Repository: goauthentik/authentik
Pull request: website/integrations: add cloudflare access
<!--
👋 Hi there! Welcome.

Please check the Contributing guidelines: https://goauthentik.io/developer-docs/#how-can-i-contribute
-->

## Details

<!--
Explain what this PR changes, what the rationale behind the change is, if any new requirements are introduced or any breaking changes caused by this PR.

Ideally also link an Issue for context that this PR will close using `closes #`
-->
closes #9710 

documents how to protect selfhosted applications with cloudflare access and authentik

---

## Checklist

-   [ ] Local tests pass (`ak test authentik/`)
-   [ ] The code has been formatted (`make lint-fix`)

If an API change has been made

-   [ ] The API schema has been updated (`make gen-build`)

If changes to the frontend have been made

-   [ ] The code has been formatted (`make web`)

If applicable

-   [ ] The documentation has been updated
-   [ ] The documentation has been formatted (`make website`)


Problem statement:
Cloudflare Access Guide
**Is your feature request related to a problem? Please describe.**
A part of my selfhosted applications are running on Cloudflare Tunnels which allow easy protection with Access. Unfortunately, Authentik does not provide a guide on how to setup an "application" for CF Access.

**Describe the solution you'd like**
Documentation created. I set it up myself and I wouldn't mind opening a pull request with my implementation. I'll probably create one in a few hours. 

**Describe alternatives you've considered**
Proxying all applications with a reverse proxy. It's just not possible 100% of the time in certain use cases

**Additional context**
Add any other context or screenshots about the feature request here.

Hints from issue discussion:

Commit message: Merge branch 'goauthentik:main' into docs/cf-access-service-setup

Patch to review:
diff --git a/website/integrations/services/cloudflare-access/index.mdx b/website/integrations/services/cloudflare-access/index.mdx
new file mode 100644
index 000000000000..8bc56a4ec4b0
--- /dev/null
+++ b/website/integrations/services/cloudflare-access/index.mdx
@@ -0,0 +1,64 @@
+---
+title: Cloudflare Access
+---
+
+<span class="badge badge--secondary">Support level: Community</span>
+
+## What is Cloudflare Access
+
+> Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources.
+>
+> -- https://www.cloudflare.com/zero-trust/products/access/
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `mysubdomain.cloudflareaccess.company` is the FQDN of your Cloudflare Access subdomain.
+-   `authentik.company` is the FQDN of the authentik install.
+
+You must have a free account on Cloudflare and a publicly available Authentik instance with a trusted SSL certificate.
+
+## Authentik Configuration Guide
+
+### Step 1: Log In to Authentik
+
+1. Log in to your Authentik instance.
+2. Click the "Admin interface".
+
+### Step 2: Create a New Authentication Provider
+
+3. Under "Applications", click "Providers" and create a new provider.
+4. Choose "OAuth2/OpenID Provider" and click "Next".
+5. Set the authorization flow to "Authorize Application" (`default-provider-authorization-explicit-consent`).
+6. Set the client type to "Confidential".
+7. Set the redirect URI to `https://mysubdomain.cloudflareaccess.company/cdn-cgi/access/callback`.
+8. Ensure the signing key is set to "Authentik Self-signed Certificate".
+9. Click "Finish" to create the provider.
+
+### Step 3: Create a New Application
+
+10. Create a new application and give it a name.
+11. Set the provider to the one you just created.
+12. Ensure the "Policy engine mode" is set to "ANY, any policy must match to grant access".
+13. Click "Create" and navigate to your [Cloudflare Access dashboard](https://one.dash.cloudflare.com).
+
+## Cloudflare Access Configuration
+
+### Step 4: Configure Cloudflare Access
+
+1. Go to the Cloudflare One dashboard.
+2. Click "Settings" at the bottom of the menu, then select "Authentication".
+
+### Step 5: Add a Login Method
+
+3. From "Login methods" click "Add" and select "OpenID Connect".
+4. Enter a name for your login method. This can be anything.
+5. Copy the following details from the Authentik Provider settings you previously created and paste them into the text boxes:
+    - **Client ID** -> App ID
+    - **Client Secret** -> Client Secret
+    - **Authorize URL** -> Auth URL
+    - **Token URL** -> Token URL
+    - **JWKS URL** -> Certificate URL
+6. Click "Save".
+7. Click "Test" to verify your login provider.
diff --git a/website/sidebarsIntegrations.js b/website/sidebarsIntegrations.js
index a69033910299..ae993c98695b 100644
--- a/website/sidebarsIntegrations.js
+++ b/website/sidebarsIntegrations.js
@@ -80,6 +80,7 @@ module.exports = {
                         "services/apache-guacamole/index",
                         "services/argocd/index",
                         "services/awx-tower/index",
+                        "services/cloudflare-access/index",
                         "services/globalprotect/index",
                         "services/harbor/index",
                         "services/hashicorp-vault/index",


Code review comments:
diff_hunk: @@ -0,0 +1,64 @@
+---
+title: Cloudflare Access
+---
+
+<span class="badge badge--secondary">Support level: Community</span>
+
+## What is Cloudflare Access
+
+> Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources.
+>
+> -- https://www.cloudflare.com/zero-trust/products/access/
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `mysubdomain.cloudflareaccess.company` is the FQDN of your Cloudflare Access subdomain.
+-   `authentik.company` is the FQDN of the authentik install.
+
+You must have a free account on Cloudflare and a publicly available Authentik instance with a trusted SSL certificate.
+
+## Authentik Configuration Guide
+
+### Step 1: Log In to Authentik
+
+1. Log in to your Authentik instance.
+2. Click the "Admin interface".
+
+### Step 2: Create a New Authentication Provider
+
+3. Under "Applications", click "Providers" and create a new provider.
+4. Choose "OAuth2/OpenID Provider" and click "Next".
+5. Set the authorization flow to "Authorize Application" (`default-provider-authorization-explicit-consent`).
+6. Set the client type to "Confidential".
+7. Set the redirect URI to `https://mysubdomain.cloudflareaccess.company/cdn-cgi/access/callback`.
+8. Ensure the signing key is set to "Authentik Self-signed Certificate".
+9. Click "Finish" to create the provider.
+
+### Step 3: Create a New Application
+
+10. Create a new application and give it a name.
+11. Set the provider to the one you just created.
+12. Ensure the "Policy engine mode" is set to "ANY, any policy must match to grant access".
path: website/integrations/services/cloudflare-access/index.mdx
text: @user1:
```suggestion
12. Ensure that the **Policy engine mode** is set to **ANY, any policy must match to grant access**.
```

diff_hunk: @@ -0,0 +1,64 @@
+---
+title: Cloudflare Access
+---
+
+<span class="badge badge--secondary">Support level: Community</span>
+
+## What is Cloudflare Access
+
+> Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources.
+>
+> -- https://www.cloudflare.com/zero-trust/products/access/
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `mysubdomain.cloudflareaccess.company` is the FQDN of your Cloudflare Access subdomain.
+-   `authentik.company` is the FQDN of the authentik install.
+
+You must have a free account on Cloudflare and a publicly available Authentik instance with a trusted SSL certificate.
+
+## Authentik Configuration Guide
+
+### Step 1: Log In to Authentik
+
+1. Log in to your Authentik instance.
+2. Click the "Admin interface".
+
+### Step 2: Create a New Authentication Provider
+
+3. Under "Applications", click "Providers" and create a new provider.
+4. Choose "OAuth2/OpenID Provider" and click "Next".
+5. Set the authorization flow to "Authorize Application" (`default-provider-authorization-explicit-consent`).
+6. Set the client type to "Confidential".
+7. Set the redirect URI to `https://mysubdomain.cloudflareaccess.company/cdn-cgi/access/callback`.
+8. Ensure the signing key is set to "Authentik Self-signed Certificate".
+9. Click "Finish" to create the provider.
+
+### Step 3: Create a New Application
+
+10. Create a new application and give it a name.
+11. Set the provider to the one you just created.
+12. Ensure the "Policy engine mode" is set to "ANY, any policy must match to grant access".
+13. Click "Create" and navigate to your [Cloudflare Access dashboard](https://one.dash.cloudflare.com).
+
+## Cloudflare Access Configuration
+
+### Step 4: Configure Cloudflare Access
+
+1. Go to the Cloudflare One dashboard.
+2. Click "Settings" at the bottom of the menu, then select "Authentication".
+
+### Step 5: Add a Login Method
+
+3. From "Login methods" click "Add" and select "OpenID Connect".
path: website/integrations/services/cloudflare-access/index.mdx
text: @user1:
```suggestion
3. From **Login methods** click **Add** and select **OpenID Connect"**
```

diff_hunk: @@ -0,0 +1,64 @@
+---
+title: Cloudflare Access
+---
+
+<span class="badge badge--secondary">Support level: Community</span>
+
+## What is Cloudflare Access
+
+> Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources.
+>
+> -- https://www.cloudflare.com/zero-trust/products/access/
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `mysubdomain.cloudflareaccess.company` is the FQDN of your Cloudflare Access subdomain.
+-   `authentik.company` is the FQDN of the authentik install.
+
+You must have a free account on Cloudflare and a publicly available Authentik instance with a trusted SSL certificate.
+
+## Authentik Configuration Guide
+
+### Step 1: Log In to Authentik
+
+1. Log in to your Authentik instance.
+2. Click the "Admin interface".
+
+### Step 2: Create a New Authentication Provider
+
+3. Under "Applications", click "Providers" and create a new provider.
+4. Choose "OAuth2/OpenID Provider" and click "Next".
+5. Set the authorization flow to "Authorize Application" (`default-provider-authorization-explicit-consent`).
+6. Set the client type to "Confidential".
+7. Set the redirect URI to `https://mysubdomain.cloudflareaccess.company/cdn-cgi/access/callback`.
+8. Ensure the signing key is set to "Authentik Self-signed Certificate".
+9. Click "Finish" to create the provider.
+
+### Step 3: Create a New Application
+
+10. Create a new application and give it a name.
+11. Set the provider to the one you just created.
+12. Ensure the "Policy engine mode" is set to "ANY, any policy must match to grant access".
+13. Click "Create" and navigate to your [Cloudflare Access dashboard](https://one.dash.cloudflare.com).
+
+## Cloudflare Access Configuration
+
+### Step 4: Configure Cloudflare Access
+
+1. Go to the Cloudflare One dashboard.
+2. Click "Settings" at the bottom of the menu, then select "Authentication".
+
+### Step 5: Add a Login Method
path: website/integrations/services/cloudflare-access/index.mdx
text: @user1:
```suggestion
### Step 5: Add a login method
```