mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-29 18:42:15 +00:00
599a1ddd78
* Modified quick start guide to reflect the new onboarding changes. * Modified titles to optimize indexing. Left thet titles in title case for now. * Added side bar labels and also made minor changes to titles. * Update docs/docs/apis/openidoauth/endpoints.mdx Co-authored-by: Fabi <[email protected]> --------- Co-authored-by: Fabi <[email protected]>
54 lines
2.2 KiB
Plaintext
54 lines
2.2 KiB
Plaintext
---
|
|
title: Configure ZITADEL as an OIDC Identity Provider on Cloudflare Zero Trust
|
|
sidebar_label: Cloudflare Zero Trust
|
|
---
|
|
|
|
import CreateApp from "../application/_application.mdx";
|
|
|
|
This guide shows how to configure ZITADEL as OpenID Connect identity provider for Cloudflare Zero Trust.
|
|
|
|
Prerequisites:
|
|
|
|
- Existing ZITADEL instance, organization, and project. Follow our [get started](/guides/start/quickstart) guide to get started. If not present follow [this guide](/guides/start/quickstart)
|
|
- Existing Cloudflare account and [team domain](https://developers.cloudflare.com/cloudflare-one/glossary/#team-domain)
|
|
|
|
## Create the client in ZITADEL
|
|
|
|
<CreateApp appType="web" authType="code" appName="Cloudflare" redirectURI="https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback"/>
|
|
|
|
## Send user info in tokens
|
|
|
|
Make sure to enable "User Info inside ID Token" on your application settings.
|
|
|
|
|
|
|
|
:::info
|
|
Cloudflare will return an error "User email was not returned. API permissions are likely incorrect". Enable to send the user information inside the token on your client settings.
|
|
:::
|
|
|
|
## Configure Cloudflare Zero Trust Authentication
|
|
|
|
1. On the Cloudflare dashboard go to Zero Trust, click settings, and then select "Authentication"
|
|
2. Add a new login method with the type "OpenID Connect"
|
|
3. Fill in the required information. Check the discovery endpoint of your instance (https://{your_domain}/.well-known/openid-configuration) for the urls. As mentioned in the Cloudflare docs the Certificate Url is jwks_uri.
|
|
4. Disable PKCE (Cloudflare requires a client secret for PKCE, which is currently not supported)
|
|
5. Add the following claims: "openid", "profile", "email"
|
|
6. Test the connection
|
|
|
|
### Example configuration
|
|
|
|
```json
|
|
{
|
|
"config": {
|
|
"client_id": "<your client id>",
|
|
"client_secret": "<your client secret>",
|
|
"auth_url": "https://{your_domain}.zitadel.cloud/oauth/v2/authorize",
|
|
"token_url": "https://{your_domain}.zitadel.cloud/oauth/v2/token",
|
|
"certs_url": "https://{your_domain}.zitadel.cloud/oauth/v2/keys",
|
|
"scopes": ["openid", "email", "profile"],
|
|
"pkce_enabled": false,
|
|
},
|
|
"type": "oidc",
|
|
"name": "Generic Google"
|
|
}
|
|
``` |