Additional Admin "Member invitation" received, but doesn't work

[graham.wideman]

How is this “member invite” process supposed to actually take effect?

The Cloudflare account that owns a particular domain (call it “somedomain_com”) sent me an invite to become a “member” so that I could perform some admin duties. (Underscore because forum won’t allow posting URLs. Sigh.)

I received the invite, and clicked on the link. That took me to a page requiring me to create a CF account – OK, fair enough. Having done that, and responded to validation email, I was able to log in and accept the invitation.

However, I did not see somedomain_com listed on the “Websites” > Home page, so not available for me to do anything with.

So, I suspected that I might need to add that domain explicitly. I hit the “Add a Site” button, and added somedomain_com. But CF treated that as though I wanted to set up somedomain_com from scratch, and offered me various subscriptions to set up a new site.

Fearing that this was a wrong turn, I looked for a way to remove somedomain_com (now showing status “Setup” the list on page Home. But there is no visible way to remove it.

Oddly, some minutes later, I noticed that back on the Home screen, somedomain_com’s status had chanced to “Active”. I clicked on it, and was then able to browse some of its DNS settings, which was my immediate objective.

A while later I logged out, and then noticed that I had received email from CF titled " somedomain_com has been deleted".

Yikes! I can’t tell if that means it’s been deleted altogether, or just removed from my account, or is this a side effect of my spuriously-added new somedomain_com being replaced by the invited membership in the original somedomain_com?

At any rate, upon logging in, my Home page shows no domains for me. I waited a bit, nothing happened.

So I again hit the “Add a Site” button, despite earlier reservations. That again added somedomain_com as a new site in Setup status (not providing access to the existing invited one). So I’m back to square, er, two, or minus-one, depending on how you count it.

So how the Dickens is this “invite member as additional Admin” process supposed to work?

Graham

[fritex]

@graham.wideman

However, I did not see somedomain_com listed on the “Websites” > Home page, so not available for me to do anything with.

If you go to Cloudflare dashboard, you should see the page to choose the Cloudflare account. Therefrom, upon clicking on the CF account, you should get listed the domains under that CF account.

Example:

@graham.wideman

A while later I logged out

May I ask have you tried using a different Web browser, or tried clearing your Web browser cache?
How about using a Private window (Incognito mode) or a VPN connection if possible?
Is it the same behaviour on your mobile phone (4G LTE, mobile data, cellular)?

I’d prefer using a different Web browser if you are logged into one CF account, then logoff, then log back in using 2nd CF account. Might be some web browser cache you’ve experienced.

@graham.wideman

Yikes

Domain would be removed from CF account.

@graham.wideman

my Home page shows no domains for me

From what I understand, you were actually wanting to add yourself as a 2nd member of your 1st CF account. Therefore, “transfer” the domain from 1st to 2nd CF account?

1. Should leave the domain at 1st CF account
2. Add domain to the 2nd CF account, change nameservers, double-check all the settings
3. Upon success and once active and enabled, either manually remove the domain from the 1st CF account, otherwise let it be “as-is” as far as Cloudflare would notice the domain nameservers are using and pointed to the CF nameservers of your 2nd CF account and would remove the domain name from your 1st CF account in a few days or so

Is that what you wanted to do or something else?

[graham.wideman]

Well, it seems that much of this run-around was because I didn’t have a clear understanding of what “member” means in this context.

I expected that the feature was intended to allow another user to become a member of the admin team for a particular domain. That’s why I expected the already-registered-to-the-other-account domain to appear in my account’s list as well.

Instead, the feature allows a second person to become a non-super-admin of the other account, regardless of how many domains that other account has.

Having been granted member status in the other account, I now see that when I log in to my account on CF, it then immediately offers me a choice of accounts to proceed with. If I select the other account, then it’s as though I’ve logged in to the other account (minus some super-admin permissions, apparently), and i can access details of the domains registered to that other account.

So, I’m now able to do what I need to do. But this seems like the feature was not completely thought through, as it doesn’t seem to provide a way for the operator of several domains on CF to delegate admin of just one or some of the domains to another user, or to delegate admin of several sites individually to different users. But, not a problem for me at the moment.

[sdayman]

It would be neat to share just a domain, and that can be done with API tokens:

Cloudflare API Documentation

As for the Multi-User feature, it’s doing exactly as advertised. You can invite another user to admin your account:

Manage account access · Cloudflare Fundamentals docs

Even the invitation screen makes this clear:

If you need to isolate domains, they would need their own account, then invite other users in to admin that account.

[graham.wideman]

Thanks for commenting.

Yes, in retrospect, the “Multi-User” feature behaves in accordance with the various screens. From long experience with other servers and services that offer control of permissions by type-of-permission and also by the specific resource to be admin’ed, I was rather primed to expect the control of admin permissions per domain. With that expectation I overlooked some of what the UI says.

In later studying of CF docs that I had not previously seen, my expectation is not entirely out of line: If you have an Enterprise account, you can indeed give very fine-grained permissions to different members of the account. Though glaringly absent is the ability to set permissions per domain.

Your suggestion regarding API tokens is an interesting side-note, though not applicable if the users want a user interface rather than an API.

Your underlining of “Can access the full account” in the Invite members panel is one of those UI indications that I noticed, but couldn’t quite make sense of. (In setting up sharing, I temporarily logged in as the owner of the account, to figure out what steps they should take to allow my own account to gain admin permissions for the domain of interest.)

That “Administrator - …” text looked like it might be an item of a drop-down that might offer alternative choices, but clicking on it does nothing. So just sitting there enigmatically, it wasn’t clear what it was stating or offering. It does not, for example, say “As administrator”, or “new member will have permissions of Administrator”. I now see from docs that for an enterprise account it is indeed rendered as a drop-down list with multiple choices. When it’s presented as a list, it’s more obvious that it is a setting for the user to choose and approve of.

Finally, “If you need to isolate domains, they would need their own account,” – yes, sure. Except that Cloudflare requires a different email address for each account. So if one had a dozen domains for which to share admin with separate individuals, that would require the owner of the domains to have a dozen different email account just for that purpose. Not a practical way to proceed

But, not a problem for us at the moment, so not worth us dwelling on here.