instruction: Explain Docker containerization and best practices
output: Back
  Ask AI
  Start typing to search or try
  Contact support
  Manuals
  Get started
  Guides
  SCIM provisioning
  Page options
  Copy page as Markdown for LLMs
  View page as plain text
  Ask questions with Docs AI
  Claude
  Open in Claude
  Subscription:
  Business
  Requires:
  Docker Desktop
  and later
  For:
  Administrators
  Automate user management for your Docker organization using System for Cross-domain Identity Management (SCIM). SCIM automatically provisions and de-provisions users, synchronizes team memberships, and keeps your Docker organization in sync with your identity provider.
  This page shows you how to automate user provisioning and de-provisioning for Docker using SCIM.
  Prerequisites
  Before you begin, you must have:
  SSO configured for your organization
  Administrator access to Docker Home and your identity provider
  How SCIM works
  SCIM automates user provisioning and de-provisioning for Docker through your
  identity provider. After you enable SCIM, any user assigned to your
  Docker application in your identity provider is automatically provisioned and added to your
  Docker organization. When a user is removed from the Docker application in your
  identity provider, SCIM deactivates and removes them from your Docker organization.
  In addition to provisioning and removal, SCIM also syncs profile updates like
  name changes made in your identity provider. You can use SCIM alongside Docker's default
  Just-in-Time (JIT) provisioning or on its own with JIT disabled.
  SCIM automates:
  Creating users
  Updating user profiles
  Removing and deactivating users
  Re-activating users
  Group mapping
  Note
  SCIM only manages users provisioned through your identity provider after SCIM is enabled. It cannot remove users who were manually added to your Docker organization before SCIM was set up.
  To remove those users, delete them manually from your Docker organization.
  For more information, see
  Manage organization members
  Supported attributes
  SCIM uses attributes (name, email, etc.) to sync user information between your
  identity provider and Docker. Properly mapping these attributes in your identity provider ensures that user provisioning works smoothly and prevents issues like duplicate user accounts
  when using single sign-on.
  Docker supports the following SCIM attributes:
  Attribute
  Description
  userName
  Userâs primary email address, used as the unique identifier
  name.givenName
  Userâs first name
  name.familyName
  Userâs surname
  active
  Indicates if a user is enabled or disabled, set to âfalseâ to de-provision a user
  For additional details about supported attributes and SCIM, see
  Docker Hub API SCIM reference
  Important
  By default, Docker uses Just-in-Time (JIT) provisioning for SSO. If SCIM is
  enabled, JIT values still take precedence and will overwrite attribute values
  set by SCIM. To avoid conflicts, make sure your JIT attribute values match your
  SCIM values.
  Alternatively, you can disable JIT provisioning to rely solely on SCIM.
  For details, see
  Just-in-Time
  Enable SCIM in Docker
  To enable SCIM:
  Sign in to
  Docker Home
  Select
  Admin Console
  , then
  SSO and SCIM
  In the
  SSO connections
  table, select the
  Actions
  icon for your connection, then select
  Setup SCIM
  Copy the
  SCIM Base URL
  API Token
  and paste the values into your IdP.
  Enable SCIM in your IdP
  The user interface for your identity provider may differ slightly from the following steps. You can refer to the documentation for your identity provider to verify. For additional details, see the documentation for your identity provider:
  Okta
  Entra ID/Azure AD SAML 2.0
  Note
  Microsoft does not currently support SCIM and OIDC in the same non-gallery
  application in Entra ID. This page provides a verified workaround using a
  separate non-gallery app for SCIM provisioning. While Microsoft does not
  officially document this setup, it is widely used and supported in practice.
  Okta
  Entra ID (OIDC)
  Entra ID (SAML 2.0)
  Step one: Enable SCIM
  Sign in to Okta and select
  Admin
  to open the admin portal.
  Open the application you created when you configured your SSO connection.
  On the application page, select the
  General
  tab, then
  Edit App Settings
  Enable SCIM provisioning, then select
  Save
  Navigate to the
  Provisioning
  , then select
  Edit SCIM Connection
  To configure SCIM in Okta, set up your connection using the following values and settings:
  SCIM Base URL: SCIM connector base URL (copied from Docker Home)
  Unique identifier field for users:
  email
  Supported provisioning actions:
  Push New Users
  Push Profile Updates
  Authentication Mode: HTTP Header
  SCIM Bearer Token: HTTP Header Authorization Bearer Token (copied from Docker Home)
  Select
  Test Connector Configuration
  Review the test results and select
  Save
  Step two: Enable synchronization
  In Okta, select
  Provisioning
  Select
  To App
  , then
  Edit
  Enable
  Create Users
  Update User Attributes
  , and
  Deactivate Users
  Select
  Save
  Remove unnecessary mappings. The necessary mappings are:
  Username
  Given name
  Family name
  Email
  Next,
  set up role mapping
  Microsoft does not support SCIM and OIDC in the same non-gallery application.
  You must create a second non-gallery application in Entra ID for SCIM
  provisioning.
  Step one: Create a separate SCIM app
  In the Azure Portal, go to
  Microsoft Entra ID
  Enterprise Applications
  New application
  Select
  Create your own application
  Name your application and choose
  Integrate any other application you don't find in the gallery
  Select
  Create
  Step two: Configure SCIM provisioning
  In your new SCIM application, go to
  Provisioning
  Get started
  Provisioning Mode
  Automatic
  Under
  Admin Credentials
  Tenant URL
  : Paste the
  SCIM Base URL
  from Docker Home.
  Secret Token
  : Paste the
  SCIM API token
  from Docker Home.
  Select
  Test Connection
  to verify.
  Select
  Save
  to store credentials.
  Next,
  set up role mapping
  In the Azure Portal, go to
  Microsoft Entra ID
  Enterprise Applications
  and select your Docker SAML app.
  Select
  Provisioning
  Get started
  Provisioning Mode
  Automatic
  Under
  Admin Credentials
  Tenant URL
  : Paste the
  SCIM Base URL
  from Docker Home.
  Secret Token
  : Paste the
  SCIM API token
  from Docker Home.
  Select
  Test Connection
  to verify.
  Select
  Save
  to store credentials.
  Next,
  set up role mapping
  Set up role mapping
  You can assign
  Docker roles
  users by adding optional SCIM attributes in your IdP. These attributes override
  default role and team values set in your SSO configuration.
  Note
  Role mappings are supported for both SCIM and Just-in-Time (JIT)
  provisioning. For JIT, role mapping applies only when the user is first
  provisioned.
  The following table lists the supported optional user-level attributes:
  Attribute
  Possible values
  Notes
  dockerRole
  member
  editor
  , or
  owner
  If not set, the user defaults to the
  member
  role. Setting this attribute overrides the default.
  For role definitions, see
  Roles and permissions
  dockerOrg
  Docker
  organizationName
  (e.g.,
  moby
  Overrides the default organization configured in your SSO connection.
  If unset, the user is provisioned to the default organization. If
  dockerOrg
  dockerTeam
  are both set, the user is provisioned to the team within the specified organization.
  dockerTeam
  Docker
  teamName
  (e.g.,
  developers
  Provisions the user to the specified team in the default or specified organization. If the team doesn't exist, it is automatically created.
  You can still use
  group mapping
  to assign users to multiple teams across organizations.
  The external namespace used for these attributes is:
  urn:ietf:params:scim:schemas:extension:docker:2.0:User
  This value is required in your identity provider when creating custom SCIM attributes for Docker.
  Okta
  Entra ID/Azure AD (SAML 2.0 and OIDC)
  Step one: Set up role mapping in Okta
  Setup
  and SCIM first.
  In the Okta admin portal, go to
  Directory
  , select
  Profile Editor
  , and then
  User (Default)
  Select
  Add Attribute
  and configure the values for the role, organization, or team you want to add. Exact naming isn't required.
  Return to the
  Profile Editor
  and select your application.
  Select
  Add Attribute
  and enter the required values. The
  External Name
  External Namespace
  must be exact.
  The external name values for organization/team/role mapping are
  dockerOrg
  dockerTeam
  , and
  dockerRole
  respectively, as listed in the previous table.
  The external namespace is the same for all of them:
  urn:ietf:params:scim:schemas:extension:docker:2.0:User
  After creating the attributes, navigate to the top of the page and select
  Mappings
  , then
  Okta User to YOUR APP
  Go to the newly created attributes and map the variable names to the external names, then select
  Save Mappings
  . If youâre using JIT provisioning, continue to the following steps.
  Navigate to
  Applications
  and select
  YOUR APP
  Select
  General
  , then
  SAML Settings
  , and
  Edit
  Select
  Step 2
  and configure the mapping from the user attribute to the Docker variables.
  Step two: Assign roles by user
  In the Okta Admin portal, select
  Directory
  , then
  People
  Select
  Profile
  , then
  Edit
  Select
  Attributes
  and update the attributes to the desired values.
  Step three: Assign roles by group
  In the Okta Admin portal, select
  Directory
  , then
  People
  Select
  YOUR GROUP
  , then
  Applications
  Open
  YOUR APPLICATION
  and select the
  Edit
  icon.
  Update the attributes to the desired values.
  If a user doesn't already have attributes set up, users who are added to the group will inherit these attributes upon provisioning.
  Step one: Configure attribute mappings
  Complete the
  SCIM provisioning setup
  In the Azure Portal, open
  Microsoft Entra ID
  Enterprise Applications
  and select your SCIM application.
  Go to
  Provisioning
  Mappings
  Provision Azure Active Directory Users
  Add or update the following mappings:
  userPrincipalName
  userName
  mail
  emails.value
  Optional. Map
  dockerRole
  dockerOrg
  , or
  dockerTeam
  using one of the
  mapping methods
  Remove any unsupported attributes to prevent sync errors.
  Optional. Go to
  Mappings
  Provision Azure Active Directory Groups
  If group provisioning causes errors, set
  Enabled
  If enabling, test group mappings carefully.
  Select
  Save
  to apply mappings.
  Step two: Choose a role mapping method
  You can map
  dockerRole
  dockerOrg
  , or
  dockerTeam
  using one of the following
  methods:
  Expression mapping
  Use this method if you only need to assign Docker roles like
  member
  editor
  owner
  In the
  Edit Attribute
  view, set the mapping type to
  Expression
  In the
  Expression
  field:
  If your App Roles match Docker roles exactly, use: SingleAppRoleAssignment([appRoleAssignments])
  If they don't match, use a switch expression:
  Switch(SingleAppRoleAssignment([appRoleAssignments]), "My Corp Admins", "owner", "My Corp Editors", "editor", "My Corp Users", "member")
  Set:
  Target attribute
  urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRole
  Match objects using this attribute
  : No
  Apply this mapping
  : Always
  Save your changes.
  Warning
  You can't use
  dockerOrg
  dockerTeam
  with this method. Expression mapping
  is only compatible with one attribute.
  Direct mapping
  Use this method if you need to map multiple attributes (
  dockerRole
  dockerTeam
  For each Docker attribute, choose a unique Entra extension attribute (
  extensionAttribute1
  extensionAttribute2
  , etc.).
  In the
  Edit Attribute
  view:
  Set mapping type to
  Direct
  Source attribute
  to your selected extension attribute.
  Target attribute
  to one of:
  dockerRole: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRole
  dockerOrg: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerOrg
  dockerTeam: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerTeam
  Apply this mapping
  Always
  Save your changes.
  To assign values, you'll need to use the Microsoft Graph API.
  Step three: Assign users and groups
  For either mapping method:
  In the SCIM app, go to
  Users and Groups
  Add user/group
  Select the users or groups to provision to Docker.
  Select
  Assign
  If you're using expression mapping:
  Go to
  App registrations
  > your SCIM app >
  App Roles
  Create App Roles that match Docker roles.
  Assign users or groups to App Roles under
  Users and Groups
  If you're using direct mapping:
  Go to
  Microsoft Graph Explorer
  and sign in as a tenant admin.
  Use Microsoft Graph API to assign attribute values. Example PATCH request:
  PATCH https://graph.microsoft.com/v1.0/users/
  user-id
  Content-Type: application/json
  "extensionAttribute1"
  "owner"
  "extensionAttribute2"
  "moby"
  "extensionAttribute3"
  "developers"
  Note
  You must use a different extension attribute for each SCIM field.
  See the documentation for your IdP for additional details:
  Okta
  Entra ID/Azure AD
  Test SCIM provisioning
  After completing role mapping, you can test the configuration manually.
  Okta
  Entra ID/Azure AD (OIDC and SAML 2.0)
  In the Okta admin portal, go to
  Directory > People
  Select a user you've assigned to your SCIM application.
  Select
  Provision User
  Wait a few seconds, then check the Docker
  Admin Console
  under
  Members
  If the user doesnât appear, review logs in
  Reports > System Log
  confirm SCIM settings in the app.
  In the Azure Portal, go to
  Microsoft Entra ID
  Enterprise Applications
  and select your SCIM app.
  Go to
  Provisioning
  Provision on demand
  Select a user or group and choose
  Provision
  Confirm that the user appears in the Docker
  Admin Console
  under
  Members
  If needed, check
  Provisioning logs
  for errors.
  Disable SCIM
  If SCIM is disabled, any user provisioned through SCIM will remain in the organization. Future changes for your users will not sync from your IdP. User de-provisioning is only possible when manually removing the user from the organization.
  To disable SCIM:
  Sign in to
  Docker Home
  Select
  Admin Console
  , then
  SSO and SCIM
  In the
  SSO connections
  table, select the
  Actions
  icon.
  Select
  Disable SCIM
  Next steps
  Set up
  Group mapping
  Troubleshoot provisioning