. Create an application in Centrify
11+
1012
1. Log in to the Centrify administrator panel.
1113

1214
2. Select **Apps**.
@@ -54,19 +56,23 @@ Centrify secures access to infrastructure, DevOps, cloud, and other modern enter
5456

5557
16. Select the roles to grant access to your application.
5658

57-
17. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Authentication**.
59+
### 2. Add Centrify to Zero Trust
60+
61+
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Authentication**.
62+
63+
2. Under **Login methods**, select **Add new**.
5864

59-
18. Under **Login methods**, select **Add new**.
65+
3. Paste in the **Client ID**, **Client Secret**, **Centrify account URL** and **Application ID**.
6066

61-
19. Paste in the **Client ID**, **Client Secret**, **Centrify account URL** and **Application ID**.
67+
4. (Optional) To enable SCIM, refer to [Synchronize users and groups](/cloudflare-one/identity/idp-integration/generic-oidc/#synchronize-users-and-groups).
6268

63-
20. (Optional) Under **Optional configurations**, enter [custom OIDC claims](/cloudflare-one/identity/idp-integration/generic-oidc/#oidc-claims) that you wish to add to your users' identity. This information will be available in the [user identity endpoint](/cloudflare-one/identity/authorization-cookie/application-token/#user-identity).
69+
5. (Optional) Under **Optional configurations**, enter [custom OIDC claims](/cloudflare-one/identity/idp-integration/generic-oidc/#oidc-claims) that you wish to add to your users' identity. This information will be available in the [user identity endpoint](/cloudflare-one/identity/authorization-cookie/application-token/#user-identity).
6470

65-
21. Select **Save**.
71+
6. Select **Save**.
6672

6773
To test that your connection is working, go to **Authentication** > **Login methods** and select **Test** next to the login method you want to test.
6874

69-
## **Example API Config**
75+
## Example API Config
7076

7177
```json
7278
{

‎src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ The Microsoft Entra ID integration allows you to synchronize IdP groups and auto
120120

121121
<Render
122122
file="access/enable-scim-on-dashboard"
123-
params={{ one: "Enable SCIM and Support groups" }}
123+
params={{ idp: "Entra ID", and: " and ", supportgroups: "Support groups"}}
124124
/>
125125

126126
### 2. Configure SCIM in Entra ID
@@ -159,6 +159,8 @@ SCIM requires a separate enterprise application from the one created during [ini
159159

160160
To check which users and groups were synchronized, select **View provisioning logs**.
161161

162+
<Render file="access/verify-scim-provisioning"/>
163+
162164
### Provisioning attributes
163165

164166
Provisioning attributes define the user properties that Entra ID will synchronize with Cloudflare Access. To modify your provisioning attributes, go to the **Provisioning** page in Entra ID and select **Edit attribute mappings**.

‎src/content/docs/cloudflare-one/identity/idp-integration/generic-oidc.mdx‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ sidebar:
55
order: 1
66
---
77

8+
import { Render } from "~/components";
9+
810
Cloudflare Access has a generic OpenID Connect (OIDC) connector to help you integrate IdPs not already set in Access.
911

1012
## Set up a generic OIDC
@@ -39,12 +41,41 @@ Cloudflare Access has a generic OpenID Connect (OIDC) connector to help you inte
3941

4042
8. (Optional) Enable [Proof of Key Exchange (PKCE)](https://www.oauth.com/oauth2-servers/pkce/) if the protocol is supported by your IdP. PKCE will be performed on all login attempts.
4143

42-
9. (Optional) Under **Optional configurations**, enter [custom OIDC claims](#oidc-claims) that you wish to add to users' identity. This information will be available in the [user identity endpoint](/cloudflare-one/identity/authorization-cookie/application-token/#user-identity).
44+
9. (Optional) To enable SCIM, refer to [Synchronize users and groups](#synchronize-users-and-groups).
45+
46+
10. (Optional) Under **Optional configurations**, enter [custom OIDC claims](#oidc-claims) that you wish to add to users' identity. This information will be available in the [user identity endpoint](/cloudflare-one/identity/authorization-cookie/application-token/#user-identity).
4347

44-
10. Select **Save**.
48+
11. Select **Save**.
4549

4650
To test that your connection is working, go to **Authentication** > **Login methods** and select **Test** next to the login method you want to test. On success, a confirmation screen displays.
4751

52+
## Synchronize users and groups
53+
54+
The generic OIDC integration allows you to synchronize user groups and automatically deprovision users using [SCIM](/cloudflare-one/identity/users/scim/).
55+
56+
### Prerequisites
57+
58+
Your identity provider must support SCIM version 2.0.
59+
60+
### 1. Enable SCIM in Zero Trust
61+
62+
<Render
63+
file="access/enable-scim-on-dashboard"
64+
params={{ idp: "IdP"}}
65+
/>
66+
67+
### 2. Configure SCIM in the IdP
68+
69+
Setup instructions vary depending on the identity provider. In your identity provider, you will either need to edit the [original SSO application](/cloudflare-one/identity/idp-integration/generic-oidc/#set-up-a-generic-oidc) or create a new SCIM application. Refer to your identity provider's documentation for more details. For example instructions, refer to our [Okta](/cloudflare-one/identity/idp-integration/okta/#synchronize-users-and-groups) or [Jumpcloud](/cloudflare-one/identity/idp-integration/jumpcloud-saml/#synchronize-users-and-groups) guides.
70+
71+
:::note
72+
If your IdP requires creating a new SCIM application, ensure that the groups in the SCIM application match the groups in the [original SSO application](/cloudflare-one/identity/idp-integration/generic-oidc/#set-up-a-generic-oidc). Because SCIM group membership updates will overwrite any groups in a user's identity, assigning the same groups to each app ensures consistent policy evaluation.
73+
:::
74+
75+
### 3. Verify SCIM provisioning
76+
77+
<Render file="access/verify-scim-provisioning"/>
78+
4879
## Optional configurations
4980

5081
### OIDC claims

‎src/content/docs/cloudflare-one/identity/idp-integration/generic-saml.mdx‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ sidebar:
55
order: 2
66
---
77

8+
import { Render } from "~/components";
9+
810
Cloudflare Zero Trust integrates with any identity provider that supports SAML 2.0. If your identity provider is not listed in the integration list of login methods in Zero Trust, it can be configured using SAML 2.0 (or OpenID if OIDC based). Generic SAML can also be used if you would like to pass additional SAML headers or claims for an IdP in the integration list.
911

1012
## Prerequisites
@@ -45,13 +47,41 @@ To download the SAML metadata file, copy-paste the metadata endpoint into a web
4547
2. Select **Add new** and select **SAML**.
4648
3. Choose a descriptive name for your identity provider.
4749
4. Enter the **Single Sign on URL**, **IdP Entity ID or Issuer URL**, and **Signing certificate** obtained from your identity provider.
48-
5. (Optional) Enter [optional configurations](#optional-configurations).
49-
6. Select **Save**.
50+
5. (Optional) To enable SCIM, refer to [Synchronize users and groups](#synchronize-users-and-groups).
51+
6. (Optional) Under **Optional configurations**, configure [additional SAML options](#optional-configurations).
52+
7. Select **Save**.
5053

5154
## 3. Test the connection
5255

5356
You can now [test the IdP integration](/cloudflare-one/identity/idp-integration/#test-idps-in-zero-trust). A success response should return the configured SAML attributes.
5457

58+
## Synchronize users and groups
59+
60+
The generic SAML integration allows you to synchronize user groups and automatically deprovision users using [SCIM](/cloudflare-one/identity/users/scim/).
61+
62+
### Prerequisites
63+
64+
Your identity provider must support SCIM version 2.0.
65+
66+
### 1. Enable SCIM in Zero Trust
67+
68+
<Render
69+
file="access/enable-scim-on-dashboard"
70+
params={{ idp: "IdP"}}
71+
/>
72+
73+
### 2. Configure SCIM in the IdP
74+
75+
Setup instructions vary depending on the identity provider. In your identity provider, you will either need to edit the [original SSO application](#1-create-an-application-in-your-identity-provider) or create a new SCIM application. Refer to your identity provider's documentation for more details. For example instructions, refer to our [Okta](/cloudflare-one/identity/idp-integration/okta/#synchronize-users-and-groups) or [JumpCloud](/cloudflare-one/identity/idp-integration/jumpcloud-saml/#synchronize-users-and-groups) guides.
76+
77+
:::note
78+
If your IdP requires creating a new SCIM application, ensure that the groups in the SCIM application match the groups in the [original SSO application](/cloudflare-one/identity/idp-integration/generic-saml/#1-create-an-application-in-your-identity-provider). Because SCIM group membership updates will overwrite any groups in a user's identity, assigning the same groups to each app ensures consistent policy evaluation.
79+
:::
80+
81+
### 3. Verify SCIM provisioning
82+
83+
<Render file="access/verify-scim-provisioning"/>
84+
5585
## Optional configurations
5686

5787
SAML integrations allow you to pass additional headers or claims to applications.

‎src/content/docs/cloudflare-one/identity/idp-integration/gsuite.mdx‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ You do not need to be a Google Cloud Platform user to integrate Google Workspace
1616

1717
## Set up Google Workspace as an identity provider
1818

19+
### 1. Configure Google Workspace
20+
1921
1. Log in to the Google Cloud Platform [console](https://console.cloud.google.com/). This is separate from your Google Workspace console.
2022

2123
2. A Google Cloud project is required to enable Google Workspace APIs. If you do not already have a Google Cloud project, go to **IAM & Admin** > **Create Project**. Name the project and select **Create**.
@@ -66,21 +68,21 @@ You do not need to be a Google Cloud Platform user to integrate Google Workspace
6668

6769
15. Enable the **Trust internal, domain-owned apps** option. This setting is disabled by default and must be enabled for Cloudflare Access to work correctly.
6870

69-
16. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Authentication**.
71+
### 2. Add Google Workspace to Zero Trust
7072

71-
17. Under **Login methods**, select **Add new** and choose **Google Workspace**.
73+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Authentication**.
7274

73-
18. Input the Client ID and Client Secret fields generated previously. Additionally, input the domain of your Google Workspace account.
75+
2. Under **Login methods**, select **Add new** and choose **Google Workspace**.
7476

75-
19. (Optional) Enable [Proof of Key Exchange (PKCE)](https://www.oauth.com/oauth2-servers/pkce/). PKCE will be performed on all login attempts.
77+
3. Input the Client ID and Client Secret fields generated previously. Additionally, input the domain of your Google Workspace account.
7678

77-
20. (Optional) Under **Optional configurations**, enter [custom OIDC claims](/cloudflare-one/identity/idp-integration/generic-oidc/#oidc-claims) that you wish to add to your Access [application token](/cloudflare-one/identity/authorization-cookie/application-token/).
79+
4. (Optional) Enable [Proof of Key Exchange (PKCE)](https://www.oauth.com/oauth2-servers/pkce/). PKCE will be performed on all login attempts.
7880

79-
21. Select **Save**. To complete setup, you must visit the generated link. If you are not the Google Workspace administrator, share the link with the administrator.
81+
5. (Optional) Under **Optional configurations**, enter [custom OIDC claims](/cloudflare-one/identity/idp-integration/generic-oidc/#oidc-claims) that you wish to add to your Access [application token](/cloudflare-one/identity/authorization-cookie/application-token/).
8082

81-
22. The generated link will prompt you to log in to your Google admin account and to authorize Cloudflare Access to view group information. After allowing permissions, you will see a success page from Cloudflare Access.
83+
6. Select **Save**. To complete setup, you must visit the generated link. If you are not the Google Workspace administrator, share the link with the administrator.
8284

83-
## Test your connection
85+
7. The generated link will prompt you to log in to your Google admin account and to authorize Cloudflare Access to view group information. After allowing permissions, you will see a success page from Cloudflare Access.
8486

8587
To test that your connection is working, go to **Authentication** > **Login methods** and select **Test** next to Google Workspace. Your user identity and group membership should return.
8688

‎src/content/docs/cloudflare-one/identity/idp-integration/jumpcloud-saml.mdx‎

Lines changed: 59 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,16 @@ pcx_content_type: how-to
33
title: JumpCloud (SAML)
44
---
55

6+
import { Render } from "~/components";
7+
68
[JumpCloud](https://jumpcloud.com/#platform) provides SSO identity management. Cloudflare Access integrates with JumpCloud as a SAML identity provider.
79

10+
The following steps are specific to setting up JumpCloud with Cloudflare Access. For more information on configuring JumpCloud SSO application, refer to the [JumpCloud documentation](https://jumpcloud.com/support/integrate-with-cloudflare).
11+
812
## Set up Jumpcloud as a SAML provider
913

14+
### 1. Create an SSO application in JumpCloud
15+
1016
1. In the [JumpCloud Admin Portal](https://console.jumpcloud.com/#/home), go to **SSO Applications**.
1117

1218
2. Select **Add New Application**.
@@ -34,24 +40,71 @@ title: JumpCloud (SAML)
3440
```txt
3541
https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback
3642
```
37-
3. Scroll up to **JumpCloud Metadata** and select **Export Metadata**. Save this XML file for use in a later step.
43+
3. (Optional) Configure SAML attributes that you want to send to Cloudflare Access.
44+
45+
4. Scroll up to **JumpCloud Metadata** and select **Export Metadata**. Save this XML file for use in a [later step](#2-add-jumpcloud-to-zero-trust).
3846

3947
9. In the **User Groups** tab, [assign user groups](https://jumpcloud.com/support/get-started-applications-saml-sso#managing-employee-access-to-applications) to this application.
4048

4149
10. Select **Save**.
4250

43-
11. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Authentication**.
51+
### 2. Add JumpCloud to Zero Trust
52+
53+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Authentication**.
54+
55+
2. Under **Login methods**, select **Add new**.
56+
57+
3. Select **SAML**.
4458

45-
12. Under **Login methods**, select **Add new**.
59+
4. Upload your JumpCloud XML metadata file.
4660

47-
13. Select **SAML**.
61+
5. (Optional) To enable SCIM, refer to [Synchronize users and groups](#synchronize-users-and-groups).
4862

49-
14. Upload your JumpCloud XML metadata file.
63+
6. (Optional) Under **Optional configurations**, configure [additional SAML options](#optional-configurations).
5064

51-
15. Select **Save**.
65+
7. Select **Save**.
5266

5367
You can now [test your connection](/cloudflare-one/identity/idp-integration/#test-idps-in-zero-trust) and create [Access policies](/cloudflare-one/policies/access/) based on the configured login method and SAML attributes.
5468

69+
## Synchronize users and groups
70+
71+
The JumpCloud integration allows you to synchronize user groups and automatically deprovision users using [SCIM](/cloudflare-one/identity/users/scim/).
72+
73+
### 1. Enable SCIM in Zero Trust
74+
75+
<Render
76+
file="access/enable-scim-on-dashboard"
77+
params={{ idp: "JumpCloud"}}
78+
/>
79+
80+
### 2. Configure SCIM in JumpCloud
81+
82+
1. In the [JumpCloud Admin Portal](https://console.jumpcloud.com/#/home), go to **SSO Applications**.
83+
2. Select the Cloudflare application that was created when you [Set up JumpCloud as a SAML provider](/cloudflare-one/identity/idp-integration/jumpcloud-saml/#set-up-jumpcloud-as-a-saml-provider).
84+
3. Select the **Identity Management** tab.
85+
4. Make sure that **Enable management of User Groups and Group Membership in this application** is turned on.
86+
5. Select **Configure**.
87+
6. In the **Base URL** field, enter the **SCIM Endpoint** obtained from Zero Trust.
88+
7. In the **Token Key** field, enter the **SCIM Secret** obtained from Zero Trust.
89+
8. Select **Activate**. You will receive a confirmation that the Identity Management integration has been successfully verified.
90+
9. Select **Save**.
91+
92+
<Render file="access/verify-scim-provisioning"/>
93+
94+
### Provisioning attributes
95+
96+
Provisioning attributes define the user and group properties that JumpCloud will synchronize with Cloudflare Access. By default, JumpCloud will send the following attributes during a SCIM update event:
97+
98+
| JumpCloud user attribute| Cloudflare Access attribute |
99+
| ------------------ | ----------------------- |
100+
| `email` | `email` |
101+
| `firstname` | `givenName` |
102+
| `lastname` | `surname` |
103+
104+
| JumpCloud group attribute | Cloudflare Access attribute |
105+
| ------------------ | ----------------------- |
106+
| `name` | `groups` |
107+
55108
## Example API configuration
56109

57110
```json

‎src/content/docs/cloudflare-one/identity/idp-integration/okta.mdx‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ The Okta integration allows you to synchronize IdP groups and automatically depr
9292

9393
<Render
9494
file="access/enable-scim-on-dashboard"
95-
params={{ one: "Enable SCIM " }}
95+
params={{ idp: "Okta"}}
9696
/>
9797

9898
### 2. Configure SCIM in Okta
@@ -139,7 +139,9 @@ The Okta integration allows you to synchronize IdP groups and automatically depr
139139

140140
15. In the **Push Groups** tab, add the Okta groups you want to synchronize with Cloudflare Access. These groups will display in the Access policy builder.
141141

142-
Provisioning will begin immediately. To verify the integration, select **View Logs** in the Okta SCIM application.
142+
To verify the integration, select **View Logs** in the Okta SCIM application.
143+
144+
<Render file="access/verify-scim-provisioning"/>
143145

144146
## Example API Configuration
145147

0 commit comments

Comments
 (0)