About Cloudflare Access identity providers
Cloudflare Access is a fast, reliable Zero Trust Network Access solution that protects employees and contractors. Access is an identity-aware proxy in front of your applications. It decides if an authenticated user may get to them. Thus, it is an authorization and enforcement layer, not your primary user directory.
Usually, you use Access with a current identity provider (Okta, Microsoft Entra ID, Google Workspace, or a different OIDC or SAML IdP). That IdP signs users in and manages their accounts, groups, MFA, and lifecycle. Access can combine that IdP identity with device posture, IP and location, the application, service tokens, and other conditions. You can configure more than one identity provider, including all providers that support OpenID Connect (OIDC).
Persona can be a generic OIDC identity provider. You keep your IdP for authentication and account management. You add Persona, so that Access can require identity verification before an employee gets to a sensitive application, for example an application with production or financial data. Persona can also compare the verification result with the profile in that IdP. This is the attribute matching step below.
Configure the Authentications product feature to get the client ID and client secret that you use below.
Cloudflare Configuration Guide
Do the steps below to configure Persona OIDC as an identity provider in Cloudflare Zero Trust.
1. Configure the Persona authentication template
In the Persona Dashboard, create an authentication template with these settings:
- Allowed redirect URIs:
https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback. Your team name is in the Cloudflare dashboard under Settings > Team name and domain > Team name. - Skip account create: Required. Cloudflare Access does not send a
login_hintfor SSO. Thus, Persona cannot fill in the email address of the user. - Token endpoint authentication method: Client secret basic. Cloudflare uses HTTP Basic authentication for the Persona token endpoint. It does not put a client secret in the request body.
- PKCE: Optional. Persona recommends that you enable it when it is supported.
Cloudflare Access does not send a login_hint. Thus, users must enter their email address two times: one time to start to sign in to the application, and one time in the Persona flow.
2. Add Persona OIDC as an identity provider in Cloudflare
In the Cloudflare dashboard, go to:
- Zero Trust > Integrations > Identity providers
- Under Your identity providers, select Add new identity provider. Then select OpenID Connect.
Give the provider a name (for example, “Persona”). Enter the values from your Persona authentication template in the fields:
- Client ID: The Client ID from your Persona authentication template
- Client secret: The Client Secret from your Persona authentication template
- Auth URL:
https://authenticate.withpersona.com/authenticate/oidc/authorize - Token URL:
https://authenticate.withpersona.com/authenticate/oidc/token - Certificate URL:
https://authenticate.withpersona.com/authenticate/oidc/jwks
These values are also on the Persona OIDC discovery endpoint. Cloudflare can use this endpoint to find the endpoints:
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configurationTo test with your sandbox environment, use this configuration instead: Openid Configuration
Keep the default values for the other settings. Then select Save.
3. Create an Access application
Go to:
- Zero Trust > Access controls > Applications
- Select Add an application. Select the application type that you want to protect.
Do the steps that the dashboard shows to configure your application. To use Persona as an identity provider, you do not have to change application settings. In the next step, you apply the identity provider at the policy level.
4. Create an Access policy
Go to:
- Zero Trust > Access controls > Policies
- Create a new policy, or edit an existing one. Assign it to the application that you want to protect.
In the policy rule, select Persona as the identity provider. For tests, you can start with a rule that allows all users. After you confirm that the flow works, make the rule more specific.
5. Configure Persona Marketplace Integration for Employee Data
The setup above verifies the identity of the person who signs in. But it does not compare that identity with your system of record. The Cloudflare Access generic OIDC identity provider sends no user data to Persona. It does not send a login_hint. Thus, nothing connects the verified identity to the profile of the employee in your IAM. You must do the attribute comparison with the identity provider that you use with Access.
To match a verification result to the profile of the employee, configure the inquiry template to collect an identifier from the user. Persona uses this identifier to find the user. For example, if your employees sign in through Okta, collect their email address in the inquiry. Then use the Okta marketplace integration to find the Okta profile with the email. Write the attributes of the profile into the Persona account, and compare them with the verified identity.
- Add a step to your inquiry template that collects an identifier from the user, for example their email address.
- Use the Okta integration guide to add the credentials of your identity provider in the Persona Dashboard. If you use a different IAM, use the integration guide of that vendor instead.
- Notify your Persona account team so they can finalize setup and enable profile comparison.
6. Test the integration
- Go to your application and sign in.
- When the application tells you, complete the Persona identity verification.
- Make sure that you go back to the application and that you get access.
Related resources
- Cloudflare integration overview
- How to configure Persona Authentications with OpenID Connect
- Cloudflare: Identity providers
- Cloudflare: Generic OIDC
Plans Explained
Cloudflare Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Cloudflare Integration | Not Available | Not Available | Limited | Available |