アクセスアプリケーションの作成

Cloudflare Access allows you to securely publish internal tools and applications to the Internet by providing an authentication layer between the end user and your origin server. You can use signals from your existing identity providers (IdPs), device posture providers, and other rules to control who can access your application.

各アプリケーションには、アクセスするユーザーグループに応じて異なる制約を持つ複数のポリシーを設定できます。たとえば、企業ユーザーに特定のデバイスポスチャーチェックや相互TLS認証イベントを提示させるポリシーと、これらの属性を必要としない契約者用の別のポリシーを作成できます。

アプリケーションをアクセスに追加する

1. In Zero Trust ↗, go to Access > Applications.

2. Select Add an application.

3. Select Self-hosted.

4. Enter any name for the application.

5. In Session Duration, choose how often the user’s application token should expire.

   Cloudflare checks every HTTP request to your application for a valid application token. If the user’s application token (and global token) has expired, they will be prompted to reauthenticate with the IdP. For more information, refer to Session management.

6. In Application domain, enter the domains that will represent the application.

   • Domains must belong to an active zone in your Cloudflare account. You can either select a domain from the dropdown or enter a custom domain that you control.
   • You can use wildcards to protect multiple parts of an application that share a root path.

7. (Optional) Configure App Launcher settings for the application.

8. Under Block pages, choose what end users will see when they are denied access to the application:

   • Cloudflare default: Reload the login page and display a block message below the Cloudflare Access logo. The default message is That account does not have access, or you can enter a custom message.
   • Redirect URL: Redirect to the specified website.
   • Custom page template: Display a custom block page hosted in Zero Trust.

9. Next, configure how users will authenticate:

   1. Select the Identity providers you want to enable for your application.

   2. (Recommended) If you plan to only allow access via a single IdP, turn on Instant Auth. End users will not be shown the Cloudflare Access login page. Instead, Cloudflare will redirect users directly to your SSO login event.

   3. (Optional) Under WARP authentication identity, allow users to authenticate to the application using their WARP session identity.

10. Select Next.

アクセスポリシーを追加する

You can now configure an Access policy to control who can connect to your application.

1. Enter any name for your rule.

2. Specify a policy action.

3. Assign Access groups to reuse existing rules, or create new rules. You can add as many include, exception, or require statements as needed.

4. (Optional) Customize the login experience for users who match this policy:

   • Purpose justification
   • Temporary authentication

5. Select Next.

（オプション）高度な設定を構成する

You can configure the following advanced settings for your application:

• Cross-Origin Resource Sharing (CORS)
• Cookie settings
• Automatic cloudflared authentication
• Browser rendering

To finish configuring the application, select Add application.

ユーザーがアプリケーションにアクセスすると、アイデンティティプロバイダーでログインするように促されます。