OIDC connections overview
Table of contents
OIDC connections create a trust relationship between Docker and a trusted third party so you don't have to maintain long-lived credentials. When you create an OIDC connection, Docker exchanges short-lived tokens with another vendor that can grant fine-grained access to your Docker resources.
How OIDC connections work
OIDC connections follow the OpenID Connect (OIDC) standard. Establishing a trust relationship involves creating the connection, configuring a workflow, and testing. For example, a trust relationship between Docker and GitHub follows these steps:
- GitHub issues a JWT ID token for the workflow run.
- During authentication, Docker:
- Verifies the token against GitHub's public key registry
- Matches subject claims against rulesets created in Docker Home
- Docker returns an access token so the GitHub Action can sign in to Docker and access resources.
All tokens created and exchanged during an OIDC workflow are short-lived and issued on a per-workflow basis.
For how OIDC connections compare to organization access tokens, see Access tokens.