About OpenID Connect (OIDC) with Persona
Persona supports acting as an OpenID Connect (OIDC) Identity Provider (IdP) authenticator, so an identity-aware proxy such as Cloudflare Access can call Persona for identity verification as part of an authentication flow.
Cloudflare Access is a fast, reliable Zero Trust Network Access solution that secures employees and contractors. Access sits in front of your applications as an identity-aware proxy and decides whether an authenticated user may reach them, which makes it an authorization and enforcement layer rather than your primary user directory.
Access is generally used alongside an existing identity provider (Okta, Microsoft Entra ID, Google Workspace, or another OIDC or SAML IdP) that signs users in and manages their accounts, groups, MFA, and lifecycle. Access can combine that IdP identity with device posture, IP and location, the application being accessed, service tokens, and other conditions, and you can configure more than one identity provider.
That is where Persona fits. You keep your IdP for authentication and account management, and add Persona so that Access can require identity verification before an employee reaches a sensitive application, such as one containing production or financial data. The verification result can also be compared against the profile in that IdP, which is the attribute matching step described below.
You’ll need to configure the Authentications product feature to obtain the client ID and client secret used below.
Cloudflare Configuration Guide
Follow the steps below to configure Persona OIDC as an identity provider in Cloudflare Zero Trust.
1. Configure the Persona authentication template
In the Persona Dashboard, create an authentication template with the following settings:
- Allowed redirect URIs:
https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback. Find your team name in the Cloudflare dashboard under Settings > Team name and domain > Team name. - Skip account create: required. Cloudflare Access does not send a
login_hintfor SSO, so Persona cannot pre-fill the user’s email address. - Token endpoint authentication method: Client secret basic. Cloudflare authenticates to Persona’s token endpoint with HTTP Basic authentication rather than a client secret in the request body.
- PKCE: optional, but Persona recommends enabling it whenever it is supported.
Because Cloudflare Access does not pass a login_hint, users are prompted to enter their email address twice: once to start signing in to the application, and once in the Persona flow.
2. Add Persona OIDC as an identity provider in Cloudflare
In the Cloudflare dashboard, navigate to:
- Zero Trust > Integrations > Identity providers
- Under Your identity providers, select Add new identity provider, then choose OpenID Connect.
Name the provider (for example, “Persona”) and fill in the fields with the values from your Persona authentication template:
- Client ID: the Client ID from your Persona authentication template
- Client secret: the Client Secret from your Persona authentication template
- Auth URL:
https://authenticate.withpersona.com/authenticate/oidc/authorize - Token URL:
https://authenticate.withpersona.com/authenticate/oidc/token - Certificate URL:
https://authenticate.withpersona.com/authenticate/oidc/jwks
You can also find these values on Persona’s OIDC discovery endpoint, which Cloudflare can use to look up the endpoints:
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configurationTo test using your sandbox environment, use the following instead: Openid Configuration
Leave any remaining settings at their defaults, then select Save.
3. Create an Access application
Navigate to:
- Zero Trust > Access controls > Applications
- Select Add an application and choose the application type you want to protect.
Follow the prompts to configure your application. You do not need to change any application settings to use Persona as an identity provider; the identity provider is applied at the policy level in the next step.
4. Create an Access policy
Navigate to:
- Zero Trust > Access controls > Policies
- Create a new policy, or edit an existing one, and assign it to the application you want to protect.
In the policy rule, select Persona as the identity provider. For testing, you can start with a rule that allows everyone; refine it once you have confirmed the flow works.
5. Configure attribute matching
The setup above verifies the identity of the person signing in, but it does not compare that identity against your system of record. Cloudflare Access’s generic OIDC identity provider passes no user data to Persona; it does not even send a login_hint. So nothing ties the verified identity to the employee’s profile in your IAM, and you must do the attribute comparison against the identity provider you use together with Access.
To match a verification result to the employee’s profile, have the inquiry template collect an identifier from the user that Persona can use to look them up. For example, if your employees sign in through Okta, collect their email address in the inquiry, then use the Okta marketplace integration to look up the Okta profile by email, write the profile’s attributes into the Persona account, and compare them against the verified identity.
- Add a step to your inquiry template that collects an identifier from the user, such as their email address.
- Follow the Okta integration guide and add your identity provider’s credentials in the Persona Dashboard. If you use a different IAM, follow that vendor’s integration guide instead.
- Notify your Persona account team so they can finalize setup and enable profile comparison.
6. Test the integration
- Navigate to your application and sign in.
- Complete the Persona identity verification when prompted.
- Confirm you are redirected back to the application and granted access.
Related resources
- Cloudflare integration overview
- How to configure Persona Authentications with OpenID Connect
- Configure Persona as an Authentication Method in Okta
- Cloudflare: Generic OIDC
Plans Explained
Cloudflare Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Cloudflare Integration | Not Available | Not Available | Limited | Available |