Connect single sign-on

Setting up a single sign-on (SSO) connection involves configuring both Docker and your identity provider (IdP). This guide walks you through setup in Docker, setup in your IdP, and final connection.

[!TIP]

You’ll copy and paste values between Docker and your IdP. Complete this guide in one session with separate browser windows open for Docker and your IdP.

Supported identity providers

Docker supports any SAML 2.0 or OIDC-compatible identity provider. This guide provides detailed setup instructions for the most commonly used providers: Okta and Microsoft Entra ID.

If you're using a different IdP, the general process remains the same:

Configure the connection in Docker.
Set up the application in your IdP using the values from Docker.
Complete the connection by entering your IdP's values back into Docker.
Test the connection.

Prerequisites

Before you begin:

Verify your domain
Set up an account with your identity provider (IdP)
Complete the steps in the Configure single sign-on guide

Step one: Create an SSO connection in Docker

[!NOTE]

You must verify at least one domain before creating an SSO connection.

Sign in to Docker Home and choose your organization.
Select Admin Console, then SSO and SCIM.
Select Create Connection and provide a name for the connection.
Select an authentication method: SAML or Azure AD (OIDC).
Copy the required values for your IdP:
- Okta SAML: Entity ID, ACS URL
- Azure OIDC: Redirect URL

Keep this window open to paste values from your IdP later.

Step two: Create an SSO connection in your IdP

Use the following tabs based on your IdP provider.

Sign in to your Okta account and open the Admin portal.
Select Administration and then Create App Integration.
Select SAML 2.0, then Next.
Name your app "Docker".
Optional. Upload a logo.
Paste values from Docker:
- Docker ACS URL -> Single Sign On URL
- Docker Entity ID -> Audience URI (SP Entity ID)
Configure the following settings:
- Name ID format: EmailAddress
- Application username: Email
- Update application on: Create and update
Optional. Add SAML attributes. See SSO attributes.
Select Next.
Select the This is an internal app that we have created checkbox.
Select Finish.

Sign in to Microsoft Entra (formerly Azure AD).
Select Default Directory > Add > Enterprise Application.
Choose Create your own application, name it "Docker", and choose Non-gallery.
After creating your app, go to Single Sign-On and select SAML.
Select Edit on the Basic SAML configuration section.
Edit Basic SAML configuration and paste values from Docker:
- Docker Entity ID -> Identifier
- Docker ACS URL -> Reply URL
Optional. Add SAML attributes. See SSO attributes.
Save the configuration.
From the SAML Signing Certificate section, download your Certificate (Base64).

Register the app

Sign in to Microsoft Entra (formerly Azure AD).
Select App Registration > New Registration.
Name the application "Docker".
Set account types and paste the Redirect URI from Docker.
Select Register.
Copy the Client ID.

Create client secrets

In your app, go to Certificates & secrets.
Select New client secret, describe and configure duration, then Add.
Copy the value of the new secret.

Set API permissions

In your app, go to API permissions.
Select Grant admin consent and confirm.
Select Add a permissions > Delegated permissions.
Search and select User.Read.
Confirm that admin consent is granted.

Step three: Connect Docker to your IdP

Complete the integration by pasting your IdP values into Docker.

In Okta, select your app and go to View SAML setup instructions.
Copy the SAML Sign-in URL and x509 Certificate.

[!IMPORTANT]

Copy the entire certificate, including ----BEGIN CERTIFICATE---- and ----END CERTIFICATE---- lines.
Return to the Docker Admin Console.
Paste the SAML Sign-in URL and x509 Certificate values.
Optional. Select a default team.
Review and select Create connection.

Open your downloaded Certificate (Base64) in a text editor.
Copy the following values:
- From Azure AD: Login URL
- Certificate (Base64) contents
[!IMPORTANT]

Copy the entire certificate, including ----BEGIN CERTIFICATE---- and ----END CERTIFICATE---- lines.
Return to the Docker Admin Console.
Paste the Login URL and Certificate (Base64) values.
Optional. Select a default team.
Review and select Create connection.

Return to the Docker Admin Console.
Paste the following values:
- Client ID
- Client Secret
- Azure AD Domain
Optional. Select a default team.
Review and select Create connection.

Step four: Test the connection

Open an incognito browser window.
Sign in to the Admin Console using your domain email address.
The browser will redirect to your identity provider's sign in page to authenticate. If you have multiple IdPs, choose the sign sign-in option Continue with SSO.
Authenticate through your domain email instead of using your Docker ID.

If you're using the CLI, you must authenticate using a personal access token.

Optional: Configure multiple IdPs

Docker supports multiple IdP configurations. To use multiple IdPs with one domain:

Repeat Steps 1-4 on this page for each IdP.
Each connection must use the same domain.
Users will select Continue with SSO to choose their IdP at sign in.

Optional: Enforce SSO

[!IMPORTANT]

If SSO is not enforced, users can still sign in using Docker usernames and passwords.

Enforcing SSO requires users to use SSO when signing into Docker. This centralizes authentication and enforces policies set by the IdP.

Sign in to Docker Home and select your organization or company.
Select Admin Console, then SSO and SCIM.
In the SSO connections table, select the Action menu, then Enable enforcement.
Follow the on-screen instructions.
Select Turn on enforcement.

When SSO is enforced, your users are unable to modify their email address and password, convert a user account to an organization, or set up 2FA through Docker Hub. If you want to use 2FA, you must enable 2FA through your IdP.