Cannot edit application in Access: "service_auth_401_redirect cannot be true when there is no service auth policy on app"

Zero Trust Access
1

For testing purposes, I added service authorisation to two of my applications that are configured via Access. I am unable to edit any of those two apps and I cannot remove or add any policies because of the following error that is displayed on top of the page.

Error configuring your application: Access api error invalid_request: service_auth_401_redirect cannot be true when there is no service auth policy on app

I have searched through all settings that are available to me in the dashboard, I have searched through all account settings but was not able to find any option that sounded like it would change a Service Auth 401 Redirect setting. I am kinda lost now.
I guess this is related to changing the plan of my account. I first had the Standard plan enabled but then noticed that I can get service token auth with the Access plan so I switched to it a few days ago. Both apps were added when the Standard plan was active.

Does anyone have an idea how I can solve this without having to delete the whole application?
Thanks in advance.

1 Like
2

Today I’ve encountered a very similar problem, except I didn’t change the plan (always had “Standard” plan. Unfortunately only deleting and re-adding an application helped.

3

I have a ticket open at the Cloudflare Support and they are investigating the issue. I will keep this updated.

Instead of deleting your application, it is possible to edit the app via the API. Not really comfortable, but worth trying.

curl --request PUT \
--url 'https://api.cloudflare.com/client/v4/accounts/123-your-account-id-789/access/apps/123-your-app-id-789' \
--header 'Authorization: Bearer --xyz--' \
--header 'Content-Type: application/json' \
--data '{
"type": "self_hosted",
"name": "Your App Name",
"domain": "your-app.domain.com",
"service_auth_401_redirect": false
}'

The "service_auth_401_redirect": false part is important.

1 Like
4

I have received the info from the Support team that their engineering team fixed this issue. It should not happen in the future.