Is it possible to allow access to enrolled users in gateway (Cloudflare Zero Trust Access) without h

Is it possible to allow access to enrolled users in gateway (Cloudflare Zero Trust Access) without having to use the E-Mail OTP-Code (we don't have / need an IDP atm). I would just like if the user has gateway installed and enabled that he gains instant access.

FF0rce Is it possible to allow access to enrolled users in gateway (Cloudflare Zero Tru...

Chaika•8/24/23, 7:01 PM

You can use a gateway posture check, and then a service auth policy which includes it: https://community.cloudflare.com/t/using-warp-posture-checks-with-cloudflare-access/449569

Cloudflare Community

Using WARP posture checks with Cloudflare Access

This tutorial explains how to enable WARP client posture checks and use them in an Access application policy. Enabling the “Warp” and “Gateway” selectors The “Warp” and “Gateway” selectors are not visible in the policy creator by default and must be manually enabled. Fortunately, this is quite simple and can be done in only a few steps. In th...

Chaika•8/24/23, 7:02 PM

Clients will pass the “Gateway” posture check if:

    The WARP client is signed in to your Zero Trust organization; and
    The WARP connection mode is “Gateway with WARP”; and
    The “Proxy” option is enabled in Settings → Network → Firewall

Clients will pass the “Gateway” posture check if:

    The WARP client is signed in to your Zero Trust organization; and
    The WARP connection mode is “Gateway with WARP”; and
    The “Proxy” option is enabled in Settings → Network → Firewall

Important to note those requirements as well

CChaika You can use a gateway posture check, and then a service auth policy which includ...

F0rceOP•8/24/23, 7:26 PM

Thanks for your help. I had everything setup correctly besides the Service Auth Policy. I was using allow.

I sometimes get discombombulated when to use which policy... I would have never thought that Gateway is an Service Auth Policy.

Really appreciate it

FF0rce Thanks for your help. I had everything setup correctly besides the Service Auth ...

Chaika•8/24/23, 7:29 PM

Of course!

Yea it can be a bit confusing, Allow is basically "go through an identity provider, and then check the conditions", Bypass is if you match these conditions, exit out of the Zero Trust flow and go through normal zone security, Service Auth is "check these conditions, if you pass, you go through the full zero trust flow, just without an identity"

Chaika•8/24/23, 7:30 PM

https://developers.cloudflare.com/cloudflare-one/policies/access/#actions

CChaika Of course! Yea it can be a bit confusing, Allow is basically "go through an ide...

F0rceOP•8/24/23, 7:30 PM

Thanks for the extra clarification. I will write that down in our notes. Have a great rest of day

Cyb3r-Jak3•8/24/23, 8:41 PM

1. You can delete the DNS record for the tunnel. You'll just have to make sure to recreate it
2. You can enable/disable login methods for certain applications

Chaika•8/24/23, 8:45 PM

would be cool, wouldn't hold your breath for it though. That entire UI is just a wrapper around the cloudflared config in json format, and afaik there's no way to disable a ingress rule without deleting it, so it'd need to be added there first (some disabled: property or something)

F0rceOP•8/24/23, 9:26 PM

I am currently getting the following warning when starting my worker with wrangler dev --remotewrangler dev --remote

▲ [WARNING] worker failed to prewarm: Service Temporarily Unavailable▲ [WARNING] worker failed to prewarm: Service Temporarily Unavailable

Is there something I can do on my side, or do I have to wait until it is fixed on cloudflare side ?

kian•8/24/23, 9:49 PM

Are you using Queues?

F0rceOP•8/24/23, 10:16 PM

a small google search said that queues can not be used in --remote--remote so I fixed it by not using queues (as they were not needed for my testing). thanks you for the answer though.

valkyrie_pilot•8/24/23, 10:57 PM

what's the difference between "Update DNS record" and "Patch DNS record" in the API?

Vvalkyrie_pilot what's the difference between "Update DNS record" and "Patch DNS record" in the ...

Cyb3r-Jak3•8/25/23, 12:03 AM

Update replaces and patch replaces parts

valkyrie_pilot•8/25/23, 12:15 AM

alright, will probably only use update then as i already have all the record data

Logos•8/25/23, 1:58 AM

Does anybody know what contract negotiation means in this agile value, Customer Collaboration Over Contract Negotiation?

valkyrie_pilot•8/25/23, 3:58 AM

is there a reason the API returns values for DNS names that it doesn't actually support? For example, rather then returning

for root zone DNS records, it returns the name of the zone, which is.. complex to normalize

Ssathoro Postmark has amazing deliverability and I'll never use anything else. I even pay...

Karew•8/25/23, 5:17 AM

Hey I just wanted to say that we switched to Postmark from SES and it’s been truly amazing. Thanks for the recommendation.

KKarew Hey I just wanted to say that we switched to Postmark from SES and it’s been tru...

chientrm.com•8/25/23, 6:05 AM

The pricing is amazing too

wangtiezhu•8/25/23, 9:06 AM

hey guys, this time I have really discovered an issue with the documentation(https://developers.cloudflare.com/workers/wrangler/commands/#get)

Commands · Cloudflare Workers docs

Wrangler offers a number of commands to manage your Cloudflare Workers.

Wwangtiezhu hey guys, this time I have really discovered an issue with the documentation(htt...

Cyb3r-Jak3•8/25/23, 2:23 PM

Can you open an issue at https://github.com/cloudflare/cloudflare-docs

GitHub

GitHub - cloudflare/cloudflare-docs: Cloudflare’s documentation

Cloudflare’s documentation. Contribute to cloudflare/cloudflare-docs development by creating an account on GitHub.

HHyper I am thinking about using next middlewares to handle protected pages, but that w...

Cyb3r-Jak3•8/25/23, 2:23 PM

Depends on your use case. You can maybe look at using access instead

Vvalkyrie_pilot is there a reason the API returns values for DNS names that it doesn't actually ...

Cyb3r-Jak3•8/25/23, 2:25 PM

The actual name is the correct value. I believe

is a placeholder in the dashboard to prevent confusion

HHyper the protected pages are for logged in customers, I don’t think access is used fo...

Cyb3r-Jak3•8/25/23, 2:39 PM

Yeah middleware functions is going to be the cheapest.

CCyb3r-Jak3 Can you open an issue at https://github.com/cloudflare/cloudflare-docs

wangtiezhu•8/25/23, 2:44 PM

done~

Mizael_S•8/25/23, 3:00 PM

Is it possible to add glue records?

MMizael_S Is it possible to add glue records?

Cyb3r-Jak3•8/25/23, 3:09 PM

What do you need glue records for?

CCyb3r-Jak3 What do you need glue records for?

Mizael_S•8/25/23, 3:21 PM

mail server

MMizael_S mail server

Cyb3r-Jak3•8/25/23, 3:37 PM

I believe Cloudflare auto adds glue records

CCyb3r-Jak3 I believe Cloudflare auto adds glue records

Mizael_S•8/25/23, 3:38 PM

sure?

MMizael_S sure?

Cyb3r-Jak3•8/25/23, 3:39 PM

Ah I just checked and it doesn’t.

CCyb3r-Jak3 Ah I just checked and it doesn’t.

Mizael_S•8/25/23, 3:41 PM

Unsmart•8/25/23, 3:44 PM

a subdomain zone requires enterprise afaik (called LTZ)

Original message was deleted

Unsmart•8/25/23, 3:46 PM

pretty sure that is still the root domain just partial setup

Cyb3r-Jak3•8/25/23, 3:47 PM

LTZ is when you split off a subdomain and partial is when you don’t change the nameservers

Unsmart•8/25/23, 3:50 PM

Not really unless you have enterprise so you can use different backend but even then having the actual domain on cloudflare would be better than using saas

Unsmart•8/25/23, 3:51 PM

why cant you add the domain to cloudflare?

CCyb3r-Jak3 The actual name is the correct value. I believe `@` is a placeholder in the dash...

valkyrie_pilot•8/25/23, 6:24 PM

Hmm. Sending the actual name in a create record request results in a 400- I’ll test this again when i get home, something might have been misconfigured?

Is it possible to allow access to enrolled users in gateway (Cloudflare Zero Trust Access) without h

Similar Threads

Similar Threads

Similar Threads