Skip to content

authentik (SAML)

Last updated View as MarkdownAgent setup

Connect authentik to Cloudflare Access with Security Assertion Markup Language (SAML) 2.0.

Prerequisites

  • An authentik account with administrator access
  • A Cloudflare account with Zero Trust access
  • A publicly accessible authentik deployment with a trusted TLS certificate

1. Create an application in authentik

Your Cloudflare Access team name is part of the Assertion Consumer Service (ACS) URL. Locate your team name before you configure authentik.

You can find your team name in the Cloudflare dashboard ↗︎ under Settings > Team name and domain > Team name.

  1. Log in to authentik as an administrator and open the Admin interface.
  2. Go to Applications > Applications and select New Application.
  3. Enter the application details and select Next.
  4. For the provider type, select SAML Provider.
  5. Configure the provider:

    1. Enter a provider name and select an authorization flow.

    2. For ACS URL, enter:

      https://<YOUR_TEAM_NAME>.cloudflareaccess.com/cdn-cgi/access/callback

    3. For Audience, enter the same Cloudflare Access callback URL.

    4. Select a Signing Certificate and keep Sign assertions turned on.

    5. For Service Provider Binding, select Post.

    6. For Default NameID Policy, select Email address.

  6. Select Create Application.

For more information about authentik provider settings, refer to Create a SAML provider ↗︎.

2. Get the authentik provider details

  1. In the authentik Admin interface, go to Applications > Providers.

  2. Select the SAML provider that you created for Cloudflare Access.

  3. Record the following values. Replace <AUTHENTIK_DOMAIN> with your authentik hostname and <APPLICATION_SLUG> with the associated application slug.

    Cloudflare field authentik value
    Single Sign-On URL https://<AUTHENTIK_DOMAIN>/application/saml/<APPLICATION_SLUG>/
    IdP Entity ID or Issuer URL https://<AUTHENTIK_DOMAIN>/application/saml/<APPLICATION_SLUG>/metadata/

  4. Under Download signing certificate, select Download. Save the certificate for the Cloudflare configuration.

The metadata tab also contains the SAML endpoint, entity ID, and signing certificate. For more information, refer to SAML Provider ↗︎.

3. Add authentik to Cloudflare Access

  1. In Cloudflare Zero Trust, go to Integrations > Identity providers.

    Go to Identity providers ↗

  2. Select Add new identity provider > SAML.

  3. Enter a name for the identity provider.

  4. Enter the Single Sign-On URL and IdP Entity ID or Issuer URL from authentik.

  5. For Signing certificate, paste the certificate downloaded from authentik.

  6. Select Save.

4. Test the integration

  1. In Cloudflare Zero Trust, go to Integrations > Identity providers.

    Go to Identity providers ↗

  2. Find the authentik identity provider and select Test.

  3. Complete the authentik login flow.

  4. Verify that Cloudflare displays a successful test result and the expected email address.

Was this helpful?