Okta

Okta provides cloud software that helps companies manage and secure user authentication to modern applications, and helps developers build identity controls into applications, website web services, and devices. You can integrate Okta with Cloudflare Zero Trust and build rules based on user identity and group membership. Cloudflare Zero Trust supports Okta integrations using either the OIDC (default) or SAML protocol.

Additionally, you can configure Okta to use risk information from Zero Trust user risk scores to create SSO-level policies. For more information, refer to Send risk score to Okta.

Set up Okta as an OIDC provider

1. On your Okta admin dashboard, go to Applications > Applications.

2. Select Create App Integration.

3. For the Sign-in method, select OIDC - OpenID Connect.

   

4. For the Application type, select Web Application. Select Next.

5. Enter any name for the application. In the Sign-in redirect URIs field, enter the following URL:

   https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback

   You can find your team name in Zero Trust under Settings > Custom Pages.

6. Choose the desired Assignment option and select Save.

7. From the application view, go to the Sign On tab.

8. Scroll down to the OpenID ConnectID Token and select Edit.

   

9. Set the Groups claim filter to Matches regex and its value to .*.

   Note

   Groups managed outside of Okta (for example, Microsoft Entra ID or Google groups) may require different regex values. For more information, refer to the Okta documentation on Groups Claims ↗ and OpenID Connect Claims ↗.

10. In the General tab, copy the Client ID and Client secret.

    

11. In Zero Trust ↗, go to Settings > Authentication.

12. Under Login methods, select Add new. Select Okta as your identity provider.

13. Fill in the following information:

    • Name: Name your identity provider.
    • App ID: Enter your Okta client ID.
    • Client secret: Enter your Okta client secret.
    • Okta account URL: Enter your Okta domain ↗, for example https://my-company.okta.com.

14. (Optional) Create an Okta API token and enter it in Zero Trust (the token can be read-only). This will prevent your Okta groups from failing if you have more than 100 groups.

15. (Optional) To configure custom OIDC claims:

    1. In Okta, create a custom authorization server ↗ and ensure that the groups scope is enabled.
    2. In Zero Trust, enter the Authorization Server ID obtained from Okta.
    3. Under Optional configurations, enter the claims that you wish to add to your users' identity.

16. (Optional) Enable Proof of Key Exchange (PKCE) ↗. PKCE will be performed on all login attempts.

17. Select Save.

To test that your connection is working, select Test.

Note

If you see the error Failed to fetch user/group information from the identity, double-check your Okta configuration:

• If you have more than 100 Okta groups, ensure you include the API token.
• The request may be blocked by the ThreatInsights feature ↗ within Okta.

Synchronize users and groups

The Okta integration allows you to synchronize IdP groups and automatically deprovision users using SCIM. To enable SCIM provisioning between Access and Okta, you need two separate app integrations in Okta:

• The Okta OIDC connector you created when adding Okta as an identity provider.
• A second Okta application of type SCIM 2.0 Test App (Header Auth). This is technically a SAML app but is responsible for sending user and group info via SCIM.

Note

If you would like to only maintain one Okta app instance, Okta does support SAML and SCIM within the same application. Create a generic SAML integration and configure those values in the Sign-On field of your Okta SCIM application.

1. Enable SCIM in Zero Trust

1. In Zero Trust ↗, go to Settings > Authentication.

2. Find the Okta integration and select Edit.

3. Turn on Enable SCIM

4. (Optional) Configure the following settings:

• Enable user deprovisioning: Revoke a user's active session when they are removed from the SCIM application in Okta. This will invalidate all active Access sessions and prompt for reauthentication for any WARP session policies.
• Remove user seat on deprovision: Remove a user's seat from your Zero Trust account when they are removed from the SCIM application in Okta.
• SCIM identity update behavior: Choose what happens in Zero Trust when the user's identity updates in Okta.
  • Automatic identity updates: Automatically update the User Registry identity when Okta sends an updated identity or group membership through SCIM. This identity is used for Gateway policies and WARP device profiles; Access will read the user's updated identity when they reauthenticate.
  • Group membership change reauthentication: Revoke a user's active session when their group membership changes in Okta. This will invalidate all active Access sessions and prompt for reauthentication for any WARP session policies. Access will read the user's updated group membership when they reauthenticate.
  • No action: Update the user's identity the next time they reauthenticate to Access or WARP.

5. Select Regenerate Secret. Copy the SCIM Endpoint and SCIM Secret. You will need to enter these values into Okta.

6. Select Save.

The SCIM secret never expires, but you can manually regenerate the secret at any time.

2. Configure SCIM in Okta

1. On your Okta admin dashboard, go to Applications > Applications.

2. Select Browse App Catalog.

3. Search for SCIM Header Auth and select SCIM 2.0 Test App (Header Auth).

4. Select Add Integration.

5. On the General Settings tab, name your application and select Next.

6. On the Sign-on Options tab, ensure that SAML 2.0 is selected. Select Done to create the integration.

7. On the Provisioning tab, select Configure API Integration.

8. Select Enable API integration.

9. In the Base URL field, enter the SCIM Endpoint obtained from Zero Trust.

10. In the API Token field, enter the SCIM Secret obtained from Zero Trust.

    

11. Select Test API Credentials to ensure that the credentials were entered correctly. Select Save.

12. On the Provisioning tab, select Edit and enable:

    • Create Users
    • Update User Attributes
    • Deactivate Users

    

13. Select Save to complete the configuration.

14. In the Assignments tab, add the users you want to synchronize with Cloudflare Access. You can add users in batches by assigning a group. If a user is removed from the application assignment via a either direct user assignment or removed from the group that was assigned to the app, this will trigger a deprovisioning event from Okta to Cloudflare.

15. In the Push Groups tab, add the Okta groups you want to synchronize with Cloudflare Access. These groups will display in the Access policy builder and are the group memberships that will be added and removed upon membership change in Okta.

    Note

    Groups in this SCIM app Push Groups integration should match the groups in your base OIDC app integration. Because SCIM group membership updates will overwrite any groups in a user's identity, assigning the same groups to each app ensures consistent policy evaluation.

To verify the integration, select View Logs in the Okta SCIM application.

To check if user identities were updated in Zero Trust, view your SCIM provisioning logs.

Note

New users must first register the WARP client or authenticate to an Access application before SCIM provisioning can begin.

Example API Configuration

{
  "config": {
    "client_id": "<your client id>",
    "client_secret": "<your client secret>",
    "okta_account": "https://dev-abc123.oktapreview.com"
  },
  "type": "okta",
  "name": "my example idp"
}