Subscribe to receive notifications of new posts:

Now You Can Setup Centrify, OneLogin, Ping and Other Identity Providers with Cloudflare Access

2018-04-23

4 min read

We use Cloudflare Access to secure our own internal tools instead of a VPN. As someone that does a lot of work on the train, I can attest this is awesome (though I might be biased). You can see it in action below. Instead of having to connect to a VPN to reach our internal jira, we just login with our Google account and we are good to go:

CFAccess-JIRAv3

Before today, you could setup Access if you used GSuite, Okta or Azure AD to manage your employee accounts. Today we would like to announce support for two more Identity Providers with Cloudflare Access: Centrify and OneLogin.

We launched Cloudflare Access earlier this year and have been overwhelmed by the response from our customers and community. Customers tell us they love the simplicity of setting up Access to secure applications and integrate with their existing identity provider solution. Access helps customers implement a holistic solution for both corporate and remote employees without having to use a VPN.

If you are using Centrify or OneLogin as your identity provider you can now easily integrate them with Cloudflare Access and have your team members login with their accounts to securely reach your internal tools.

CFAccess-ssov3

Oh and one last thing, We have a new generic connector which allows you to integrate any OIDC based identity provider with Cloudflare Access. OpenID Connect (OIDC) is supported by many identity providers (some popular OIDC based Identity Providers are Ping Identity and Forgerock)

If you’re eager to get started, steps are below for configuring OneLogin, Centrify and a custom OIDC provider. Each take about 3-5 minutes. Hope you enjoy!

Steps for setting up Centrify

Login to your Centrify admin portal and click on apps.

cfy1

Click on Add Web Apps and navigate to custom tab. Scroll down and click Add on OpenID Connect.

cfy2

cfy3

Click Yes on the Application modal to create an OpenID Connect app.

cfy4

Enter an Application ID and click save.

cfy5

Navigate to the trust tab and enter a strong application secret. Under the Service Provider configuration enter your application's authentication domain as the Resource application URL. Click Add on Authorized redirect URIs and put your authentication domain/cdn-cgi/access/callback. Click Save.

cfy6

cfy7

cfy8-1

Now copy your Client ID, Client Secret, OpenID Connect Issuer URL without the forward slash and Application ID from Settings tab in the Centrify dashboard and then paste them into the Cloudflare dashboard.

Steps for setting up OneLogin

Login to your Onelogin admin portal and click on custom connectors.

ol1

Click on New Connector

ol2

Name the connector and select OpenID Connect as the sign on method.In the redirect URI field, put your authentication domain/cdn-cgi/access/callback. Click Save.

ol3

Click on More Actions and select Add App to Connector.

ol4

Name the app and click save.

ol5

Navigate to the SSO tab and click on show client secret.

ol6-1

Now copy your Client ID and Client Secret from the Onelogin dashboard and then paste them into the Cloudflare dashboard.

Setting up a custom identity provider using OIDC

The following are the information you would need from your identity provider into the Cloudflare Dashboard.

  • Client ID and Client Secret: IdPs let you create a client or an app for each custom integration. You can create one for Access and grab the client id and secret.

  • Auth URL: This is the authorization_endpoint URL of your IdP.

  • Token URL: This is the token_endpoint URL of your IdP.

  • Certificate URL: The jwks_uri endpoint of your IdP is where you get the keys used by the IdP to sign the tokens.

All the above endpoint values can be obtained from your IdP's OIDC discovery endpoint which is also called as the well-known URL. For example if you use Ping as your identity the URL would be <hostname>/.well-known/openid-configuration

Give your IdP connector a name of your choice by entering it in the Name field.

In your IdP's Authorized redirect URI field, put your authentication domain/cdn-cgi/access/callback URL.

Cloudflare's connectivity cloud protects entire corporate networks, helps customers build Internet-scale applications efficiently, accelerates any website or Internet application, wards off DDoS attacks, keeps hackers at bay, and can help you on your journey to Zero Trust.

Visit 1.1.1.1 from any device to get started with our free app that makes your Internet faster and safer.

To learn more about our mission to help build a better Internet, start here. If you're looking for a new career direction, check out our open positions.
Cloudflare AccessAuthenticationProduct NewsSecurity

Follow on X

Cloudflare|@cloudflare

Related posts

September 27, 2024 1:00 PM

AI Everywhere with the WAF Rule Builder Assistant, Cloudflare Radar AI Insights, and updated AI bot protection

This year for Cloudflare’s birthday, we’ve extended our AI Assistant capabilities to help you build new WAF rules, added new AI bot & crawler traffic insights to Radar, and given customers new AI bot blocking capabilities...

September 27, 2024 1:00 PM

Advancing cybersecurity: Cloudflare implements a new bug bounty VIP program as part of CISA Pledge commitment

Cloudflare strengthens its commitment to cybersecurity by joining CISA's "Secure by Design" pledge. In line with this commitment, we're enhancing our vulnerability disclosure policy by launching a VIP bug bounty program, giving top researchers early access to our products. Keep an eye out for future updates regarding Cloudflare's CISA pledge as we work together to shape a safer digital future....

September 26, 2024 1:00 PM

Making Workers AI faster and more efficient: Performance optimization with KV cache compression and speculative decoding

With a new generation of data center accelerator hardware and using optimization techniques such as KV cache compression and speculative decoding, we’ve made large language model (LLM) inference lightning-fast on the Cloudflare Workers AI platform....

September 26, 2024 1:00 PM

Zero-latency SQLite storage in every Durable Object

Traditional cloud storage is inherently slow because it is accessed over a network and must synchronize many clients. But what if we could instead put your application code deep into the storage layer, such that your code runs where the data is stored? Durable Objects with SQLite do just that. ...