Barbican Cloud

Identity Demo Environment

Path-based routing

Single domain — Cloudflare Access policies applied per path. barbicancloud.co.uk/<method>/

Identity Provider

OIDC Pending

OpenID Connect

Entra ID — OAuth 2.0 / OIDC

›
SAML Pending

SAML 2.0

Entra ID — SAML federation

›

Access Control — SCIM Provisioning

SCIM Pending

Group A — Restricted

Entra group sync — limited scope

›
SCIM Pending

Group B — Elevated

Entra group sync — elevated scope

›

Direct Access

Open Live

No Authentication

Publicly accessible — no identity check

›
Local Pending

One-Time PIN

Cloudflare Access — OTP via email

›

Machine Authentication

mTLS Pending

Mutual TLS

Client certificate — transport layer auth

›
Token Pending

Service Token

Cloudflare Access — machine-to-machine

›

Subdomain routing

Separate Cloudflare Access Application per subdomain. <method>.barbicancloud.co.uk

Identity Provider

OIDC Pending

OpenID Connect

Entra ID — OAuth 2.0 / OIDC

›
SAML Pending

SAML 2.0

Entra ID — SAML federation

›

Access Control — SCIM Provisioning

SCIM Pending

Group A — Restricted

Entra group sync — limited scope

›
SCIM Pending

Group B — Elevated

Entra group sync — elevated scope

›

Direct Access

Open Pending

No Authentication

Publicly accessible — no identity check

›
Local Pending

One-Time PIN

Cloudflare Access — OTP via email

›

Machine Authentication

mTLS Pending

Mutual TLS

Client certificate — transport layer auth

›
Token Pending

Service Token

Cloudflare Access — machine-to-machine

›