Skip to content

Commit 5a49d2a

Browse files
akristenakristen
committed
initial commit
1 parent 8decba3 commit 5a49d2a

6 files changed

Lines changed: 241 additions & 228 deletions

File tree

‎content/guides/admin-user-management/onboard.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,4 +67,4 @@ It also:
6767
- Ensures consistent access control policies.
6868
- Help you scale permissions as teams grow or change.
6969

70-
For more information on how it works, see [Group mapping](/manuals/enterprise/security/provisioning/group-mapping.md).
70+
For more information on how it works, see [Group mapping](/provisioning/scim/group-mapping).

‎content/manuals/enterprise/security/provisioning/just-in-time.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: Learn how Just-in-Time provisioning works with your SSO connection.
33
keywords: user provisioning, just-in-time provisioning, JIT, autoprovision, Docker Admin, admin, security
44
title: Just-in-Time provisioning
55
linkTitle: Just-in-Time
6-
weight: 10
6+
weight: 20
77
aliases:
88
- /security/for-admins/provisioning/just-in-time/
99
---
@@ -85,5 +85,5 @@ Users are provisioned with JIT by default. If you enable SCIM, you can disable J
8585
## Next steps
8686

8787
- Configure [SCIM provisioning](/manuals/enterprise/security/provisioning/scim.md) for advanced user management.
88-
- Set up [group mapping](/manuals/enterprise/security/provisioning/group-mapping.md) to automatically assign users to teams.
88+
- Set up [group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) to automatically assign users to teams.
8989
- Review [Troubleshoot provisioning](/manuals/enterprise/troubleshoot/troubleshoot-provisioning.md).

‎content/manuals/enterprise/security/provisioning/scim/_index.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: SCIM overview
3+
linkTitle: SCIM
4+
description: Learn how System for Cross-domain Identity Management works and how to set it up.
5+
keywords: SCIM, SSO, user provisioning, de-provisioning, role mapping, assign users
6+
aliases:
7+
- /security/for-admins/scim/
8+
- /docker-hub/scim/
9+
- /security/for-admins/provisioning/scim/
10+
---
11+
12+
{{< summary-bar feature_name="SSO" >}}
13+
14+
Automate user management for your Docker organization using System for
15+
Cross-domain Identity Management (SCIM). SCIM automatically provisions and
16+
de-provisions users, synchronizes team memberships, and keeps your Docker
17+
organization in sync with your identity provider.
18+
19+
This page shows you how to automate user provisioning and de-provisioning for
20+
Docker using SCIM.
21+
22+
## Prerequisites
23+
24+
Before you begin, you must have:
25+
26+
- SSO configured for your organization
27+
- Administrator access to Docker Home and your identity provider
28+
29+
## How SCIM works
30+
31+
SCIM automates user provisioning and de-provisioning for Docker through your
32+
identity provider. After you enable SCIM, any user assigned to your
33+
Docker application in your identity provider is automatically provisioned and
34+
added to your Docker organization. When a user is removed from the Docker
35+
application in your identity provider, SCIM deactivates and removes them from
36+
your Docker organization.
37+
38+
In addition to provisioning and removal, SCIM also syncs profile updates like
39+
name changes made in your identity provider. You can use SCIM alongside Docker's
40+
default Just-in-Time (JIT) provisioning or on its own with JIT disabled.
41+
42+
SCIM automates:
43+
44+
- Creating users
45+
- Updating user profiles
46+
- Removing and deactivating users
47+
- Re-activating users
48+
- Group mapping
49+
50+
> [!NOTE]
51+
>
52+
> SCIM only manages users provisioned through your identity provider after
53+
> SCIM is enabled. It cannot remove users who were manually added to your Docker
54+
> organization before SCIM was set up.
55+
>
56+
> To remove those users, delete them manually from your Docker organization.
57+
> For more information, see
58+
> [Manage organization members](/manuals/admin/organization/members.md).

content/manuals/enterprise/security/provisioning/group-mapping.md renamed to content/manuals/enterprise/security/provisioning/scim/group-mapping.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ aliases:
77
- /admin/organization/security-settings/group-mapping/
88
- /docker-hub/group-mapping/
99
- /security/for-admins/group-mapping/
10-
- /security/for-admins/provisioning/group-mapping/
11-
weight: 30
10+
- /security/for-admins/provisioning/scim/group-mapping/
11+
weight: 20
1212
---
1313

1414
{{< summary-bar feature_name="SSO" >}}

‎content/manuals/enterprise/security/provisioning/scim/migrate-scim.md‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
---
2+
title: Migrate JIT to SCIM
3+
linkTitle: Migrate
4+
description: Learn how to migrate from just-in-time (JIT) to SCIM.
5+
weight: 30
6+
---
7+
8+
## Migrate existing JIT users to SCIM
9+
10+
If you already have users provisioned through Just-in-Time (JIT) and want to
11+
enable full SCIM lifecycle management, you need to migrate them. Users
12+
originally created by JIT cannot be automatically de-provisioned through SCIM,
13+
even after SCIM is enabled.
14+
15+
### Why migrate
16+
17+
Organizations using JIT provisioning may encounter limitations with user
18+
lifecycle management, particularly around de-provisioning. Migrating to SCIM
19+
provides:
20+
21+
- Automatic user de-provisioning when users leave your organization. This is
22+
the primary benefit for large organizations that need full automation.
23+
- Continuous synchronization of user attributes
24+
- Centralized user management through your identity provider
25+
- Enhanced security through automated access control
26+
27+
> [!IMPORTANT]
28+
>
29+
> Users originally created through JIT provisioning cannot be automatically
30+
> de-provisioned by SCIM, even after SCIM is enabled. To enable full lifecycle
31+
> management including automatic de-provisioning through your identity provider,
32+
> you must manually remove these users so SCIM can re-create them with proper
33+
> lifecycle management capabilities.
34+
35+
This migration is most critical for larger organizations that require fully
36+
automated user de-provisioning when employees leave the company.
37+
38+
### Prerequisites for migration
39+
40+
Before migrating, ensure you have:
41+
42+
- SCIM configured and tested in your organization
43+
- A maintenance window for the migration
44+
45+
> [!WARNING]
46+
>
47+
> This migration temporarily disrupts user access. Plan to perform this
48+
> migration during a low-usage window and communicate the timeline to affected
49+
> users.
50+
51+
### Prepare for migration
52+
53+
#### Transfer ownership
54+
55+
Before removing users, ensure that any repositories, teams, or organization
56+
resources they own are transferred to another administrator or service account.
57+
When a user is removed from the organization, any resources they own may
58+
become inaccessible.
59+
60+
1. Review repositories, organization resources, and team ownership for affected
61+
users.
62+
2. Transfer ownership to another administrator.
63+
64+
> [!WARNING]
65+
>
66+
> If ownership is not transferred, repositories owned by removed users may
67+
> become inaccessible when the user is removed. Ensure all critical resources
68+
> are transferred before proceeding.
69+
70+
#### Verify identity provider configuration
71+
72+
1. Confirm all JIT-provisioned users are assigned to the Docker application in
73+
your identity provider.
74+
2. Verify identity provider group to Docker team mappings are configured and
75+
tested.
76+
77+
Users not assigned to the Docker application in your identity provider are not
78+
re-created by SCIM after removal.
79+
80+
#### Export user records
81+
82+
Export a list of JIT-provisioned users from Docker Admin Console:
83+
84+
1. Sign in to [Docker Home](https://app.docker.com) and select your
85+
organization.
86+
2. Select **Admin Console**, then **Members**.
87+
3. Select **Export members** to download the member list as CSV for backup and
88+
reference.
89+
90+
Keep this CSV list of JIT-provisioned users as a rollback reference if needed.
91+
92+
### Complete the migration
93+
94+
#### Disable JIT provisioning
95+
96+
> [!IMPORTANT]
97+
>
98+
> Before disabling JIT, ensure SCIM is fully configured and tested in your
99+
> organization. Do not disable JIT until you have verified SCIM is working
100+
> correctly.
101+
102+
1. Sign in to [Docker Home](https://app.docker.com) and select your organization.
103+
2. Select **Admin Console**, then **SSO and SCIM**.
104+
3. In the SSO connections table, select the **Actions** menu for your connection.
105+
4. Select **Disable JIT provisioning**.
106+
5. Select **Disable** to confirm.
107+
108+
Disabling JIT prevents new users from being automatically added through SSO
109+
during the migration.
110+
111+
#### Remove JIT-origin users
112+
113+
> [!IMPORTANT]
114+
>
115+
> Users originally created through JIT provisioning cannot be automatically
116+
> de-provisioned by SCIM, even after SCIM is enabled. To enable full lifecycle
117+
> management including automatic de-provisioning through your identity provider,
118+
> you must manually remove these users so SCIM can re-create them with proper
119+
> lifecycle management capabilities.
120+
121+
This step is most critical for large organizations that require fully automated
122+
user de-provisioning when employees leave the company.
123+
124+
1. Sign in to [Docker Home](https://app.docker.com) and select your organization.
125+
2. Select **Admin Console**, then **Members**.
126+
3. Identify and remove JIT-provisioned users in manageable batches.
127+
4. Monitor for any errors during removal.
128+
129+
> [!TIP]
130+
>
131+
> To efficiently identify JIT users, compare the member list exported before
132+
> SCIM was enabled with the current member list. Users who existed before SCIM
133+
> was enabled were likely provisioned via JIT.
134+
135+
#### Verify SCIM re-provisioning
136+
137+
After removing JIT users, SCIM automatically re-creates user accounts:
138+
139+
1. In your identity provider system log, confirm "create app user" events for
140+
Docker.
141+
2. In Docker Admin Console, confirm users reappear with SCIM provisioning.
142+
3. Verify users are added to the correct teams via group mapping.
143+
144+
#### Validate user access
145+
146+
Perform post-migration validation:
147+
148+
1. Select a subset of migrated users to test sign-in and access.
149+
2. Verify team membership matches identity provider group assignments.
150+
3. Confirm repository access is restored.
151+
4. Test that de-provisioning works correctly by removing a test user from your
152+
identity provider.
153+
154+
Keep audit exports and logs for compliance purposes.
155+
156+
### Migration results
157+
158+
After completing the migration:
159+
160+
- All users in your organization are SCIM-provisioned
161+
- User de-provisioning works reliably through your identity provider
162+
- No new JIT users are created
163+
- Consistent identity lifecycle management is maintained
164+
165+
### Troubleshoot migration issues
166+
167+
If a user fails to reappear after removal:
168+
169+
1. Check that the user is assigned to the Docker application in your identity
170+
provider.
171+
2. Verify SCIM is enabled in both Docker and your identity provider.
172+
3. Trigger a manual SCIM sync in your identity provider.
173+
4. Check provisioning logs in your identity provider for errors.
174+
175+
For more troubleshooting guidance, see
176+
[Troubleshoot provisioning](/manuals/enterprise/troubleshoot/troubleshoot-provisioning.md).

0 commit comments

Comments
 (0)