Has anyone done an integration with Cloudflare Access

[Greg Haverkamp]

We've done a three Cloudflare Access integrations so far.

The odd integrations occasionally run together, but it could be that
CloudFlare was one that used what I considered backward terminology for the
IdP and SP entity ID's.  (I know I had one of those in recent months.) I
don't actually have access to our CF admin consoles, so I can't look for
sure. But I do know that the process only took 10 minutes or so to get
going.

I imagine we manually configured it.  I can get someone to give me the
config details, if that would be helpful.

(My biggest integration problem so far has been that one of my colleagues
likes to leave the validUntil attributes in their metadata, and I've been
contacted when the CF Access logins suddenly fail.)

Greg

On Fri, Oct 23, 2020 at 9:00 AM Darren Boss <darren.boss at computecanada.ca>
wrote:

> Cloudflare access is their VPN alternative that requires
> authentication before the request gets proxied over the CloudFlare
> network.
>
> https://www.cloudflare.com/teams/access/
>
> I've tried integration with both SAML (version 4.0.1) and OIDC with
> the 2.0.0 extension and can't get either to work. They allow for
> upload of your IdP metadata but when I do that it chooses the
> HTTP-POST url but does a get request. After loading the metadata or if
> you ignore the metadata upload feature you can just fill in the fields
> directly so I switch to the redirect url, waited for the change to
> propagate and then I got an error because the entityid was set to the
> entityid of the IdP and not the SP? Very odd.
>
> I gave up and tried OIDC but my email claim is not available after
> auth. I watched the logs on the IdP from a known working OIDC client
> and it looks like Cloudflare is not using the userinfo endpoint. They
> only have three fields when entering OIDC info, auth, token and
> certificate and they don't seem to support discovery. Only the sub
> claim was available to Cloudflare but I did get release consent for
> email. I have "openid email profile" configured in the scope in the
> cloudflare metadata.
>
> I can provide more information (logs and configuration) but I was
> hoping that maybe someone has done this integration and knows how to
> get this working with Shibboleth using either SAML or OIDC.
> --
> Darren Boss
> Senior Programmer/Analyst
> Programmeur-analyste principal
> darren.boss at computecanada.ca
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20201025/50d4a793/attachment.htm>