{"record":{"id":"a7cc8dd3370f80d2","repo":"cloudflare/cloudflared","slug":"access-teamname-cannot-be-blank-when-access-audtag","errorCode":null,"errorMessage":"access.TeamName cannot be blank when access.audTags are present","messagePattern":"access\\.TeamName cannot be blank when access\\.audTags are present","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":239,"sourceCode":"// code for all incoming requests.\nfunc GetDefaultIngressRules(log *zerolog.Logger) []Rule {\n\tnoRulesService := newDefaultStatusCode(log)\n\treturn []Rule{\n\t\t{\n\t\t\tService: &noRulesService,\n\t\t},\n\t}\n}\n\nfunc validateAccessConfiguration(cfg *config.AccessConfig) error {\n\tif !cfg.Required {\n\t\treturn nil\n\t}\n\n\t// we allow for an initial setup where user can force Access but not configure the rest of the keys.\n\t// however, if the user specified audTags but forgot teamName, we should alert it.\n\tif cfg.TeamName == \"\" && len(cfg.AudTag) > 0 {\n\t\treturn errors.New(\"access.TeamName cannot be blank when access.audTags are present\")\n\t}\n\n\treturn nil\n}\n\nfunc validateIngress(ingress []config.UnvalidatedIngressRule, defaults OriginRequestConfig) (Ingress, error) {\n\trules := make([]Rule, len(ingress))\n\tfor i, r := range ingress {\n\t\tcfg := setConfig(defaults, r.OriginRequest)\n\t\tvar service OriginService\n\n\t\tif prefix := \"unix:\"; strings.HasPrefix(r.Service, prefix) {\n\t\t\t// No validation necessary for unix socket filepath services\n\t\t\tpath := strings.TrimPrefix(r.Service, prefix)\n\t\t\tservice = &unixSocketPath{path: path, scheme: \"http\"}\n\t\t} else if prefix := \"unix+tls:\"; strings.HasPrefix(r.Service, prefix) {\n\t\t\tpath := strings.TrimPrefix(r.Service, prefix)\n\t\t\tservice = &unixSocketPath{path: path, scheme: \"https\"}","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L221-L257","documentation":"This validation error is raised when an ingress rule's access configuration specifies audTags but leaves access.teamName empty. Cloudflare Access policy matching requires both the team (account) name and audience tags, so a partial Access config is rejected.","triggerScenarios":"validateAccessConfiguration (called by validateIngress) sees cfg.AudTag non-empty while cfg.TeamName == \"\" in an ingress rule's access block.","commonSituations":"Users enabling Access on a rule by listing audTags but forgetting the required teamName key (their Cloudflare Zero Trust team name).","solutions":["Add the teamName field to the access block with your Cloudflare Zero Trust team name","If Access is not intended, remove the audTags entries","Run 'cloudflared tunnel ingress validate' after editing"],"exampleFix":"// before\naccess:\n  audTag:\n    - org.example\n// after\naccess:\n  teamName: my-team\n  audTag:\n    - org.example","handlingStrategy":"validation","validationCode":"func accessConfigValid(c config.AccessConfig) bool { return c.TeamName != \"\" || len(c.AudTag) == 0 }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set teamName alongside audTags in access blocks","Run ingress validate after every config edit","Copy the team name from the Zero Trust dashboard when configuring Access"],"tags":["config","ingress","access","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}