Cloudflare

When you connect a Cloudflare account to Oblique, Oblique will automatically sync the account’s members, along with the user groups and resource groups that describe their access.

As you add members in Cloudflare, change their policies, or remove their access, these changes are automatically synced to Oblique. If connected in read-write mode, Oblique can also change user group membership and policies in Cloudflare.

You can add multiple Cloudflare accounts to Oblique. These function as separate integrations and are distinguished by their account name.

Supported options

Oblique syncs the following from your Cloudflare account. In read-write mode, Oblique can also change user group membership and policies in Cloudflare.

Cloudflare object	Oblique object	Capability
Members	Accounts	Read-only
Resource groups	Resources	Read-only
User groups	Resources	Read-only
Permission groups	Roles	Read-only
Policies	Entitlements	Read-write
User group membership	Entitlements	Read-write

Accounts

Oblique syncs each Cloudflare member as an Oblique account. Members with pending invitations, whose status isn’t accepted, aren’t synced.

Cloudflare accounts are matched to Oblique users by email.

Account matching

Resources

Oblique syncs the following from Cloudflare as resources:

• Resource groups
• User groups

In Cloudflare, a policy is used to grant a member or the members of a user group access to a resource group. Oblique reads these policies as entitlements, and reflects both direct access for members and indirect access through user groups as entitlements in Oblique.

Roles

Oblique syncs Cloudflare roles, also called permission groups, as Oblique roles.

An entitlement for a resource group can be for one or more roles. There is no role for membership in a user group.

Required permissions

The Cloudflare integration requests the following scopes for your Cloudflare account:

Cloudflare scope	What Oblique uses it for
account-settings.read	Read the account, its user groups, resource groups, and permission groups
memberships.read	Read the account’s members and the policies attached to them
account-settings.write	Change a user group’s policies and its members (for a read-write integration)
memberships.write	Change the policies attached to a member (for a read-write integration)
offline_access	Maintain the connection without an administrator signing in again

Add Cloudflare integration

You must be an admin to add an integration.

You connect a Cloudflare account to Oblique by signing in to Cloudflare as a Super Administrator and approving the access Oblique asks for.

To add a Cloudflare integration, navigate to the Integrations page:

1. Select Add integration.
2. Select Cloudflare.
3. Under Connect, select Read-write to let Oblique manage access in Cloudflare, or Read-only to only let Oblique read it. By default, this is read-write.
4. Select Connect Cloudflare.
5. Sign in to Cloudflare as a Super Administrator and approve the access Oblique asks for.

Oblique will immediately start syncing the account’s members and groups.

Change Cloudflare integration’s authorizations

You must be an admin to change an integration's authorizations.

To reconnect the Cloudflare integration, including to change the member it is tied to, from the integration’s detail page:

1. Navigate to the Settings tab.
2. Under Connection, select Reconnect.
3. Sign in as a different Cloudflare member and approve the access Oblique asks for.

You can only reconnect the current account. To change the account, instead delete the integration and add another one.

To give a read-only integration write access, from the Settings tab, under Permissions, select Upgrade to read-write and approve the additional access Oblique asks for.

Manage entitlements

In read-write mode, the Cloudflare integration lets Oblique manage access in your Cloudflare account. This is done by updating user group membership and policies in Cloudflare.

Grant access

Caution

When Oblique modifies entitlements, it may overwrite existing Cloudflare policies. As a result, Cloudflare may report a policy change even when access is the same.

Remove Cloudflare integration

You must be an admin to remove an integration.

To remove a Cloudflare integration, from the integration’s detail page:

1. Navigate to the Settings tab.
2. At the bottom of the page, under Delete integration, select Delete integration….
3. In the confirmation dialog, type the text to confirm, then select Delete integration.

This will immediately stop all syncing and remove all resources from the integration. Access that Oblique granted in Cloudflare stays as it is.

Caution

Removing the integration doesn’t revoke Oblique’s access to Cloudflare. To revoke it, remove Oblique’s authorization from your Cloudflare account.