{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/cloudflare-access-oidc-required-claim-mapping/", "item": { "id": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/", "slug": "cloudflare-access-oidc-required-claim-mapping", "url": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping.md", "json": "https://update.dsesecurity.com/api/v1/posts/cloudflare-access-oidc-required-claim-mapping/" }, "title": "Review required OIDC claims before connecting a SaaS application through Cloudflare Access", "summary": "A missing required claim can block authentication even after the user signs in successfully.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "microsoft-365-identity", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:30+00:00", "modified_at": "2026-10-15T13:36:17+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 266, "potentially_affected": "This concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.", "dse_recommendation": "DSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in.", "primary_source": { "name": "Cloudflare — Generic OIDC SaaS", "url": "https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A missing required claim can block authentication even after the user signs in successfully.

\n

Source facts

\n

Cloudflare’s generic OIDC SaaS integration sends selected identity scopes and claims to the application. Administrators can remove an unnecessary groups scope, filter the groups passed onward, and map an identity-provider attribute to a named OIDC claim. If a mapped claim is marked required and the identity provider does not provide it, Cloudflare fails the authentication request. Where multiple identity providers are enabled, per-provider claim mappings can override the parent mapping. The application’s callback URL and Access policy are separate required integration settings.

\n

Source: Cloudflare — Generic OIDC SaaS.

\n

Applicability

\n

This concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.

\n

DSE recommendation

\n

DSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in. Record claim name, source attribute, expected format, and whether absence should block entry. Review each allowed identity provider, especially where group names or employee identifiers differ. Share only attributes the application needs. Keep an approved recovery account or procedure available during the cutover, and document callback URLs independently of launcher URLs so a user-facing shortcut is not mistaken for the protocol endpoint.

\n

Verification

\n

Use test identities with complete claims, a missing required attribute, and the permitted alternative identity provider. Confirm the expected rejection and successful mapping without exposing full tokens in tickets. Review application-side account matching and authorization as well as successful completion of the Access login screen.

\n

Official reference

\n

Cloudflare — Generic OIDC SaaS. Reviewed October 15, 2026.

", "content_text": "A missing required claim can block authentication even after the user signs in successfully.\nSource facts\nCloudflare’s generic OIDC SaaS integration sends selected identity scopes and claims to the application. Administrators can remove an unnecessary groups scope, filter the groups passed onward, and map an identity-provider attribute to a named OIDC claim. If a mapped claim is marked required and the identity provider does not provide it, Cloudflare fails the authentication request. Where multiple identity providers are enabled, per-provider claim mappings can override the parent mapping. The application’s callback URL and Access policy are separate required integration settings.\nSource: Cloudflare — Generic OIDC SaaS.\nApplicability\nThis concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.\nDSE recommendation\nDSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in. Record claim name, source attribute, expected format, and whether absence should block entry. Review each allowed identity provider, especially where group names or employee identifiers differ. Share only attributes the application needs. Keep an approved recovery account or procedure available during the cutover, and document callback URLs independently of launcher URLs so a user-facing shortcut is not mistaken for the protocol endpoint.\nVerification\nUse test identities with complete claims, a missing required attribute, and the permitted alternative identity provider. Confirm the expected rejection and successful mapping without exposing full tokens in tickets. Review application-side account matching and authorization as well as successful completion of the Access login screen.\nOfficial reference\nCloudflare — Generic OIDC SaaS. Reviewed October 15, 2026.", "content_markdown": "A missing required claim can block authentication even after the user signs in successfully.\n\n## Source facts\n\nCloudflare’s generic OIDC SaaS integration sends selected identity scopes and claims to the application. Administrators can remove an unnecessary groups scope, filter the groups passed onward, and map an identity-provider attribute to a named OIDC claim. If a mapped claim is marked required and the identity provider does not provide it, Cloudflare fails the authentication request. Where multiple identity providers are enabled, per-provider claim mappings can override the parent mapping. The application’s callback URL and Access policy are separate required integration settings.\n\nSource: [Cloudflare — Generic OIDC SaaS](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/).\n\n## Applicability\n\nThis concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.\n\n## DSE recommendation\n\nDSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in. Record claim name, source attribute, expected format, and whether absence should block entry. Review each allowed identity provider, especially where group names or employee identifiers differ. Share only attributes the application needs. Keep an approved recovery account or procedure available during the cutover, and document callback URLs independently of launcher URLs so a user-facing shortcut is not mistaken for the protocol endpoint.\n\n## Verification\n\nUse test identities with complete claims, a missing required attribute, and the permitted alternative identity provider. Confirm the expected rejection and successful mapping without exposing full tokens in tickets. Review application-side account matching and authorization as well as successful completion of the Access login screen.\n\n## Official reference\n\n[Cloudflare — Generic OIDC SaaS](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/", "url": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Review required OIDC claims before connecting a SaaS application through Cloudflare Access", "item": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/#article", "identifier": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/", "url": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/", "headline": "Review required OIDC claims before connecting a SaaS application through Cloudflare Access", "description": "A missing required claim can block authentication even after the user signs in successfully.", "abstract": "A missing required claim can block authentication even after the user signs in successfully.", "articleBody": "A missing required claim can block authentication even after the user signs in successfully.\nSource facts\nCloudflare’s generic OIDC SaaS integration sends selected identity scopes and claims to the application. Administrators can remove an unnecessary groups scope, filter the groups passed onward, and map an identity-provider attribute to a named OIDC claim. If a mapped claim is marked required and the identity provider does not provide it, Cloudflare fails the authentication request. Where multiple identity providers are enabled, per-provider claim mappings can override the parent mapping. The application’s callback URL and Access policy are separate required integration settings.\nSource: Cloudflare — Generic OIDC SaaS.\nApplicability\nThis concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.\nDSE recommendation\nDSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in. Record claim name, source attribute, expected format, and whether absence should block entry. Review each allowed identity provider, especially where group names or employee identifiers differ. Share only attributes the application needs. Keep an approved recovery account or procedure available during the cutover, and document callback URLs independently of launcher URLs so a user-facing shortcut is not mistaken for the protocol endpoint.\nVerification\nUse test identities with complete claims, a missing required attribute, and the permitted alternative identity provider. Confirm the expected rejection and successful mapping without exposing full tokens in tickets. Review application-side account matching and authorization as well as successful completion of the Access login screen.\nOfficial reference\nCloudflare — Generic OIDC SaaS. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:30+00:00", "dateModified": "2026-10-15T13:36:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review required OIDC claims before connecting a SaaS application through Cloudflare Access" }, "articleSection": [ "Cybersecurity", "Microsoft 365 & Identity" ], "keywords": [ "Cybersecurity", "Microsoft 365 & Identity", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" } ], "wordCount": 266, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Generic OIDC SaaS", "url": "https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/" } } ] } }