JumpCloud SSO x CloudFlare Access Policies (Zero Trust)

[shawnsong]

Hi folks,

Hope everyone is sailing smoothly through the last month of Q3 and gearing up for the final stretch of 2024 – time flies, doesn’t it?

Recently, I encountered a unique use case that got my creative gears turning right from the start. The task? We needed to add an authentication layer to a web application’s gateway. Ideally with a SSO IdP that supports SAML. 

So, fast forward a bit: I mapped out a strategy that combines CloudFlare Access Policies and JumpCloud’s CloudFlare SAML connector together to achieve this goal. And to validate the concept, I even built a sample Flask app (which, if you're interested, you can check out here).

The architecture looks something like this:

As usual, let’s dive into the How-To.

Step 0 - Make sure the DNS record of your app is managed by CloudFlare. 

• DNS records | Cloudflare DNS docs 
• Proxy status | Cloudflare DNS docs 

Step 1 - Integrate CloudFlare with JumpCloud (SAML)

• Integrate with Cloudflare - JumpCloud
• Generic SAML 2.0 | Cloudflare Zero Trust docs
• Create respective user groups on JumpCloud for role based access to your app, and bind the CloudFlare you created above on each user group:

Step 2 - Create the access policies on CloudFlare

• Access policies
• You can create multiple “self-hosted applications” as in our case we have two application paths representing 2 different roles:
• The settings of 1 of the application look like this.
  • At Overview section:
    • At Policy section - Make sure the policy check against the group member in JumpCloud:
    • At the Authentication section - select the SAML integration with JumpCloud you have created from above.
  • I have left the rest of the settings / configurations untouched, feel free to tweak based on your application environment. 
  • Repeat the same steps for /IT path if needed. 

Now, It’s time for a test run

The main use case I can think of is protecting your application — often internal corporate ones where adding an authentication layer within the application (via auth SDKs) isn’t feasible, especially for just a handful of users. Implementing a modern security solution like SAML for SSO can solve this without needing extensive changes. 

Of course, there are plenty of other use cases out there—as long as those DNS records are in your hands 😉.

Thanks for reading! Catch you folks in the next one!