Cloudflare

Cloudflare Configuration

Add a New Identity Provider

1. Log in to the Cloudflare Zero Trust dashboard
2. Navigate to Settings → Authentication → Login methods
3. Click Add new
4. Select SAML

Configure SAML Settings

Required Configuration

Optional Configurations

Click Save

Dashboard SSO

This section enables SSO for Cloudflare dashboard access. For detailed information, see the Cloudflare Dashboard SSO documentation .

Invite Members

1. Go to Cloudflare dashboard

2. Navigate to Manage Account → Members

3. Click Invite members

4. Enter one or more email addresses

5. Configure the member scope:

   • Select a scope: Account-level
   • Roles: [Super Administrator - All Privileges]

6. Click Invite

Add and Verify Your Domain

1. Go to Cloudflare Members Settings

2. Click Settings

3. Under Single Sign-On (SSO) for all members, click Add domain

4. Enter your organization’s domain

5. Cloudflare will provide DNS verification details:

   • Type: TXT
   • Name: Provided value
   • Value: Provided value

6. Add the TXT record to your DNS provider

7. Return to Cloudflare and click Verify

Access Policies for IdP Control

Cloudflare Access policies allow you to control which identity providers users can authenticate with and restrict access based on various criteria.

Access policies consist of:

• Actions: Allow, Block, Bypass, or Service Auth
• Rule Types: Include (OR logic), Exclude (NOT logic), Require (AND logic)
• Selectors: Criteria such as email, country, login method, etc.

1. In Cloudflare Zero Trust , navigate to Settings
2. Under Admin controls find Manage Cloudflare dashboard SSO applications
3. Find the domain added in the previous step and click Edit
4. A policy should already exist for your domain, find it and click the ellipsis menu (⋮)

1. An existing configuration rule should appear under Configuration Rules → Include. Click Add require, then fill:

   Selector	Value
   Login Method	Select your IdP (e.g., “SAML • Your IdP”)

Login Method Options

The Login Methods selector allows you to enable multiple authentication options simultaneously. Each selected method gives users an additional way to access the dashboard.

1. Click Save Policy
2. Review your selected login methods and rule type
3. Click Save Policy

SplitSecure Configuration

Download Cloudflare SAML Metadata

Download your Cloudflare SAML metadata file using one of the following URLs:

Finding your values:

• Team name: Found in Cloudflare Zero Trust under Settings → Team domain
• IdP ID: Obtain from the Cloudflare API endpoint List Access identity providers

Create the Cloudflare Secure Account

1. In SplitSecure, navigate to Secure Accounts → Create Account → Cloudflare
2. Enter a name for your account
3. Select the Identity Provider used in the Cloudflare configuration
4. Upload the metadata file downloaded in Step 1 (filename: access_saml_metadata.xml)
5. Provide your SSO endpoint which can be found on Cloudflare at Access Controls → Application → SSO App
6. Click Create Account

Test Authentication

Test Authentication (SP-Initiated)

1. Navigate to dash.cloudflare.com
2. Enter an email address using your verified organization domain
3. The login button should change to Log in with SSO
4. Click Log in with SSO and select your SAML identity provider
5. You will be redirected to SplitSecure
6. Enter your email address when prompted
7. Click Request Access
8. Complete the authentication flow

Troubleshooting

External Resources

• Identity Providers Supported IdP integrations overview
• Generic SAML 2.0 SAML configuration guide