Review required OIDC claims before connecting a SaaS application through Cloudflare Access

A missing required claim can block authentication even after the user signs in successfully.

Source facts

Cloudflare’s generic OIDC SaaS integration sends selected identity scopes and claims to the application. Administrators can remove an unnecessary groups scope, filter the groups passed onward, and map an identity-provider attribute to a named OIDC claim. If a mapped claim is marked required and the identity provider does not provide it, Cloudflare fails the authentication request. Where multiple identity providers are enabled, per-provider claim mappings can override the parent mapping. The application’s callback URL and Access policy are separate required integration settings.

Source: Cloudflare — Generic OIDC SaaS.

Applicability

This concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.

DSE recommendation

DSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in. Record claim name, source attribute, expected format, and whether absence should block entry. Review each allowed identity provider, especially where group names or employee identifiers differ. Share only attributes the application needs. Keep an approved recovery account or procedure available during the cutover, and document callback URLs independently of launcher URLs so a user-facing shortcut is not mistaken for the protocol endpoint.

Verification

Use test identities with complete claims, a missing required attribute, and the permitted alternative identity provider. Confirm the expected rejection and successful mapping without exposing full tokens in tickets. Review application-side account matching and authorization as well as successful completion of the Access login screen.

Official reference

Cloudflare — Generic OIDC SaaS. Reviewed October 15, 2026.