SAML | OneLogin
OneLogin provides SSO identity management. Cloudflare Access supports OneLogin as an SAML identity provider.
Set up OneLogin (SAML)
To set up OneLogin (SAML) as your identity provider:
-
Log in to your OneLogin admin portal.
-
Select Apps > Add Apps.
-
Under Find Applications, search for Cloudflare Access.
-
Select the result sponsored by Cloudflare, Inc.
You can customize the name or logo.
-
Select Save. You can change this information at any time.
-
Select the Configuration tab.
-
In the Cloudflare Access Authorization Domain field, paste your team domain .
-
Select the Parameters tab, click Add Parameter and enter your values for Cloudflare Access Field.
-
Select the Access tab
-
In Roles, use the mapping to programmatically and automatically assign users that can access the application.
-
Select the SSO tab.
-
Copy the OneLogin SAML 2.0 Endpoint (HTTP) to the Cloudflare Single Sign On URL.
-
Copy the OneLogin Issuer URL to the Cloudflare IdP Entity ID.
-
Copy the X.509 Certificate to the Cloudflare Signing Certificate.
-
On the Zero Trust dashboard, navigate to Settings > Authentication.
-
Under Login methods, click Add new.
-
Select SAML.
-
Input the details from your OneLogin account in the fields. We suggest that you name the attributes the same in both OneLogin and Cloudflare.
If other headers and SAML attribute names were added to OneLogin, be sure to add them to Cloudflare under SAML attributes and SAML header attributes in the Optional configurations menu.
-
Click Save.
To test that your connection is working, navigate to Authentication > Login methods and click Test next to the login method you want to test.
Download SP metadata (optional)
OneLogin SAML allows administrators to upload metadata files from the service provider.
To add a metadata file to your OneLogin SAML configuration:
-
Download your unique SAML metadata file at the following URL, replacing
<your-team-name>with your team name :https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/saml-metadataThe link returns a web page with your SAML SP data in XML format.
-
Save the file as an XML document.
-
Upload the XML document to OneLogin.
Example API configuration
{
"config": {
"issuer_url": "https://app.onelogin.com/saml/metadata/1b84ee45-d4fa-4373-8853-abz438942123",
"sso_target_url": "https://sandbox.onelogin.com/trust/saml2/http-post/sso/123456",
"attributes": ["email"],
"email_attribute_name": "",
"sign_request": false,
"idp_public_cert": "MIIDpDCCAoygAwIBAgIGAV2ka+55MA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEG\nA1UEC.....GF/Q2/MHadws97cZg\nuTnQyuOqPuHbnN83d/2l1NSYKCbHt24o"
},
"type": "saml",
"name": "onelogin saml example"
}