← Barbican Cloud

The Workshop

Every protocol here is actually wired up — OIDC, SAML, SCIM, mTLS, and more, implemented and running.

Path-based routing

Single domain — Cloudflare Access policies applied per path. barbicancloud.co.uk/<method>/

Identity Provider

OIDC Pending

OpenID Connect

Entra ID — OAuth 2.0 / OIDC

›
SAML Pending

SAML 2.0

Entra ID — SAML federation

›
OIDC Pending

OpenID Connect

Okta — OAuth 2.0 / OIDC

›
SAML Pending

SAML 2.0

Okta — SAML federation

›

Cross-Tenant Federation

B2B Pending

Entra B2B

Entra external identities — guest access

›
Federation Pending

Okta → Entra

Okta as external IdP — Entra trust

›
B2B Pending

Consultancy Tenant

External Entra tenant — cross-organisation

›

Access Control — SCIM Provisioning

SCIM Pending

Group A — Restricted

Entra group sync — limited scope

›
SCIM Pending

Group B — Elevated

Entra group sync — elevated scope

›

Direct Access

Open Live

No Authentication

Publicly accessible — no identity check

›
Local Pending

One-Time PIN

Cloudflare Access — OTP via email

›

Machine Authentication

mTLS Pending

Mutual TLS

Client certificate — transport layer auth

›
Token Pending

Service Token

Cloudflare Access — machine-to-machine

›

Subdomain routing

Separate Cloudflare Access Application per subdomain. <method>.barbicancloud.co.uk

Identity Provider

OIDC Pending

OpenID Connect

Entra ID — OAuth 2.0 / OIDC

›
SAML Pending

SAML 2.0

Entra ID — SAML federation

›
OIDC Pending

OpenID Connect

Okta — OAuth 2.0 / OIDC

›
SAML Pending

SAML 2.0

Okta — SAML federation

›

Cross-Tenant Federation

B2B Pending

Entra B2B

Entra external identities — guest access

›
Federation Pending

Okta → Entra

Okta as external IdP — Entra trust

›
B2B Pending

Consultancy Tenant

External Entra tenant — cross-organisation

›

Access Control — SCIM Provisioning

SCIM Pending

Group A — Restricted

Entra group sync — limited scope

›
SCIM Pending

Group B — Elevated

Entra group sync — elevated scope

›

Direct Access

Open Pending

No Authentication

Publicly accessible — no identity check

›
Local Pending

One-Time PIN

Cloudflare Access — OTP via email

›

Machine Authentication

mTLS Pending

Mutual TLS

Client certificate — transport layer auth

›
Token Pending

Service Token

Cloudflare Access — machine-to-machine

›