SCIM provisioning

1. Sign in to the Admin Console.
2. Select your organization or company in the left navigation drop-down menu, and then select SSO and SCIM.
3. In the SSO connections table, select the Actions icon and Setup SCIM.
4. Copy the SCIM Base URL and API Token and paste the values into your IdP.

Important

Organization management is moving to the Admin Console.

Manage members, team, settings, and activity logs in the Docker Admin Console. Access to these features in Docker Hub will end soon. Explore the Admin Console.

1. Sign in to Docker Hub.
2. Navigate to the SSO settings page for your organization.
   • Organization: Select My Hub, your organization, Settings, and then Security.
3. In the SSO connections table, select the Actions icon and Setup SCIM.
4. Copy the SCIM Base URL and API Token and paste the values into your IdP.

Step one: Enable SCIM

1. Sign in to Okta and select Admin to open the admin portal.
2. Open the application you created when you configured your SSO connection.
3. On the application page, select the General tab, then Edit App Settings.
4. Enable SCIM provisioning, then select Save.
5. Now you can access the Provisioning tab in Okta. Navigate to this tab, then select Edit SCIM Connection.
6. To configure SCIM in Okta, set up your connection using the following values and settings:
   • SCIM Base URL: SCIM connector base URL (copied from Docker Hub)
   • Unique identifier field for users: email
   • Supported provisioning actions: Push New Users and Push Profile Updates
   • Authentication Mode: HTTP Header
   • SCIM Bearer Token: HTTP Header Authorization Bearer Token (copied from Docker Hub)
7. Select Test Connector Configuration.
8. Review the test results and select Save.

Step two: Enable synchronization

1. In Okta, select Provisioning.
2. Select To App, then Edit.
3. Enable Create Users, Update User Attributes, and Deactivate Users.
4. Select Save.
5. Remove unnecessary mappings. The necessary mappings are:
   • Username
   • Given name
   • Family name
   • Email

Microsoft does not support SCIM and OIDC in the same non-gallery application. You must create a second non-gallery application in Entra ID for SCIM provisioning.

Step one: Create a separate SCIM app

1. In the Azure Portal, go to Microsoft Entra ID > Enterprise Applications > New application.
2. Select Create your own application.
3. Name your application and choose Integrate any other application you don't find in the gallery.
4. Select Create.

Step two: Configure SCIM provisioning

1. In your new SCIM application, go to Provisioning > Get started.
2. Set Provisioning Mode to Automatic.
3. Under Admin Credentials:
   • Tenant URL: Paste the SCIM Base URL from Docker.
   • Secret Token: Paste the SCIM API token from Docker.
4. Select Test Connection to verify.
5. Select Save to store credentials.

Next, set up role mapping.

Configure SCIM provisioning

1. In the Azure Portal, go to Microsoft Entra ID > Enterprise Applications, and select your Docker SAML app.
2. Select Provisioning > Get started.
3. Set Provisioning Mode to Automatic.
4. Under Admin Credentials:
   • Tenant URL: Paste the SCIM Base URL from Docker.
   • Secret Token: Paste the SCIM API token from Docker.
5. Select Test Connection to verify.
6. Select Save to store credentials.

Next, set up role mapping.

Step one: Set up role mapping in Okta

1. Setup SSO and SCIM first.
2. In the Okta admin portal, go to Directory, select Profile Editor, and then User (Default).
3. Select Add Attribute and configure the values for the role, organization, or team you want to add. Exact naming isn't required.
4. Return to the Profile Editor and select your application.
5. Select Add Attribute and enter the required values. The External Name and External Namespace must be exact. The external name values for organization/team/role mapping are dockerOrg, dockerTeam, and dockerRole respectively, as listed in the previous table. The external namespace is the same for all of them: urn:ietf:params:scim:schemas:extension:docker:2.0:User.
6. After creating the attributes, navigate to the top of the page and select Mappings, then Okta User to YOUR APP.
7. Go to the newly created attributes and map the variable names to the external names, then select Save Mappings. If you’re using JIT provisioning, continue to the following steps.
8. Navigate to Applications and select YOUR APP.
9. Select General, then SAML Settings, and Edit.
10. Select Step 2 and configure the mapping from the user attribute to the Docker variables.

Step two: Assign roles by user

1. In the Okta Admin portal, select Directory, then People.
2. Select Profile, then Edit.
3. Select Attributes and update the attributes to the desired values.

Step three: Assign roles by group

1. In the Okta Admin portal, select Directory, then People.
2. Select YOUR GROUP, then Applications.
3. Open YOUR APPLICATION and select the Edit icon.
4. Update the attributes to the desired values.

If a user doesn't already have attributes set up, users who are added to the group will inherit these attributes upon provisioning.

Step one: Configure attribute mappings

1. Complete the SCIM provisioning setup.
2. In the Azure Portal, open Microsoft Entra ID > Enterprise Applications, and select your SCIM application.
3. Go to Provisioning > Mappings > Provision Azure Active Directory Users.
4. Add or update the following mappings:
   • userPrincipalName -> userName
   • mail -> emails.value
   • Optional. Map dockerRole, dockerOrg, or dockerTeam using one of the mapping methods.
5. Remove any unsupported attributes to prevent sync errors.
6. Optional. Go to Mappings > Provision Azure Active Directory Groups:
   • If group provisioning causes errors, set Enabled to No.
   • If enabling, test group mappings carefully.
7. Select Save to apply mappings.

Step two: Choose a role mapping method

You can map dockerRole, dockerOrg, or dockerTeam using one of the following methods:

Expression mapping

Use this method if you only need to assign Docker roles like member, editor, or owner.

1. In the Edit Attribute view, set the mapping type to Expression.
2. In the Expression field:
   1. If your App Roles match Docker roles exactly, use: SingleAppRoleAssignment([appRoleAssignments])
   2. If they don't match, use a switch expression: Switch(SingleAppRoleAssignment([appRoleAssignments]), "My Corp Admins", "owner", "My Corp Editors", "editor", "My Corp Users", "member")
3. Set:
   • Target attribute: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRole
   • Match objects using this attribute: No
   • Apply this mapping: Always
4. Save your changes.

Warning

You can't use dockerOrg or dockerTeam with this method. Expression mapping is only compatible with one attribute.

Direct mapping

Use this method if you need to map multiple attributes (e.g., dockerRole + dockerTeam).

1. For each Docker attribute, choose a unique Entra extension attribute (e.g., extensionAttribute1, extensionAttribute2, etc.).
2. In the Edit Attribute view:
   • Set mapping type to Direct.
   • Set Source attribute to your selected extension attribute (e.g., extensionAttribute1).
   • Set Target attribute to one of:
     • dockerRole: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRole
     • dockerOrg: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerOrg
     • dockerTeam: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerTeam
   • Set Apply this mapping to Always.
3. Save your changes.

To assign values, you'll need to use the Microsoft Graph API.

Step three: Assign users and groups

For either mapping method:

1. In the SCIM app, go to Users and Groups > Add user/group.
2. Select the users or groups to provision to Docker.
3. Select Assign.

If you're using expression mapping:

1. Go to App registrations > your SCIM app > App Roles.
2. Create App Roles that match Docker roles.
3. Assign users or groups to App Roles under Users and Groups.

If you're using direct mapping:

1. Go to Microsoft Graph Explorer and sign in as a tenant admin.
2. Use Microsoft Graph API to assign attribute values. Example PATCH request:

PATCH https://graph.microsoft.com/v1.0/users/{user-id}
Content-Type: application/json

{
  "extensionAttribute1": "owner",
  "extensionAttribute2": "moby",
  "extensionAttribute3": "developers"
}

Note

You must use a different extension attribute for each SCIM field.

1. In the Okta admin portal, go to Directory > People.
2. Select a user you've assigned to your SCIM application.
3. Select Provision User.
4. Wait a few seconds, then check the Docker Admin Console under Members.
5. If the user doesn’t appear, review logs in Reports > System Log and confirm SCIM settings in the app.

1. In the Azure Portal, go to Microsoft Entra ID > Enterprise Applications, and select your SCIM app.
2. Go to Provisioning > Provision on demand.
3. Select a user or group and choose Provision.
4. Confirm that the user appears in the Docker Admin Console under Members.
5. If needed, check Provisioning logs for errors.

1. Sign in to the Admin Console.
2. Select your organization or company in the left navigation drop-down menu, and then select SSO and SCIM.
3. In the SSO connections table, select the Actions icon.
4. Select Disable SCIM.

Important

Organization management is moving to the Admin Console.

Manage members, team, settings, and activity logs in the Docker Admin Console. Access to these features in Docker Hub will end soon. Explore the Admin Console.

1. Sign in to Docker Hub.
2. Navigate to the SSO settings page for your organization.
   • Organization: Select My Hub, your organization, Settings, and then Security.
3. In the SSO connections table, select the Actions icon.
4. Select Disable SCIM.