Add check user identity policy

cloudflare · Dec 20, 2024 · 0cc6b8a · 0cc6b8a
1 parent df03757
commit 0cc6b8a
Show file tree

Hide file tree

Showing 5 changed files with 54 additions and 15 deletions.
diff --git a/src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx b/src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx
@@ -382,7 +382,39 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
 
 </TabItem> </Tabs>
 
-<Render file="gateway/policies/policies-optional" />
+## Check user identity
+
+<Render file="gateway/policies/check-user-identity" />
+
+<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
+
+| Selector         | Operator | Value         | Logic | Action |
+| ---------------- | -------- | ------------- | ----- | ------ |
+| Application      | in       | _Salesforce_  | And   | Block  |
+| User Group Names | in       | _Contractors_ |       |        |
+
+</TabItem>
+
+<TabItem label="API">
+
+```sh
+curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
+--header "Content-Type: application/json" \
+--header "Authorization: Bearer <API_TOKEN>" \
+--data '{
+  "name": "Check user identity",
+  "description": "Filter traffic based on a user identity group name",
+  "enabled": true,
+  "action": "block",
+  "filters": [
+    "dns"
+  ],
+  "traffic": "any(app.ids[*] in {606})",
+  "identity": "any(identity.groups.name[*] in {\"Contractors\"})",
+}'
+```
+
+</TabItem> </Tabs>
 
 ## Restrict access to specific groups
 

diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx
@@ -44,7 +44,14 @@ Block a section of a site without blocking the entire site. For example, you can
 | ----------- | -------- | ------------------------- | ------ |
 | Application | in       | _Artificial Intelligence_ | Block  |
 
-<Render file="gateway/policies/policies-optional" />
+## Check user identity
+
+<Render file="gateway/policies/check-user-identity" />
+
+| Selector         | Operator | Value         | Logic | Action |
+| ---------------- | -------- | ------------- | ----- | ------ |
+| Application      | in       | _Salesforce_  | And   | Block  |
+| User Group Names | in       | _Contractors_ |       |        |
 
 ## Skip inspection for groups of applications
 

diff --git a/...ntent/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx b/...ntent/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx
@@ -22,7 +22,14 @@ Refer to the [network policies page](/cloudflare-one/policies/gateway/network-po
 | ----------- | -------- | ------------------------- | ------ |
 | Application | in       | _Artificial Intelligence_ | Block  |
 
-<Render file="gateway/policies/policies-optional" />
+## Check user identity
+
+<Render file="gateway/policies/check-user-identity" />
+
+| Selector         | Operator | Value         | Logic | Action |
+| ---------------- | -------- | ------------- | ----- | ------ |
+| Application      | in       | _Salesforce_  | And   | Block  |
+| User Group Names | in       | _Contractors_ |       |        |
 
 ## Enforce device posture
 

diff --git a/src/content/partials/cloudflare-one/gateway/policies/check-user-identity.mdx b/src/content/partials/cloudflare-one/gateway/policies/check-user-identity.mdx
@@ -0,0 +1,5 @@
+---
+{}
+---
+
+Configure access on a per user or group basis by adding [identity-based conditions](/cloudflare-one/policies/gateway/identity-selectors/) to your policies.
diff --git a/src/content/partials/cloudflare-one/gateway/policies/policies-optional.mdx b/src/content/partials/cloudflare-one/gateway/policies/policies-optional.mdx