mTLS access but login provider if no certificate provided

Website, Application, Performance Security
1

Hello,

I have a Nextcloud-server behind a cloudflare tunnel, everything is working. But I am struggling with limiting access to the server in a way that satisfies my needs.

Use cases:

  1. Browser access from “any” device, preferably by authenticating through an idP.

  2. Automatic authentication through certificates, enabling apps and programs to access it.

I have figured out how to set up the two ways of authentication, but not the way I want. The idP login is set up as an application in Zero Trust.
The automatic authentication is set up through with a client certificate and mTLS rules.

My goal is for it to work like this: If no valid certificate is provided, the user has to login through the idP.
If a valid certificate is provided, the idP check is bypassed.

Is this possible to achieve?

Thank you very much!

3

Edit: The mTLS-authentication is implemented as a WAF rule.

4

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.