Proving Zero Trust Actually Works: Entra ID and Cloudflare Access
A deep dive into a fully Terraform-managed Zero Trust demo covering both OIDC and SAML protocols to expose real-world integration failure modes.
Stock photo for illustration only, not from the actual event
- Built a fully Terraform-managed Zero Trust demo integrating Entra ID and Cloudflare Access via OIDC and SAML.
- Tested real-world edge cases like Carol to prove compound policy logic actually functions.
- Automated admin consent provisioning and GUID-based group memberships to prevent common pitfalls.
Most Zero Trust write-ups stop at user sign-in and access, but that is rarely where integrations break. They usually break on group memberships that almost satisfy a policy, missing admin consent that remains silent until the first real sign-in, or country rules misconfigured between logical operators. This project was built to make those failure modes visible rather than theoretical.
The creator built a small, fully Terraform-managed demo using Microsoft Entra ID to drive Cloudflare Access authorization over both OIDC and SAML against three users, verifying identities provably at the origin. Everything is provisioned by Terraform including app registrations, demo users, groups, admin consent grants, identity providers, and dedicated tunnels with a single apply command.
Bridging Entra ID and Cloudflare Access often introduces friction due to protocol differences and group propagation mechanics. Utilizing Infrastructure-as-Code eliminates manual portal configuration errors, which frequently result in silent authentication failures during live user sign-ins.
Entra is registered with Cloudflare twice: once through the native azureAD OIDC connector resolving group membership via live Microsoft Graph calls, and once as a generic SAML 2.0 app where group membership rides inside the signed assertion. Test cases like Carol demonstrate complex compound policies where a user can satisfy an include block yet get rejected due to unmet require blocks, perfectly illustrating granular policy enforcement.
Stock photo for illustration only, not from the actual event
The architecture also features a deny policy at precedence 1 for short-circuiting, a purpose-justification prompt, a 30-minute session duration, and a path-scoped bypass for health checks. The origin server decodes the JWT assertion and verifies claims to ensure requests strictly comply with established security policies rather than bypassing them.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment