Cloudflare Access is a cool project and gives better security controls than tailscale. I haven't used it but I read a bit about it and I've been involved in cre

Cloudflare Access is a cool project and gives better security controls than tailscale. I haven't used it but I read a bit about it and I've been involved in creating some similar features at bastion-zero. I haven't read anything that suggests that webapp internal authentication is handled by Cloudflare Access. Cloudflare Access as far as I can tell just uses your SSO to setup a tunnel to your webapp, but you still need to authenticate to the webapp separately. If you found something that says different please LMK. I might have missed it. If you look at how Cloudflare Access does SSH, you create a tunnel to the target host, the target host then runs a webserver that proxies between the SSH-server and your browser and you login to SSH via the browser. > Cloudflare's browser-based terminal does not access the device's certificate store to gather SSH keys. Instead, users can input a username and password for password-based authentication or paste their private key. The terminal is rendered entirely in the user's browser [0] So Cloudflare doesn't enforce policy on what Linux user a user can assume on the target host. It just merely establishes a tunnel. You can configure Cloudflare access to use short-lived certificates in which case: > Access matches based on the identity that precedes an email domain. Unix usernames must match the identity preceding the email domain. Which is nice but now requires you have configure all your linux boxes to have linux user accounts for all your SSO users. Then you are still mananging the privileges of the linux users in linux. It's doable with LDAP but I've rarely seen it done. This is different from how bastion-zero works. Bastion-zero allows you to set and enforce policy between SSO identities and Linux users, e.g. Alice@example.com can assume `dev-user` or `readonly`. We are a bit ahead of the curve here. The biggest advantage of bastion-zero is that to compromise security both your SSO and the bastion need to be compromised. I don't believe CloudFlare Access has that yet. [0]: Connect from a browser-rendered terminal https://developers.cloudflare.com/cloudflare-one/tutorials/ssh-browser https://developers.cloudflare.com/cloudflare-one/tutorials/s... [1]: Ensure Unix usernames match user SSO identities https://developers.cloudflare.com/cloudflare-one/identity/users/short-lived-certificates https://developers.cloudflare.com/cloudflare-one/identity/us...