Hello, I’m setting up Azure AD IdP for my domain. After completing Auth flow for Azure AD, Cloudflare reports error ‘That account does not have access’. Is there any additional config that might be needed? Any tips on the approach I can take to resolve this, thanks much.
2 Likes
Has the user been granted permission to the application in Azure?
@Cyb3r-Jak3 yes, I even tried Github as IdP, same issue there as well : That account does not exist.
Did you test in Azure that the connections is working?
HI @Cyb3r-Jak3 yes the connection is working. That’s why I verified both with Azure and GitHub IdP, in both cases Cloudflare is reporting the same error, I understand some users have reported it in the past and it was fixed by Cloudflare, but then I’m still getting it.
Any further clues on how to proceed?
I don’t but maybe another @MVP can provide further debugging.
1 Like
Can you show us your application policy i.e. how you allow your users to access your application?
1 Like
How should be the policy configured?What is the best option?
Thank you
KR
Edin
Hi user 19055,
have you managed to solve the problem?I have the same issue. Is it related to the Plan?
KR
Edin
I had the same issue (“that account does not have access”) when trying to login to the Cloudflare Access App Launcher with Azure AD as IDP (SAML 2.0).
I fixed it by looking at the Cloudflare Access logs for the access denied attempts.
In my case I had to go to Cloudflare Access admin>Settings>Authentication>App Launcher Manage>
and you have to add a separate policy for each login method you want. i.e. I had another SSO IDP that already had a policy so I thought I could add the Azure SAML IDP under the include/require of that existing policy (Login Methods) but it didn’t work because in the logs it showed that it was only checking the first value of the policy.
I added a second policy with include/require for Azure SSO login method and it worked.
p.s. you can go to Logs>Access and view reasons for the errors like ‘that account does not have access’. After I checked the log it told me that the issue was exactly with the app launcher allowed login methods policy and showed me exactly what logic it performed to check permissions.
Also, I set these settings in Azure AD under the SAML SSO settings:
Under ‘SAML Certificates’ click Edit and set ‘Signing Option’ to ‘Sign SAML Assertion’, set ‘Signing Algorithm’ to ‘SHA1’, save those settings.
In my case, I just had to add a policy/rule. I guess by default it just denies everything, so you need to allow something.