Cbox ID
Cloudflare Access
Cloudflare Access
Single sign-on (SAML 2.0)
In the portal, choose Cloudflare Access under Enterprise SSO and Start with Cloudflare Access. Then, in Cloudflare Access:
- In Cloudflare Zero Trust, go to Access controls → Applications, select Create new application, then SaaS application.
- Type a custom name in the Application field, select SAML, and add the application.
- Enter the Entity ID and Assertion Consumer Service URL below, and set Name ID Format to Email.
- Copy the SSO endpoint — its metadata is at <SSO endpoint>/saml-metadata.
- Add an Allow policy, choose the identity providers, and create the application.
The values the portal shows
| Cloudflare Access field | Value |
|---|---|
| Entity ID | The portal's entity ID (https://…/sso/saml/…) |
| Assertion Consumer Service URL | The portal's ACS URL (https://…/sso/saml/…/acs) |
| Name ID Format | Email |
What to bring back
Copy SSO endpoint and paste it into the portal's Metadata URL or XML.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
Cloudflare Access's own guide: https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-saml-saas/.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.