Connect Cloudflare

Learn how to configure a connection to Cloudflare via SAML

Introduction

Each SSO Identity Provider requires specific information to create and configure a new Connection. Often, the information required to create a Connection will differ by Identity Provider.

To create a Cloudflare SAML Connection, you’ll need to manually enter the SSO URL, IdP Entity ID, and X.509 Certificate obtained from your Cloudflare instance. Instructions on where to obtain these will be covered in this guide.

WorkOS Provides

The first thing you'll need to do is create a new Cloudflare SAML connection in your WorkOS Dashboard. Start by logging in to your WorkOS dashboard and browse to the "Organizations" tab on the left hand navigation bar.

Select the organization you'd like to configure a Cloudflare SAML Connection for, and from the dropdown menu select "Add Connection".

Select "Cloudflare SAML" as the Identity Provider and give the Connection a descriptive name. Once this is filled out, click "Create Connection".

WorkOS provides the ACS URL and the SP Entity ID. These are available in your Connection’s Settings in the Developer Dashboard.

The ACS URL is the location an Identity Provider redirects its authentication response to. In Cloudflare’s case, it needs to be set by the Enterprise when configuring the application in the Cloudflare instance.

The SP Entity ID is a URI used to identify the issuer of a SAML request. In this case, the entity ID is used to communicate that WorkOS will be the party performing SAML requests to the Enterprise's Cloudflare instance.

Overview

Cloudflare SAML is a unique integration in that it sits between WorkOS and the Identity Provider. This allows for additional rules to be configured, but also means there are two connections that need to be made. The first necessary connection is between Cloudflare and the IdP, and the second connection is between WorkOS and Cloudflare.

1

Connect Cloudflare with your Identity Provider

First, create the connection between Cloudflare and the Identity Provider. Cloudflare Access allows you to connect with any IdP that supports a SAML 2.0 connection. Follow the documentation from Cloudflare to configure a SAML application connection between Cloudflare and your IdP.

The one deviation from the CloudFlare documentation is that the SAML attributes must include email, firstName, lastName, and id. Email is included by default as the "Email attribute name", but you will need to add the other three as SAML attributes.

When setting up the connection, be sure to enter email, firstName, lastName, and id as SAML attributes.

Save the connection and then click the "Test" button. When successful, you will see a success screen including your saml_attributes that have been added.

2

Add an Application in Cloudflare Access

Next, create the connection between Cloudflare and WorkOS. From the Cloudflare Zero Trust dashboard Access menu, select "Applications", then "Add an application".

Select "SaaS" for the type of application.

Copy the ACS URL and Entity ID from the Connection Settings in your WorkOS Dashboard.

Select the name of your application from the dropdown menu. If your application is not listed, type the name to save it.

Paste the ACS URL and SP Entity ID to the corresponding fields in Cloudflare. Then select the Name ID Format that you would like to use for this application. For this example we’ll use Unique ID.

3

Configure Attribute Mapping

Now, Configure the attribute statements. WorkOS requires that email, firstName, lastName, and id be included. Cloudflare automatically sends id and email, so you just need to add firstName and lastName. These attributes were configured in Step 1, and the mapped values are the same here.

Add firstName and lastName to both the right and left sides of the SAML attribute statements.

Select the Identity Provider that you are using from the list. In this example we are using an Okta SAML connection.

Configure at least one policy and one rule, then click next. For this example the Policy sets the session length to 30 minutes for everyone.

4

Copy Connection Credentials

The SSO endpoint, Entity ID, and Public key (X.509 certificate) all will be entered in the Connection details in the WorkOS Dashboard. The SSO endpoint and Entity ID can be entered as-is, but the Public Key needs to be formatted as an X.509 certificate.

To format the Public Key, copy the value to a text editor and add the following header and footer, along with two equal characters at the end of the Public Key, "==". Ensure there are no spaces above or below the Key value, then save with the file extension ".cert".

Certificate Format

-----BEGIN CERTIFICATE-----
<PUBLIC KEY VALUE>==
-----END CERTIFICATE-----

The file should look like this when you’re finished. Note that there are two equal characters, ==, appended to the end of the Public Key. These must be added manually.

Completed Certificate Format

-----BEGIN CERTIFICATE-----
MIIDUTCCAjmgAwIBAgIRAN557boQ2ZxW4Ww08cZYK2IwDQYJKoZIhvcNAQELBQAw
YjELMAkGA1UEBhMCVVMxDjAMxxxxxAgTBVRleGFzMQ8wDQYDVQQHEwZBdXN0aW4x
EzARBgNVBAoTCkNsb3VkZmxhcmUxHTAbBgNVBAMTFGNsb3VkZmxhcmVhY2Nlc3Mu
Y29tMB4XDTxxxxxwMjE5MzMxM1oXDTMyMDIwMjE5MzMxM1owYjELMAkGA1UEBhMC
VVMxDjAMBgNVBAgTBVRleGFzMQ8wDQYDVQQHEwZBdXN0aW4xEzARBgNVBAoTCkNs
b3VkZmxhcmUxHTAbBgNVBAMTFGNsb3VkZmxxxxxhY2Nlc3MuY29tMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA49p6jXzk65DeG4DI2NgW0UOOJrd+9qYS
OCuBYq/e4IqSeqchsm1JDY9MjB6xmiw+urC1qWuj0MS4dwAJQwiGFbCGDh5m4FAF
mZm5VaMkW5Q+MG5zXRfeLmhvLuT0XVBcDlkwPC3k28/moKi1KlwPcujLF43+rf2d
8Rm6ZNCJgfVzRxxxxxPd5NGpNlEZ0ViPXM1gsO15/1Iginevv+xKqRTx0vMsNLWJ
BwWLAAqm5b6U9XQefwy9lPqPywFwCuZEMXwI9Rpm0f2xmOK56EudtdSkQ1JtSgYX
x9rf/97NfP8wI2x1IncQtwdWNdW5cvxMqYU/Za6WZvjNCnpFQGXLJQIDAQABowIw
ADANBgkqhkiG9w0BAQsFAAOCAQEARZ0h2ZeNXSme0EbQeJfEFOX+mj9rPkHIJFfQ
G7+dRG6DwDubxG56TsvUINcJX8O5C6oQ0T6dRutO/jG5LxJqmCz5wLUTA/6/YLDk
95gbYyJ/yfLm4sd6DEoXzWSld+EZ5b86pxFnvR/+cPY2tcSghQ+moZKR5THwHLsZ
hie2Pr6UVvuS5D9BC4ijR+cPyB5r4qliI9C1p8phuZctoX9dPpFY+UwkWgUDx9sz
UXFJsqueoibxfVqh4Jzdw+2XH6xN3WvTdJN4Sh1fqEpBeOxxxxxlRrCAJiMnLtG6
QgHF9ZnNRbIFcUHF/lyWY3oxcvgeUwEnE5QVVbdoMMGKKgffbQ==
-----END CERTIFICATE-----
5

Provide Connection Credentials

Navigate to the Connection in your Developer Dashboard. Enter the SSO endpoint in the IdP SSO URL field and enter the "Access Entity ID or Issuer" value into the "IdP URI (Entity ID)" field.

Upload the file that you saved for the X.509 certificate to the "Add an X.509 Certificate" field. Click Save Configuration.

Your Connection will then be Active and good to go!