Single sign-on

A client administrator connects the organisation’s identity provider to LightHouse™ at Access → Single sign-on. Sign-in at the edge is enforced by Cloudflare Access for every tenant (see Authentication); this page configures the organisation’s provider in Cloudflare Access.

Requirements

Requirement	Detail
Role	client_admin, signed in as a person
Identity provider	Microsoft Entra ID, Okta, Google Workspace, SAML 2.0 or OpenID Connect
Limit	Up to five identity providers per tenant, in addition to the one-time PIN; refused as too_many_providers above that
Registration	An application registered in the identity provider with the values LightHouse shows

Client secret

The client secret is sent to Cloudflare Access in the provider’s configuration and is then discarded. LightHouse does not store, log, audit or return it, and Cloudflare Access does not return it. Atlantic staff have no access to it. To change it, use Replace secret.

Values for the identity provider

Under What to enter in your identity provider, the page shows:

Value	Use
Redirect URI (ACS URL)	The address the provider returns the person to after sign-in. For SAML, the assertion consumer service URL
Entity ID (audience)	For SAML, the service provider’s entity ID

Register an application with these values, then enter the provider’s details under Connect an identity provider.

Microsoft Entra ID

In the Microsoft Entra admin centre, register an application (App registrations → New registration) with a Web redirect URI set to the value LightHouse shows. Create a client secret under Certificates & secrets. Grant the delegated Microsoft Graph permissions openid, email, profile and User.Read, with administrator consent, and GroupMember.Read.All if sign-in rules will use Entra groups.

In LightHouse, enter the Client ID (the application ID), the Directory (tenant) ID and the Client secret.

Okta

In the Okta admin console, create an OIDC – OpenID Connect app integration of type Web Application, with the sign-in redirect URI set to the value LightHouse shows, and assign it to the people or groups who will use LightHouse.

In LightHouse, enter the Okta organisation URL (such as https://example.okta.com), the Client ID and the Client secret. For a custom authorisation server, also enter its Authorisation server ID.

Google Workspace

In the Google Cloud console for the Workspace organisation, create an OAuth client ID of type Web application, with the authorised redirect URI set to the value LightHouse shows.

In LightHouse, enter the Client ID, the Client secret and the Google Workspace domain.

SAML 2.0

In the identity provider, create a SAML application with the ACS URL and entity ID that LightHouse shows, and release the person’s email address as an attribute.

In LightHouse, paste the provider’s metadata XML. LightHouse reads the sign-in URL, the issuer and the signing certificates from it. If the email address is released under a non-default attribute name, enter it as Email attribute.

OpenID Connect

In the identity provider, register a confidential web client with the redirect URI that LightHouse shows.

In LightHouse, enter the Client ID, the Client secret, the Issuer URL, the Authorisation URL, the Token URL and the JWKS URL. If the email address is in a claim other than email, enter it as Email claim.

Testing

A new provider starts in the state Testing. In this state its Cloudflare Access policy admits only the administrator who connected it, so a misconfigured provider (for example, one that points at the wrong directory or releases a claim that matches every user) admits no other user.

1. Choose Connect.

   Result: the provider shows Testing, and only the connecting administrator can sign in through it.

2. Sign out, sign in again and choose the new provider.

3. Return to Access → Single sign-on and choose Confirm the test.

   Result: the provider shows Tested, ready to turn on.

The test is accepted only from a session that Cloudflare Access admitted through that provider. A confirmation from any other session or provider is refused.

Turning it on

Choose which people the provider admits, then choose Turn on for the organisation:

Option	Admits	Condition
Everyone with an address at	People at one or more verified domains	An unverified domain is refused
Everyone the provider signs in	Every user of the provider	The provider is the organisation’s own: Entra ID, Okta, Google Workspace, SAML or OpenID Connect

Turning a provider on admits these people at the edge. Each person’s role in LightHouse comes from the sign-in rules on the Access page or from a directory group. A person whom no rule admits is refused.

Provider	Second factor
Entra ID, Okta	Proved by the provider
Google Workspace, SAML, OpenID Connect	Required by Cloudflare Access

GET /api/v1/me shows how a person’s second factor was proved.

One-time PIN, secrets and disconnection

Action	Effect
Stop offering the one-time PIN	Retires the email one-time PIN that a tenant created by sign-up starts with. Available once a provider the administrator connected has been tested and turned on
Replace secret	Sends a new client secret to Cloudflare Access; the previous secret is no longer used
Disconnect	Removes the provider, its Access policy and its entry on the tenant’s sign-in page

A provider can be disconnected, or the one-time PIN retired, only while another active sign-in method remains for the tenant’s administrators.

Providers configured by Atlantic before self-service single sign-on was available are shown as Set up by Atlantic and remain in use. Changes to them are made through Atlantic support.

API

Route	Role	Action
GET /api/v1/sso	client_admin	Lists the providers, their states and the values for the identity provider
POST /api/v1/sso	client_admin, a person	Connects a provider in the state Testing
POST /api/v1/sso/{id}/test	A person signed in through that provider	Confirms the test
POST /api/v1/sso/{id}/enable	client_admin, a person	Turns the provider on: {"email_domains": [...], "all_users": false}
POST /api/v1/sso/{id}/secret	client_admin, a person	Replaces the client secret
DELETE /api/v1/sso/{id}	client_admin, a person	Disconnects the provider
POST /api/v1/sso/otp/retire	client_admin, a person	Retires the one-time PIN

Audit

Each step is recorded in the tenant’s audit log with the person who made it: sso_provider_connected, sso_provider_tested, sso_provider_enabled, sso_secret_replaced, sso_provider_removed and sso_otp_retired. The client secret is not written to the log.