JA EN
shiichan

Google Workspace SCIM provisioning now works with Cloudflare One

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! I found a nice identity update for Cloudflare One today, so let me share it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

In the Cloudflare Changelog, Cloudflare announced that Google Workspace SCIM provisioning can now connect to Cloudflare One through a generic SAML identity provider.

SCIM is an open standard for syncing user identities between an identity provider and a service. Google Workspace is rolling out custom SCIM profiles in beta, and organizations with access can use Google's built-in provisioning to send user updates and deprovisioning events to Cloudflare One.

Why it matters

When someone leaves or changes roles, a lingering Access session is a problem. With SCIM, changes in Google reach Cloudflare automatically, so fewer things slip through manual cleanup.

What changes

If you use Google Workspace as your identity source, deprovisioning a user in Google can now also revoke their active Access sessions in Cloudflare One.

Dive Deep

Here is the setup flow.

  • In Cloudflare One, use a generic SAML identity provider (the dedicated Google Workspace integration does not support SCIM)
  • Configure a SAML app in Google
  • Enter the Cloudflare SCIM endpoint and secret in the app's autoprovisioning settings
  • Turn on "Enable user deprovisioning" in Cloudflare One to revoke active Access sessions when Google deprovisions a user

A few things to keep in mind.

  • Google's configured deprovisioning delay still applies
  • Support for the existing Google Workspace OIDC client will be added once Google supports OIDC + SCIM
  • Group membership is configured separately: have the Google SAML app send a groups attribute during authentication. Selecting groups as a SCIM scope does not sync membership (Google is still adding this)
  • Users must first authenticate to Access or register a device with the Cloudflare One Client before SCIM updates can apply
  • Availability of custom SCIM profiles depends on Google's beta rollout

Wrap-up

  • Google Workspace SCIM can connect to Cloudflare One via generic SAML
  • Deprovisioning can revoke Access sessions
  • Group sync is not done by SCIM yet, use the groups attribute
  • It depends on Google's beta availability

This one is for admins running zero trust with Google Workspace and Cloudflare One!

Related posts