Edit

Share via

Microsoft Entra SSO integration with Docker Business

  • Article

In this tutorial, you'll learn how to integrate Docker Business with Microsoft Entra ID. When you integrate Docker Business with Microsoft Entra ID, you can:

  • Control in Microsoft Entra ID who has access to Docker Business.
  • Enable your users to be automatically signed-in to Docker Business with their Microsoft Entra accounts.
  • Manage your accounts in one central location.

Prerequisites

To integrate Microsoft Entra ID with Docker Business, you need:

  • A Microsoft Entra subscription. If you don't have a subscription, you can get a free account.
  • A Docker Business subscription.

Scenario description

In this tutorial, you configure and test Microsoft Entra SSO in a test environment.

  • Docker Business supports only SP initiated SSO.
  • Docker Business supports Just In Time user provisioning.

To configure the integration of Docker Business into Microsoft Entra ID, you need to add Docker Business from the gallery to your list of managed SaaS apps.

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
  2. Browse to Identity > Applications > Enterprise applications > New application.
  3. In the Add from the gallery section, type Docker Business in the search box.
  4. Select Docker Business from results panel and then add the app. Wait a few seconds while the app is added to your tenant.

Alternatively, you can also use the Enterprise App Configuration Wizard. In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. Learn more about Microsoft 365 wizards.

Configure and test Microsoft Entra SSO for Docker Business

Configure and test Microsoft Entra SSO with Docker Business using a test user called B.Simon. For SSO to work, you need to establish a link relationship between a Microsoft Entra user and the related user in Docker Business.

To configure and test Microsoft Entra SSO with Docker Business, perform the following steps:

  1. Configure Microsoft Entra SSO - to enable your users to use this feature.
    1. Create a Microsoft Entra test user - to test Microsoft Entra single sign-on with B.Simon.
    2. Assign the Microsoft Entra test user - to enable B.Simon to use Microsoft Entra single sign-on.
  2. Configure Docker Business SSO - to configure the single sign-on settings on application side.
    1. Create Docker Business test user - to have a counterpart of B.Simon in Docker Business that is linked to the Microsoft Entra ID representation of user.
  3. Test SSO - to verify whether the configuration works.

Configure Microsoft Entra SSO

Follow these steps to enable Microsoft Entra SSO in the Microsoft Entra admin center.

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

  2. Browse to Identity > Applications > Enterprise applications > Docker Business > Single sign-on.

  3. On the Select a single sign-on method page, select SAML.

  4. On the Set up single sign-on with SAML page, click the pencil icon for Basic SAML Configuration to edit the settings.

    Screenshot shows how to edit Basic SAML Configuration.

  5. On the Basic SAML Configuration section, perform the following steps:

    a. In the Identifier (Entity ID) text box, type a value using the following pattern: urn:auth0:docker-prod:<Docker_SsoID>

    b. In the Reply URL text box, type a URL using the following pattern: https://login.docker.com/login/callback?connection=<Docker_SsoID>

    c. In the Sign on URL text box, type a URL using the following pattern: https://hub.docker.com/auth/start?connection=<Docker_SsoID>

    Note

    These values are not real. Update these values with the actual Identifier, Reply URL and Sign on URL. You will get these values while configuring Docker Business SSO. You can also refer to the patterns shown in the Basic SAML Configuration section in the Microsoft Entra admin center.

  6. Docker Business application expects Unique User Identifier mapped to an email address (user.mail) instead of user.userprincipalname and it also supports givenname and surname to sync users full name into Docker Business app. The following screenshot shows the list of default attributes.

    Screenshot shows the image of the attributes.

    Note

    Please delete name and emailaddress manually from the above default attributes in the Microsoft Entra admin center as per application requirements.

  7. In addition to above, Docker Business application supports optional attributes to be passed back in SAML response, which are shown below. These attributes can be added to manage the provisioning of users in specific teams and their roles within the Docker Business Organization.

    Claim Name Namespace Source Attribute
    dockerOrg <empty> Docker Organization name
    dockerTeam <empty> Docker Team name
    dockerRole <empty> User role in the Organization. Allowed values: “owner”, “editor”, “member”.

    Note

    If the organization requires to manage users into multiple teams, then group claims can also be enabled. To learn more about Docker SSO Group Management click here.

  8. On the Set up single sign-on with SAML page, in the SAML Signing Certificate section, find Certificate (Base64) and select Download to download the certificate and save it on your computer.

  9. On the Set up Docker Business section, copy the appropriate URL(s) based on your requirement.

Create a Microsoft Entra test user

In this section, you'll create a test user in the Microsoft Entra admin center called B.Simon.

  1. Sign in to the Microsoft Entra admin center as at least a User Administrator.
  2. Browse to Identity > Users > All users.
  3. Select New user > Create new user, at the top of the screen.
  4. In the User properties, follow these steps:
    1. In the Display name field, enter B.Simon.
    2. In the User principal name field, enter the [email protected]. For example, [email protected].
    3. Select the Show password check box, and then write down the value that's displayed in the Password box.
    4. Select Review + create.
  5. Select Create.

Assign the Microsoft Entra test user

In this section, you'll enable B.Simon to use Microsoft Entra single sign-on by granting access to Docker Business.

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
  2. Browse to Identity > Applications > Enterprise applications > Docker Business.
  3. In the app's overview page, select Users and groups.
  4. Select Add user/group, then select Users and groups in the Add Assignment dialog.
    1. In the Users and groups dialog, select B.Simon from the Users list, then click the Select button at the bottom of the screen.
    2. If you are expecting a role to be assigned to the users, you can select it from the Select a role dropdown. If no role has been set up for this app, you see "Default Access" role selected.
    3. In the Add Assignment dialog, click the Assign button.

Configure Docker Business SSO

  1. Log in to Docker Business company site as an administrator.

  2. Select your organization or company from the left drop-down menu and click SSO & SCIM.

  3. In the SSO connections table, select Create Connection and create a name for the connection.

    Note

    You have to verify at least one domain before creating the connections.

  4. Select SAML as an authentication method and perform the following steps:

    Screenshot that shows the Configuration.

    1. Copy Entity ID value, paste this value into the Identifier (Entity ID) text box in the Basic SAML Configuration section in Microsoft Entra admin center.

    2. Copy ACS URL value, paste this value into the Reply URL text box in the Basic SAML Configuration section in Microsoft Entra admin center.

    3. In the SAML Sign-On URL field, paste the Login URL value, which you have copied from the Microsoft Entra admin center.

    4. Open the downloaded Certificate (Base64) into Notepad and paste the content into the Key x509 Certificate textbox.

    5. Click Next and Save Connection.

Create Docker Business test user

In this section, a user called Britta Simon is created in Docker Business. Docker Business supports Just-in-Time user provisioning, which is enabled by default. There is no action item for you in this section. If a user doesn't already exist in Docker Business, a new one is created after authentication.

Test SSO

In this section, you test your Microsoft Entra single sign-on configuration with following options.

  • Click on Test this application in Microsoft Entra admin center. This will redirect to Docker Business Sign on URL where you can initiate the login flow.

  • Go to Docker Business Sign on URL directly and initiate the login flow from there.

  • You can use Microsoft My Apps. When you click the Docker Business tile in the My Apps, this will redirect to Docker Business Sign-on URL. For more information about the My Apps, see Introduction to the My Apps.

Next steps

Once you configure Docker Business you can enforce session control, which protects exfiltration and infiltration of your organization's sensitive data in real time. Session control extends from Conditional Access. Learn how to enforce session control with Microsoft Defender for Cloud Apps.