Cloudflare Access/Teams - user denied without reason

[gareth3]

We use Cloudflare access to add an extra auth step to internal staff to access a support part of our application and our test application.

All was working well withour 5 user limit until we got another member of staff. We’ve upgraded to Teams free which gives 50 users but I’ve got a user who can’t log in to our test application.

In the teams dashboard, Matt shows up as “Inactive” under Access:

But is “Blocked” in the logs:

In Teams I’ve got a rule set against this domain just allowing our staff (and Matt’s part of this group)

I tried to revoke the token so it’d get re-issued but I get a 500 error from the dashboard when doing so.

Looking at the Teams Billing page I’ve got 5/50 users in use. How do I get 6 if they can’t authenticate?

Any help appreciated, support are taking weeks to get back to me on things so thought I’d try here

Thanks

Gareth

[sdayman]

@gareth3

support are taking weeks

It shouldn’t take that long. Can you post the ticket number?

[gareth3]

My bad, it was just a single week (and admittedly the ticket isn’t related to this issue, it was a caching ticket: 2069145 ) I was just saying it seems like support are snowed under at the moment so hoping I can solve this here instead.

[sdayman]

Ok.

My Access experience is limited. But I see there are Rules, and it would appear that Matt fits one of your Block rule settings.

[gareth3]

Yeah it’s not that - all the applications use the same user group and rules. His email address is just another email address in the group. This worked perfectly until we hit 6 users, so I’m inclined to think it’s because we’re on the legacy plan and it’s not fully upgraded us.

I can’t revoke his tokens either (even though he has none) and just get an error in the dashboard

@sdayman do you know anyone at Cloudflare who can take a look at this? Matt’s our CTO and completely locked out of our application’s support tools until we get this resolved. I’m not sure if we’re on the wrong plan (if we are, why do other logins work?). It seems broken to me with the 500s from the app when we try to revoke tokens.

[sdayman]

I guess it’s time for a new ticket. Make sure to post the ticket number here to push it along. That should link the ticket to this thread.

[gareth3]

Thanks for your replies.

New ticket logged under 2074720