instruction: Create a Dockerfile for security
output: ```dockerfile
  from the user attribute to the Docker variables.Step two: Assign roles by userIn the Okta Admin portal, select Directory, then People.Select Profile, then Edit.Select Attributes and update the attributes to the desired values.Step three: Assign roles by groupIn the Okta Admin portal, select Directory, then People.Select YOUR GROUP, then Applications.Open YOUR APPLICATION and select the Edit icon.Update the attributes to the desired values.If a user doesn't already have attributes set up, users who are added to the group will inherit these attributes upon provisioning.Step one: Configure attribute mappingsComplete the SCIM provisioning setup.In the Azure Portal, open Microsoft Entra ID > Enterprise Applications,
  and select your SCIM application.Go to Provisioning > Mappings > Provision Azure Active Directory Users.Add or update the following mappings:userPrincipalName -> userNamemail -> emails.valueOptional. Map dockerRole, dockerOrg, or dockerTeam using one of the
  mapping methods.Remove any unsupported attributes to prevent sync errors.Optional. Go to Mappings > Provision Azure Active Directory Groups:If group provisioning causes errors, set Enabled to No.If enabling, test group mappings carefully.Select Save to apply mappings.Step two: Choose a role mapping methodYou can map dockerRole, dockerOrg, or dockerTeam using one of the following
  methods:Expression mappingUse this method if you only need to assign Docker roles like member, editor,
  or owner.In the Edit Attribute view, set the mapping type to Expression.In the Expression field:If your App Roles match Docker roles exactly, use: SingleAppRoleAssignment([appRoleAssignments])If they don't match, use a switch expression: Switch(SingleAppRoleAssignment([appRoleAssignments]), "My Corp Admins", "owner", "My Corp Editors", "editor", "My Corp Users", "member")Set:Target attribute: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRoleMatch objects using this attribute: NoApply this mapping: AlwaysSave your changes.
  WarningYou can't use dockerOrg or dockerTeam with this method. Expression mapping
  is only compatible with one attribute.Direct mappingUse this method if you need to map multiple attributes (dockerRole +
  dockerTeam).For each Docker attribute, choose a unique Entra extension attribute (extensionAttribute1, extensionAttribute2, etc.).In the Edit Attribute view:Set mapping type to Direct.Set Source attribute to your selected extension attribute.Set Target attribute to one of:dockerRole: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRoledockerOrg: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerOrgdockerTeam: urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerTeamSet Apply this mapping to Always.Save your changes.To assign values, you'll need to use the Microsoft Graph API.Step three: Assign users and groupsFor either mapping method:In the SCIM app, go to Users and Groups > Add user/group.Select the users or groups to provision to Docker.Select Assign.If you're using expression mapping:Go to App registrations > your SCIM app > App Roles.Create App Roles that match Docker roles.Assign users or groups to App Roles under Users and Groups.If you're using direct mapping:Go to Microsoft Graph Explorer
  and sign in as a tenant admin.Use Microsoft Graph API to assign attribute values. Example PATCH request:
  
  PATCH https://graph.microsoft.com/v1.0/users/{user-id}
  Content-Type: application/json
  
  {
   "extensionAttribute1": "owner",
   "extensionAttribute2": "moby",
   "extensionAttribute3": "developers"
  }
  NoteYou must use a different extension attribute for each SCIM field.See the documentation for your IdP for additional details:OktaEntra ID/Azure ADTest SCIM provisioningAfter completing role mapping, you can test the configuration manually.
  Okta
  
  Entra ID/Azure AD (OIDC and SAML 2.0)In the Okta admin portal, go to Directory > People.Select a user you've assigned to your SCIM application.Select Provision User.Wait a few seconds, then check the Docker
  Admin Console under Members.If the user doesnât appear, review logs in Reports > System Log and
  confirm SCIM settings in the app.In the Azure Portal, go to Microsoft Entra ID > Enterprise Applications,
  and select your SCIM app.Go to Provisioning > Provision on demand.Select a user or group and choose Provision.Confirm that the user appears in the Docker
  Admin Console under Members.If needed, check Provisioning logs for errors.Disable SCIMIf SCIM is disabled, any user provisioned through SCIM will remain in the organization. Future changes for your users will not sync
  ```