INTEGRITY Cloudflare Docs

← Cloudflare One / cloudflare-one / integrations / identity-providers

Okta

Okta provides cloud software that helps companies manage and secure user authentication to modern applications, and helps developers build identity controls into applications, website web services, and devices. You can integrate Okta with Cloudflare One and build rules based on user identity and group membership. Cloudflare One supports Okta integrations using either the OIDC (default) or SAML protocol.

Additionally, you can configure Okta to use risk information from Cloudflare One user risk scores to create SSO-level policies. For more information, refer to Send risk score to Okta.

Prerequisites

Supported features

Set up Okta as an OIDC provider (Okta App Catalog)

To set up the Okta integration using the Okta Integration Network (OIN) App Catalog:

  1. Log in to your Okta admin dashboard.

  2. Go to Applications > Applications.

  3. Select Browse App Catalog.

  4. Search for Cloudflare and select the Cloudflare One app.

  5. Select Add integration.

  6. In Application label, enter a name for the application (for example, Cloudflare Access).

  7. In Team domain, enter your Cloudflare Zero Trust team name (only the subdomain prefix, do not include .cloudflareaccess.com):

    <your-team-name>

    You can find your team name in the Cloudflare dashboard ↗ under Settings > Team name and domain > Team name.

  8. In the Sign On tab, copy the Client ID and Client secret and paste these into App ID and Client secret.

  9. Copy your Okta Account URL (without the -admin value) and copy it into the Cloudflare Okta setup field.

Set up Okta as an OIDC provider (Custom App Integration)

  1. Log in to your Okta admin dashboard and go to Applications > Applications.

  2. Select Create App Integration.

  3. For the Sign-in method, select OIDC - OpenID Connect.

    Creating an OIDC application in Okta

  4. For the Application type, select Web Application. Select Next.

  5. Enter any name for the application. In the Sign-in redirect URIs field, enter the following URL:

    https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback

    You can find your team name in the Cloudflare dashboard ↗ under Settings > Team name and domain > Team name.

  6. Choose the desired Assignment option and select Save.

  7. From the application view, go to the Sign On tab.

  8. Scroll down to Token claims and select Show legacy configuration > Edit.

    Configuring the Groups claim filter in Okta

  9. Set Groups claim filter to Matches regex and its value to .*.

  1. In the General tab, copy the Client ID and Client secret.

    Finding your Client credentials in Okta

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Integrations > Identity providers.

  2. Under Your identity providers, select Add new identity provider. Select Okta as your identity provider.

  3. Fill in the following information:

    • Name: Name your identity provider.
    • App ID: Enter your Okta client ID.
    • Client secret: Enter your Okta client secret.
    • Okta account URL: Enter your Okta domain ↗, for example https://my-company.okta.com.

  4. (Optional) Create an Okta API token and enter it in the Cloudflare dashboard ↗ under Zero Trust > Integrations > Identity providers (the token can be read-only). Use an API token if your Okta tenant has more than 100 groups. This setting is specific to Okta and is not part of SCIM. The token only retrieves Okta group names for the policy builder. Access evaluates group membership from the user's OIDC token during authentication.

  5. (Optional) To configure custom OIDC claims:

    1. In Okta, create a custom authorization server ↗ and ensure that the groups scope is enabled.
    2. In the Cloudflare dashboard ↗, enter the Authorization Server ID obtained from Okta.
    3. Under Optional configurations, enter the claims that you wish to add to your users' identity.

  6. (Optional) Enable Proof of Key Exchange (PKCE) ↗. PKCE will be performed on all login attempts.

  7. Select Save.

To test that your connection is working, select Test.

Synchronize users and groups

The Okta integration allows you to synchronize IdP groups and automatically deprovision users using SCIM. To enable SCIM provisioning between Access and Okta, you need two separate app integrations in Okta:

SCIM affects Access and Gateway policy evaluation differently.

Access evaluates a user's identity and group membership from the SAML assertion or OIDC token returned by the identity provider during authentication. SCIM provides readable group names in the Access policy builder, but Access does not use SCIM group membership to evaluate a login. If you turn on Enable user deprovisioning, removing a user from the SCIM application revokes their active Access sessions. You can also configure SCIM to revoke sessions after group membership changes. Access evaluates the updated identity provider data when the user authenticates again.

Gateway evaluates identity-based policies against the User Registry identity. SCIM updates this identity when users or group memberships change, without waiting for the user to authenticate again. Cloudflare One Client device profiles use the same synchronized identity.

1. Enable SCIM in Cloudflare One

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Integrations > Identity providers.

  2. Find the Okta integration and select Edit.

  3. Turn on Enable SCIM.

  4. (Optional) Configure the following settings:

  1. Select Regenerate Secret. Copy the SCIM Endpoint and SCIM Secret. You will need to enter these values into Okta.

  2. Select Save.

The SCIM secret never expires, but you can manually regenerate the secret at any time.

2. Configure SCIM in Okta

  1. On your Okta admin dashboard, go to Applications > Applications.

  2. Select Browse App Catalog.

  3. Search for SCIM Header Auth and select SCIM 2.0 Test App (Header Auth).

  4. Select Add Integration.

  5. On the General Settings tab, name your application and select Next.

  6. On the Sign-on Options tab, ensure that SAML 2.0 is selected.

  7. Under Credential Details, set Application username format to either Okta Username or Email. This value will be used for the SCIM userName attribute.

  8. Select Done to create the integration.

  9. On the Provisioning tab, select Configure API Integration.

  10. Select Enable API integration.

  11. In the Base URL field, enter the SCIM Endpoint obtained from Cloudflare One.

  12. In the API Token field, enter the SCIM Secret obtained from Cloudflare One.

    Enter SCIM values into Okta

  13. Select Test API Credentials to ensure that the credentials were entered correctly. Select Save.

  14. On the Provisioning tab, select Edit and enable:

    • Create Users
    • Update User Attributes
    • Deactivate Users
    Configure provisioning settings in Okta

  15. In the Assignments tab, add the users you want to synchronize with Cloudflare Access. You can add users in batches by assigning a group. If a user is removed from the application assignment via a either direct user assignment or removed from the group that was assigned to the app, this will trigger a deprovisioning event from Okta to Cloudflare.

  16. In the Push Groups tab, add the Okta groups you want to synchronize with Cloudflare Access. These groups will display in the Access policy builder and are the group memberships that will be added and removed upon membership change in Okta.

To verify the integration, select View Logs in the Okta SCIM application.

To check if user identities were updated in Cloudflare One, view your SCIM provisioning logs.

Example API Configuration

{
	"config": {
		"client_id": "<your client id>",
		"client_secret": "<your client secret>",
		"okta_account": "https://dev-abc123.oktapreview.com"
	},
	"type": "okta",
	"name": "my example idp"
}

Troubleshooting

Failed to fetch user/group information from the identity

If you see the error Failed to fetch user/group information from the identity, double-check your Okta configuration: