6.4 KiB
{{ $product_link := "Docker Hub" }} {{ $sso_navigation := `Navigate to the SSO settings page for your organization or company.
- Organization: Select Organizations, your organization, Settings, and then Security.
- Company: Select Organizations, your company, and then Settings.
}} {{ $domain_navigation :=Navigate to the domain settings page for your organization or company. - Organization: Select Organizations, your organization, Settings, and then Security.
- Company: Select Organizations, your company, and then Settings.` }} {{ $member_navigation := "Select **Organizations, your organization, and then Members." }} {{ $invite_button := "Invite members" }} {{ $remove_button := "Remove member" }} {{ $scim_link := "Set up SCIM" }} {{ $mapping_link := "Enable Group mapping" }} {{ $sso_mgmt_link := "Manage your SSO connections" }}
{{ if eq (.Get "product") "admin" }} {{ $product_link = "Docker Admin" }} {{ $invite_button = "Invite" }} {{ $remove_button = "Remove member" }} {{ $sso_navigation = "Select your organization in the left navigation drop-down menu, and then select SSO & SCIM." }} {{ $member_navigation = "Select your organization in the left navigation drop-down menu, and then select Members." }} {{ $domain_navigation = "Select your organization in the left navigation drop-down menu, and then select Domain management." }} {{ $remove_button = "Remove member" }} {{ $scim_link = "Set up SCIM" }} {{ $mapping_link = "Enable Group mapping" }} {{ $sso_mgmt_link = "Manage your SSO connections" }} {{ if eq (.Get "layer") "company" }} {{ $sso_navigation = "Select your company in the left navigation drop-down menu, and then select SSO & SCIM." }} {{ $domain_navigation = "Select your company in the left navigation drop-down menu, and then select Domain management." }} {{ $member_navigation = "Select your organization in the left navigation drop-down menu, and then select Users." }} {{ $remove_button = "Remove user" }} {{ $scim_link = "Set up SCIM" }} {{ $mapping_link = "Enable Group mapping" }} {{ $sso_mgmt_link = "Manage your SSO connections" }} {{ end }} {{ end }}
Step two: Create an SSO connection
Important
If your IdP setup requires an Entity ID and the ACS URL, you must select the SAML tab in the Authentication Method section. For example, if your Entra ID (formerly Azure AD) Open ID Connect (OIDC) setup uses SAML configuration within Azure AD, you must select SAML. If you are configuring Open ID Connect with Entra ID (formerly Azure AD) select Azure AD (OIDC) as the authentication method. Also, IdP initiated connections aren't supported at this time. { .important}
After your domain is verified, create an SSO connection.
-
Sign in to {{ $product_link }}.
-
{{ $sso_navigation }}
-
In the SSO connections table select Create Connection, and create a name for the connection.
Note
You have to verify at least one domain before creating the connections.
-
Select an authentication method, SAML or Azure AD (OIDC).
-
Copy the following fields and add them to your IdP:
- SAML: Entity ID, ACS URL
- Azure AD (OIDC): Redirect URL
-
From your IdP, copy and paste the following values into the settings in the Docker console:
- SAML: SAML Sign-on URL, x509 Certificate
- Azure AD (OIDC): Client ID, Client Secret, Azure AD Domain
-
Select the verified domains you want to apply the connection to.
-
To provision your users, select the organization(s) and/or team(s).
-
Review your summary and select Create Connection.
Step three: Test your SSO configuration
After you’ve completed the SSO configuration process in Docker, you can test the configuration when you sign in to {{ $product_link }} using an incognito browser. Sign in to {{ $product_link }} using your domain email address. You are then redirected to your IdP's login page to authenticate.
- Authenticate through email instead of using your Docker ID, and test the login process.
- To authenticate through CLI, your users must have a PAT before you enforce SSO for CLI users.
Important
SSO has Just-In-Time (JIT) Provisioning enabled by default. This means your users are auto-provisioned to your organization on Docker Hub.
You can change this on a per-app basis. To prevent auto-provisioning users, you can create a security group in your IdP and configure the SSO app to authenticate and authorize only those users that are in the security group. Follow the instructions provided by your IdP:
- Okta
- Entra ID (formerly Azure AD) { .important}
The SSO connection is now created. You can continue to set up SCIM without enforcing SSO log-in. For more information about setting up SCIM, see {{ $scim_link }}.
Optional step four: Enforce SSO
-
Sign in to {{ $product_link }}.
-
{{ $sso_navigation }}
-
In the SSO connections table, select the Action icon and then Enable enforcement.
When SSO is enforced, your users are unable to modify their email address and password, convert a user account to an organization, or set up 2FA through Docker Hub. You must enable 2FA through your IdP.
-
Continue with the on-screen instructions and verify that you’ve completed the tasks.
-
Select Turn on enforcement to complete.
Your users must now sign in to Docker with SSO.
Important
If SSO isn't enforced, users can choose to sign in with either their Docker ID or SSO. { .important}
What's next?
- {{ $sso_mgmt_link }}
- {{ $scim_link }}
- {{ $mapping_link }}