From ae522b4ab024b35418ecf64a11e9838094f717ea Mon Sep 17 00:00:00 2001 From: Kenneth Johnson Date: Thu, 10 Sep 2026 11:53:22 -0500 Subject: [PATCH 1/3] docs: document SAML ForceAuthn --- .../access/2026-09-10-saml-force-authentication.mdx | 13 +++++++++++++ .../identity-providers/generic-saml.mdx | 8 ++++++++ 2 files changed, 21 insertions(+) create mode 100644 src/content/changelog/access/2026-09-10-saml-force-authentication.mdx diff --git a/src/content/changelog/access/2026-09-10-saml-force-authentication.mdx b/src/content/changelog/access/2026-09-10-saml-force-authentication.mdx new file mode 100644 index 00000000000..66536f1619e --- /dev/null +++ b/src/content/changelog/access/2026-09-10-saml-force-authentication.mdx @@ -0,0 +1,13 @@ +--- +title: Require fresh authentication for SAML identity providers +description: Configure Cloudflare Access to request fresh identity provider authentication for each SAML login. +date: 2026-09-10 +products: + - access +--- + +Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Set `force_authn` to `true` in the identity provider configuration through the API, and Access will set `ForceAuthn` to `true` in signed and unsigned SAML authentication requests. + +This option is useful when an application requires users to reauthenticate at the identity provider instead of relying on an existing identity provider session. The default value is `false`. + +For configuration details, refer to [Require fresh authentication at the identity provider](/cloudflare-one/integrations/identity-providers/generic-saml/#require-fresh-authentication-at-the-identity-provider). diff --git a/src/content/docs/cloudflare-one/integrations/identity-providers/generic-saml.mdx b/src/content/docs/cloudflare-one/integrations/identity-providers/generic-saml.mdx index 1edfb096351..84a20ba3c13 100644 --- a/src/content/docs/cloudflare-one/integrations/identity-providers/generic-saml.mdx +++ b/src/content/docs/cloudflare-one/integrations/identity-providers/generic-saml.mdx @@ -187,6 +187,14 @@ If you rotate again before updating your IdP with the current certificate, the p This optional configuration signs the [Access JWT](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/) with the Cloudflare Access public key to ensure that the JWT is coming from a legitimate source. The Cloudflare public key can be obtained at `https://.cloudflareaccess.com/cdn-cgi/access/certs`. +### Require fresh authentication at the identity provider + +You can ask your identity provider to reauthenticate the user for every SAML authentication request. This option applies whether the request is signed or unsigned. + +This setting is available through the API. First, retrieve the identity provider's current configuration from the [Access identity provider endpoint](/api/resources/zero_trust/subresources/identity_providers/methods/get/). Then, send the complete configuration to the [update identity provider endpoint](/api/resources/zero_trust/subresources/identity_providers/methods/update/) with `force_authn` set to `true` in the `config` object. The default value is `false`. + +When this option is turned on, Access sets `ForceAuthn` to `true` in each SAML authentication request. Access may also set `ForceAuthn` to `true` when a security check requires the user to reauthenticate, even if `force_authn` is `false`. + ### Email attribute name Many [Access policies](/cloudflare-one/access-controls/policies/) depend on a user's email address. Some identity providers have a different naming for the email address attribute (for example, `Email`, `e-mail`, `emailAddress`). This can typically be checked in the identity provider's SAML test option. From 1ad69ee3738f43c7be3d3d8f2bcb18fdc78c10e4 Mon Sep 17 00:00:00 2001 From: Kenneth Johnson Date: Mon, 14 Sep 2026 10:33:10 -0500 Subject: [PATCH 2/3] [Access] Update SAML ForceAuthn changelog date --- ...hentication.mdx => 2026-09-14-saml-force-authentication.mdx} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename src/content/changelog/access/{2026-09-10-saml-force-authentication.mdx => 2026-09-14-saml-force-authentication.mdx} (98%) diff --git a/src/content/changelog/access/2026-09-10-saml-force-authentication.mdx b/src/content/changelog/access/2026-09-14-saml-force-authentication.mdx similarity index 98% rename from src/content/changelog/access/2026-09-10-saml-force-authentication.mdx rename to src/content/changelog/access/2026-09-14-saml-force-authentication.mdx index 66536f1619e..bfb8a4341c0 100644 --- a/src/content/changelog/access/2026-09-10-saml-force-authentication.mdx +++ b/src/content/changelog/access/2026-09-14-saml-force-authentication.mdx @@ -1,7 +1,7 @@ --- title: Require fresh authentication for SAML identity providers description: Configure Cloudflare Access to request fresh identity provider authentication for each SAML login. -date: 2026-09-10 +date: 2026-09-14 products: - access --- From f21f9bbaa0a04aa5b6173c9ea2ee96284a38c7ff Mon Sep 17 00:00:00 2001 From: Kenneth Johnson Date: Mon, 14 Sep 2026 10:37:21 -0500 Subject: [PATCH 3/3] [Access] Document dashboard ForceAuthn control --- .../changelog/access/2026-09-14-saml-force-authentication.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/changelog/access/2026-09-14-saml-force-authentication.mdx b/src/content/changelog/access/2026-09-14-saml-force-authentication.mdx index bfb8a4341c0..93951714ff7 100644 --- a/src/content/changelog/access/2026-09-14-saml-force-authentication.mdx +++ b/src/content/changelog/access/2026-09-14-saml-force-authentication.mdx @@ -6,7 +6,7 @@ products: - access --- -Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Set `force_authn` to `true` in the identity provider configuration through the API, and Access will set `ForceAuthn` to `true` in signed and unsigned SAML authentication requests. +Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on **Require reauthentication** in the Cloudflare dashboard, or set `force_authn` to `true` through the API. Access will then set `ForceAuthn` to `true` in signed and unsigned SAML authentication requests. This option is useful when an application requires users to reauthenticate at the identity provider instead of relying on an existing identity provider session. The default value is `false`.