Skip to content
Cloudflare for Teams
Visit Cloudflare for Teams on GitHub
Set theme to dark (⇧+D)

SAML | OneLogin

OneLogin provides SSO identity management. Cloudflare Access supports OneLogin as an SAML identity provider.

Set up OneLogin (SAML)

To set up OneLogin (SAML) as your identity provider:

  1. Log in to your OneLogin admin portal.

  2. Select Apps > Add Apps.

    OneLogin SAML Add Apps

  3. Under Find Applications, search for Cloudflare Access.

  4. Select the result sponsored by Cloudflare, Inc.

    OneLogin SAML Find Applications

    You can customize the name or logo.

  5. Select Save.

    You can change this information at any time.

    OneLogin SAML Add Cloudflare Access app

  6. Select the Configuration tab.

  7. In the Cloudflare Access Authorization Domain field, paste your team domain.

    OneLogin SAML Application Configuration

  8. Select the Parameters tab, click Add Parameter and enter your values for Cloudflare Access Field.

    OneLogin SAML Application Parameters

  9. Select the Access tab

  10. In Roles, use the mapping to programmatically and automatically assign users that can access the application.

    OneLogin SAML Application Access

  11. Select the SSO tab.

  12. Copy the OneLogin SAML 2.0 Endpoint (HTTP) to the Cloudflare Single Sign On URL.

  13. Copy the OneLogin Issuer URL to the Cloudflare IdP Entity ID.

  14. Copy the X.509 Certificate to the Cloudflare Signing Certificate.

    OneLogin SAML Application SSO

  15. On the Teams dashboard, navigate to Settings > Authentication.

  16. Under Login methods, click Add new.

  17. Select SAML.

  18. Input the details from your OneLogin account in the fields. We suggest that you name the attributes the same in both OneLogin and Cloudflare.

    If other headers and SAML attribute names were added to OneLogin, be sure to add them to Cloudflare under SAML attributes and SAML header attributes in the Optional configurations menu.

  19. Click Save.

To test that your connection is working, navigate to Authentication > Login methods and click Test next to the login method you want to test.

Download SP metadata (optional)

OneLogin SAML allows administrators to upload metadata files from the service provider.

To add a metadata file to your OneLogin SAML configuration:

  1. Download your unique SAML metadata file at the following URL, replacing <your-team-name> with your team name:


    The link returns a web page with your SAML SP data in XML format.

  2. Save the file as an XML document.

  3. Upload the XML document to OneLogin.

Example API configuration

"config": {
"issuer_url": "",
"sso_target_url": "",
"attributes": ["email"],
"email_attribute_name": "",
"sign_request": false,
"idp_public_cert": "MIIDpDCCAoygAwIBAgIGAV2ka+55MA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEG\nA1UEC.....GF/Q2/MHadws97cZg\nuTnQyuOqPuHbnN83d/2l1NSYKCbHt24o"
"type": "saml",
"name": "onelogin saml example"