From bdfd68c70effc57466a5ff34dea388b40d4bc3d1 Mon Sep 17 00:00:00 2001 From: Stephanie Aurelio <133041642+stephaurelio@users.noreply.github.com> Date: Tue, 14 May 2024 12:12:11 -0700 Subject: [PATCH] Update JIT release phase callouts (#20030) * update callouts * link to release phase doc * vale: add SCIM, Admin Console to vocabulary Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --------- Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- .github/vale/config/vocabularies/Docker/accept.txt | 2 ++ content/security/faqs/single-sign-on/idp-faqs.md | 2 +- content/security/faqs/single-sign-on/users-faqs.md | 4 ++-- content/security/for-admins/group-mapping.md | 2 +- content/security/for-admins/scim.md | 2 +- .../for-admins/single-sign-on/configure/configure-idp.md | 2 +- content/security/for-admins/single-sign-on/connect/_index.md | 2 +- layouts/shortcodes/admin-sso-management-users.md | 2 +- 8 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/vale/config/vocabularies/Docker/accept.txt b/.github/vale/config/vocabularies/Docker/accept.txt index 07ec27e1df..1129461f1f 100644 --- a/.github/vale/config/vocabularies/Docker/accept.txt +++ b/.github/vale/config/vocabularies/Docker/accept.txt @@ -2,6 +2,7 @@ A?GPLv3 APIs? ARM AWS +Admin Console Amazon Ambassador Anchore @@ -89,6 +90,7 @@ RPM S3 SARIF SBOMs? +SCIM SDKs? SLES SLSA diff --git a/content/security/faqs/single-sign-on/idp-faqs.md b/content/security/faqs/single-sign-on/idp-faqs.md index fb58305d65..b7210693d0 100644 --- a/content/security/faqs/single-sign-on/idp-faqs.md +++ b/content/security/faqs/single-sign-on/idp-faqs.md @@ -48,7 +48,7 @@ Yes, bot accounts need a seat, similar to a regular end user, having a non-alias > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning configuration is only available in Private Beta when you use the Admin Console. Otherwise, JIT is enabled by default. This feature will be available for all users soon. +> Optional Just-in-Time (JIT) provisioning configuration is available in [beta](/release-lifecycle/#beta) when you use the Admin Console and enable SCIM. Otherwise, JIT is enabled by default. { .experimental } The SSO implementation uses Just-in-Time (JIT) provisioning by default. You can optionally disable JIT if you prefer not to auto-provision users, or if you opt for auto-provisioning using SCIM. diff --git a/content/security/faqs/single-sign-on/users-faqs.md b/content/security/faqs/single-sign-on/users-faqs.md index a8fe3c294b..49264db830 100644 --- a/content/security/faqs/single-sign-on/users-faqs.md +++ b/content/security/faqs/single-sign-on/users-faqs.md @@ -61,7 +61,7 @@ When SSO is enabled and enforced, your users just have to sign in using the emai > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning configuration is only available in Private Beta when you use the Admin Console. Otherwise, JIT is enabled by default. This feature will be available for all users soon. +> Optional Just-in-Time (JIT) provisioning configuration is available in [beta](/release-lifecycle/#beta) when you use the Admin Console. Otherwise, JIT is enabled by default. { .experimental } Docker SSO provides Just-in-Time (JIT) provisioning by default, with an option to disable JIT. Users are provisioned when a user authenticates with SSO. If a user leaves the organization, administrators must sign in to Docker Hub and manually [remove the user](../../../admin/organization/members.md#remove-a-member-or-invitee) from the organization. @@ -74,7 +74,7 @@ Additionally, you can use the [Docker Hub API](/docker-hub/api/latest/) to compl > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning configuration is only available in Private Beta when you use the Admin Console. Otherwise, JIT is enabled by default. This feature will be available for all users soon. +> Optional Just-in-Time (JIT) provisioning configuration is available in [beta](/release-lifecycle/#beta) when you use the Admin Console and enable SCIM. Otherwise, JIT is enabled by default. { .experimental } If a user attempts to sign in to Docker using an email address that is a verified domain for your SSO connection, they need to be a member of the organization to access it, or have a pending invitation to the organization. Users who don't meet these criteria will encounter an `Access denied` error, and will need an administrator to invite them to the organization. diff --git a/content/security/for-admins/group-mapping.md b/content/security/for-admins/group-mapping.md index 7f269c4c8b..86ad92d578 100644 --- a/content/security/for-admins/group-mapping.md +++ b/content/security/for-admins/group-mapping.md @@ -45,7 +45,7 @@ After every successful SSO sign-in authentication, the JIT provisioner performs > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning is available in Private Beta when you use the Admin Console. If you're participating in this program, you have the option to turn off this default provisioning and disable JIT. This configuration is recommended if you're using SCIM to auto-provision users. +> Optional Just-in-Time (JIT) provisioning is available in [beta](/release-lifecycle/#beta) when you use the Admin Console and enable SCIM. With this feature, you have the option to disable JIT provisioning. { .experimental } When you opt to disable JIT provisioning in your SSO connection, the following actions occur: diff --git a/content/security/for-admins/scim.md b/content/security/for-admins/scim.md index 6338d7fb39..5dd24e8358 100644 --- a/content/security/for-admins/scim.md +++ b/content/security/for-admins/scim.md @@ -44,7 +44,7 @@ For additional details about supported attributes and SCIM, see [Docker Hub API > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning is available in Private Beta when you use the Admin Console. If you're participating in this program, you can avoid conflicts between SCIM and JIT by disabling JIT provisioning in your SSO connection. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). +> Optional Just-in-Time (JIT) provisioning is available in [beta](/release-lifecycle/#beta) when you use the Admin Console and enable SCIM. With this feature, you can avoid conflicts between SCIM and JIT by disabling JIT provisioning in your SSO connection. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). { .experimental } ## Enable SCIM in Docker diff --git a/content/security/for-admins/single-sign-on/configure/configure-idp.md b/content/security/for-admins/single-sign-on/configure/configure-idp.md index e5dff97324..9fde8ecd5d 100644 --- a/content/security/for-admins/single-sign-on/configure/configure-idp.md +++ b/content/security/for-admins/single-sign-on/configure/configure-idp.md @@ -43,7 +43,7 @@ If you use SAML for your SSO connection, Docker obtains these attributes from th > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning is available in Private Beta when you use the Admin Console. If you're participating in this program, you can avoid conflicts between SCIM and JIT by disabling JIT provisioning in your SSO connection. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). +> Optional Just-in-Time (JIT) provisioning is available in [beta](/release-lifecycle/#beta) when you use the Admin Console and enable SCIM. With this feature, you can avoid conflicts between SCIM and JIT by disabling JIT provisioning in your SSO connection. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). { .experimental } You can also configure attributes to override default values, such as default team or organization. See [role mapping](../../scim.md#set-up-role-mapping). diff --git a/content/security/for-admins/single-sign-on/connect/_index.md b/content/security/for-admins/single-sign-on/connect/_index.md index 8f0b66d06d..f2b01e71c3 100644 --- a/content/security/for-admins/single-sign-on/connect/_index.md +++ b/content/security/for-admins/single-sign-on/connect/_index.md @@ -28,7 +28,7 @@ Make sure you have completed the following before you begin: > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning is available in Private Beta when you use the Admin Console. If you're participating in this program, you have the option to turn off this default provisioning and disable JIT. This configuration is recommended if you're using SCIM to auto-provision users. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). +> Optional Just-in-Time (JIT) provisioning is available in [beta](/release-lifecycle/#beta) when you use the Admin Console and enable SCIM. With this feature, you have the option to disable JIT provisioning. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). { .experimental } {{< tabs >}} diff --git a/layouts/shortcodes/admin-sso-management-users.md b/layouts/shortcodes/admin-sso-management-users.md index ae8fd1bc54..8b0d230756 100644 --- a/layouts/shortcodes/admin-sso-management-users.md +++ b/layouts/shortcodes/admin-sso-management-users.md @@ -57,7 +57,7 @@ To remove a user: > **Beta feature** > -> Optional Just-in-Time (JIT) provisioning is available in Private Beta when you use the Admin Console. If you're participating in this program, you have the option to turn off this default provisioning and disable JIT. This configuration is recommended if you're using SCIM to auto-provision users. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). +> Optional Just-in-Time (JIT) provisioning is available in [beta](/release-lifecycle/#beta) when you use the Admin Console and SCIM is enabled. With this feature, you have the option to disable JIT provisioning. See [SSO authentication with JIT provisioning disabled](/security/for-admins/group-mapping/#sso-authentication-with-jit-provisioning-disabled). { .experimental } {{ $provisioning_steps }}