跳转到主要内容

Okta

Okta provides cloud software that helps companies manage and secure user authentication to modern applications, and helps developers build identity controls into applications, website web services, and devices. You can integrate Okta with Cloudflare One and build rules based on user identity and group membership. Cloudflare One supports Okta integrations using either the OIDC (default) or SAML protocol.

Additionally, you can configure Okta to use risk information from Cloudflare One user risk scores to create SSO-level policies. For more information, refer to Send risk score to Okta.

Prerequisites

Supported features

  • SP-initiated SSO: When a user goes to an Access application, Access redirects them to sign in with Okta.
  • SCIM provisioning: Synchronize Okta groups and automatically deprovision users. SCIM currently requires a separate custom OIDC application.

Set up Okta as an OIDC provider (Okta App Catalog)

:::note[Active Directory limitation] The Okta App Catalog template does not support synchronizing Active Directory groups. If you would like to build policies using AD groups, use the Okta OIDC app integration or SAML app integration. :::

To set up the Okta integration using the Okta Integration Network (OIN) App Catalog:

  1. Log in to your Okta admin dashboard.

  2. Go to Applications > Applications.

  3. Select Browse App Catalog.

  4. Search for Cloudflare and select the Cloudflare One app.

  5. Select Add integration.

  6. In Application label, enter a name for the application (for example, Cloudflare Access).

  7. In Team domain, enter your Cloudflare Zero Trust team name (only the subdomain prefix, do not include .cloudflareaccess.com):

    <your-team-name>

  8. In the Sign On tab, copy the Client ID and Client secret and paste these into App ID and Client secret.

  9. Copy your Okta Account URL (without the -admin value) and copy it into the Cloudflare Okta setup field.

Set up Okta as an OIDC provider (Custom App Integration)

  1. Log in to your Okta admin dashboard and go to Applications > Applications.

  2. Select Create App Integration.

  3. For the Sign-in method, select OIDC - OpenID Connect.

    Creating an OIDC application in Okta

  4. For the Application type, select Web Application. Select Next.

  5. Enter any name for the application. In the Sign-in redirect URIs field, enter the following URL:

    https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback

  6. Choose the desired Assignment option and select Save.

  7. From the application view, go to the Sign On tab.

  8. Scroll down to Token claims and select Show legacy configuration > Edit.

    Configuring the Groups claim filter in Okta

  9. Set Groups claim filter to Matches regex and its value to .*.

:::note[Token claim expressions]

  • Groups managed outside of Okta (for example, Microsoft Entra ID or Google groups) may require different regex values. For more information, refer to the Okta documentation on Groups Claims and OpenID Connect Claims.
  • To configure more complex expressions, refer to Okta's token claims documentation. :::

  1. In the General tab, copy the Client ID and Client secret.

    Finding your Client credentials in Okta

Synchronize users and groups

The Okta integration allows you to synchronize IdP groups and automatically deprovision users using SCIM. To enable SCIM provisioning between Access and Okta, you need two separate app integrations in Okta:

  • The OIDC application you created when adding Okta as an identity provider. You can create this application via the Okta App Catalog or via a Custom App Integration.
  • A second Okta application of type SCIM 2.0 Test App (Header Auth). This is technically a SAML app but is responsible for sending user and group info via SCIM.

:::note If you would like to only maintain one Okta app instance, Okta does support SAML and SCIM within the same application. Create a generic SAML integration and configure those values in the Sign-On field of your Okta SCIM application. :::

1. Enable SCIM in Cloudflare One

2. Configure SCIM in Okta

  1. On your Okta admin dashboard, go to Applications > Applications.

  2. Select Browse App Catalog.

  3. Search for SCIM Header Auth and select SCIM 2.0 Test App (Header Auth).

  4. Select Add Integration.

  5. On the General Settings tab, name your application and select Next.

  6. On the Sign-on Options tab, ensure that SAML 2.0 is selected.

  7. Under Credential Details, set Application username format to either Okta Username or Email. This value will be used for the SCIM userName attribute. :::note The userName attribute must match the user's email address in Cloudflare One. :::

  8. Select Done to create the integration.

  9. On the Provisioning tab, select Configure API Integration.

  10. Select Enable API integration.

  11. In the Base URL field, enter the SCIM Endpoint obtained from Cloudflare One.

  12. In the API Token field, enter the SCIM Secret obtained from Cloudflare One.

    Enter SCIM values into Okta

  13. Select Test API Credentials to ensure that the credentials were entered correctly. Select Save.

  14. On the Provisioning tab, select Edit and enable:

    • Create Users
    • Update User Attributes
    • Deactivate Users

    Configure provisioning settings in Okta

  15. In the Assignments tab, add the users you want to synchronize with Cloudflare Access. You can add users in batches by assigning a group. If a user is removed from the application assignment via a either direct user assignment or removed from the group that was assigned to the app, this will trigger a deprovisioning event from Okta to Cloudflare.

  16. In the Push Groups tab, add the Okta groups you want to synchronize with Cloudflare Access. These groups will display in the Access policy builder and are the group memberships that will be added and removed upon membership change in Okta.

    :::note Groups in this SCIM app Push Groups integration should match the groups in your base OIDC app integration. Matching the groups keeps the Gateway identity synchronized with the groups that Okta returns when the user authenticates to Access. :::

To verify the integration, select View Logs in the Okta SCIM application.

Example API Configuration

{
	"config": {
		"client_id": "<your client id>",
		"client_secret": "<your client secret>",
		"okta_account": "https://dev-abc123.oktapreview.com"
	},
	"type": "okta",
	"name": "my example idp"
}

Troubleshooting

Failed to fetch user/group information from the identity

If you see the error Failed to fetch user/group information from the identity, double-check your Okta configuration:

  • If your Okta tenant has more than 100 groups, include an Okta API token in the identity provider configuration. When the user's OIDC token contains no groups or reaches Okta's 100-group limit, Cloudflare uses the API token during authentication to fetch the user's complete group membership. This setting is specific to Okta and is not part of SCIM. The API token does not populate group options in the Access policy builder; those come from groups provisioned through SCIM.
  • If Okta returns more than 100 groups in a user's OIDC token, Okta may omit some group memberships from the token. This is an Okta token claim limitation, not a Cloudflare limit. If a required group is omitted, Cloudflare cannot evaluate policies that depend on that group. To avoid this, narrow the Okta groups claim filter so that only groups used in Cloudflare policies are included. For more information, refer to Okta's group functions and dynamic allowlists documentation.
  • The request may be blocked by the ThreatInsights feature within Okta.

Okta Groups selector is empty or missing groups in the policy builder

The Okta Groups selector in the Access policy builder is populated by groups provisioned through SCIM, not by the optional Okta API token. If groups are missing from the selector:

  • In Okta, go to the SCIM application's Push Groups tab and push the groups you want to use in Access policies. For more information, refer to Configure SCIM in Okta.
  • Make sure the groups you push through SCIM match the groups returned in the OIDC groups claim.
  • Adding an Okta API token will not add groups to the selector. The API token is only used during authentication to fetch a user's group membership.
这篇文档对你有帮助吗？
想留言或继续讨论？请到 Cyberforums 赛博论坛参与。 参与讨论 / 回复