Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update SSO overview doc for clarity #21197

Merged
merged 3 commits into from
Oct 22, 2024
Merged

Update SSO overview doc for clarity #21197

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
74d586b
Update SSO overview doc for clarity
sarahsanders-docker Oct 21, 2024
5e9f9cf
Update content/manuals/security/for-admins/single-sign-on/_index.md
sarahsanders-docker Oct 22, 2024
80f8c9f
Update content/manuals/security/for-admins/single-sign-on/_index.md
sarahsanders-docker Oct 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 17 additions & 11 deletions content/manuals/security/for-admins/single-sign-on/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,29 +10,35 @@
weight: 10
---

Single sign-on (SSO) allows users to authenticate using their identity providers (IdPs) to access Docker. SSO is available for a whole company, and all associated organizations, or an individual organization that has a Docker Business subscription. To upgrade your existing account to a Docker Business subscription, see [Upgrade your subscription](/subscription/upgrade/).
Single sign-on (SSO) lets users access Docker by authenticating using their identity providers (IdPs). SSO is available for a whole company, and all associated organizations within that company, or an individual organization that has a Docker Business subscription. To upgrade your existing account to a Docker Business subscription, see [Upgrade your subscription](/subscription/upgrade/).

## How it works

When you enable SSO, your users can't authenticate using their Docker login credentials (Docker ID and password). Docker supports Service Provider Initiated SSO flow. Instead, they are redirected to your IdP's authentication page to sign in. Your users must sign in to Docker Hub or Docker Desktop to initiate the SSO authentication process.
When you enable SSO, Docker supports a Identity Provider Initiated SSO flow for user login. Instead of users authenticating using their Docker username and password, they are redirected to your identity provider's authentication page to sign in. Users must sign in to Docker Hub or Docker Desktop to initiate the SSO authentication process.

Check warning on line 17 in content/manuals/security/for-admins/single-sign-on/_index.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.RecommendedWords] Consider using 'sign in' instead of 'login'

Raw Output:
{"message": "[Docker.RecommendedWords] Consider using 'sign in' instead of 'login'", "location": {"path": "content/manuals/security/for-admins/single-sign-on/_index.md", "range": {"start": {"line": 17, "column": 86}}}, "severity": "INFO"}
sarahsanders-docker marked this conversation as resolved.
Show resolved Hide resolved

The following diagram shows how SSO operates and is managed in Docker Hub and Docker Desktop. In addition, it provides information on how to authenticate between your IdP.

![SSO architecture](images/SSO.png)

## How to set it up

1. Configure SSO by adding and verify your domain for your organization, then create an SSO connection with your IdP. Docker provides the Assertion Consumer Service (ACS) URL and Entity ID needed to establish a connection between your IdP server and Docker Hub.
2. Test your connection by attempting to sign in to Docker Hub using your domain email address.
3. Optionally, you can [enforce SSO](/security/for-admins/single-sign-on/connect/#optional-enforce-sso) sign-in.
4. Complete SSO enablement. A first-time user can sign in to Docker Hub using their company's domain email address. They're then added to your company, assigned to an organization, and optionally assigned to a team.
SSO is configured using the following steps:
1. Configure SSO by creating and verifying a domain in Docker.
2. Create your SSO connection in Docker and your IdP.
3. Cross-connect Docker and your IdP.
4. Test your connection.
5. Provision users.
6. Optional. Enforce sign-in.
7. Manage your SSO configuration.

## Prerequisites
Once your SSO configuration is complete, a first-time user can sign in to Docker Hub or Docker Desktop using their company's domain email address. Once they sign in, they are added to your company, assigned to an organization, and if necessary, assigned to a team.

* You must first notify your company about the new SSO login procedures.
* Verify that your members have Docker Desktop version 4.4.2, or later, installed on their machines.
* If your organization is planning to [enforce SSO](/security/for-admins/single-sign-on/connect/#optional-enforce-sso), members using the Docker CLI are required to [create a Personal Access Token (PAT)](/docker-hub/access-tokens/) to sign in instead of with a username and password. Docker plans to deprecate signing in to the CLI with a password in the future, so using a PAT will be required to prevent issues with authentication. For more details see the [security announcement](/security/security-announcements/#deprecation-of-password-logins-on-cli-when-sso-enforced).
* Ensure all your Docker users have a valid user on your IdP with the same email address as their Unique Primary Identifier (UPN)
## Prerequisites
Before configuring SSO, ensure you meet the following prerequisites:
sarahsanders-docker marked this conversation as resolved.
Show resolved Hide resolved
* To ensure users are aware of the sign in change, you must first notify your company about the new SSO login procedures.

Check warning on line 38 in content/manuals/security/for-admins/single-sign-on/_index.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.RecommendedWords] Consider using 'sign in' instead of 'login'

Raw Output:
{"message": "[Docker.RecommendedWords] Consider using 'sign in' instead of 'login'", "location": {"path": "content/manuals/security/for-admins/single-sign-on/_index.md", "range": {"start": {"line": 38, "column": 105}}}, "severity": "INFO"}
* Verify that your members have Docker Desktop version 4.4.2 or later installed on their machines.
* If your organization is planning to [enforce SSO](/security/for-admins/single-sign-on/connect/#optional-enforce-sso), members using the Docker CLI are required to [create a Personal Access Token (PAT)](/docker-hub/access-tokens/) to sign in. The PAT will be used instead of their username and password. Docker plans to deprecate signing in to the CLI with a password in the future, so using a PAT will be required to prevent issues with authentication. For more details see the [security announcement](/security/security-announcements/#deprecation-of-password-logins-on-cli-when-sso-enforced).
* Ensure all your Docker users have a valid user on your IdP with the same email address as their Unique Primary Identifier (UPN).
* Confirm that all CI/CD pipelines have replaced their passwords with PATs.
* For your service accounts, add your additional domains or enable it in your IdP.

Expand Down
Loading