3.4 KiB
{{ $product_link := "Docker Hub" }} {{ $sso_navigation := `Navigate to the SSO settings page for your organization or company.
- Organization: Select Organizations, your organization, Settings, and then Security.
- Company: Select Organizations, your company, and then Settings.` }}
{{ if eq (.Get "product") "admin" }} {{ $product_link = "the Admin Console" }} {{ $sso_navigation = "Select your organization or company in the left navigation drop-down menu, and then select SSO and SCIM." }} {{ end }}
- In {{ $product_link }}, select the verified domains you want to apply the connection to.
- To provision your users, select the organization(s) and/or team(s).
- Review your summary and select Create Connection.
Test your SSO configuration
After you’ve completed the SSO configuration process in Docker, you can test the configuration when you sign in to {{ $product_link }} using an incognito browser. Sign in to {{ $product_link }} using your domain email address. You are then redirected to your IdP's login page to authenticate.
- Authenticate through email instead of using your Docker ID, and test the login process.
- To authenticate through CLI, your users must have a PAT before you enforce SSO for CLI users.
[!IMPORTANT]
SSO has Just-in-Time (JIT) provisioning enabled by default, unless you have disabled it. This means your users are auto-provisioned to your organization.
You can change this on a per-app basis. To prevent auto-provisioning users, you can create a security group in your IdP and configure the SSO app to authenticate and authorize only those users that are in the security group. Follow the instructions provided by your IdP:
Alternatively, see Manage how users are provisioned.
The SSO connection is now created. You can continue to set up SCIM without enforcing SSO log-in. For more information about setting up SCIM, see Set up SCIM.
Optional: Enforce SSO
-
Sign in to {{ $product_link }}.
-
{{ $sso_navigation }}
[!NOTE]
When an organization is part of a company, you must select the company and configure SSO enforcement for that organization at the company level. Each organization in a company can have its own configuration, but it must be configured at the company level.
-
In the SSO connections table, select the Action icon and then Enable enforcement.
When SSO is enforced, your users are unable to modify their email address and password, convert a user account to an organization, or set up 2FA through Docker Hub. You must enable 2FA through your IdP.
-
Continue with the on-screen instructions and verify that you’ve completed the tasks.
-
Select Turn on enforcement to complete.
Your users must now sign in to Docker with SSO.
[!IMPORTANT]
If SSO isn't enforced, users can choose to sign in with either their Docker ID or SSO.