Assigning Users and Disabling SCIM in Docker Hub

- **Target attribute**: `urn:ietf:params:scim:schemas:extension:docker:2.0:User:dockerRole` - **Match objects using this attribute**: No - **Apply this mapping**: Always If you're setting more than one attribute, for example role and organization, you need to choose a different extension attribute for each one. 3. Save your configuration. ### Assign users If you used expression mapping in the previous step, navigate to **App registrations**, select **YOUR APP**, and **App Roles**. Create an app role for each Docker role. If possible, create it with a display name that is directly equivalent to the role in Docker, for example, `owner` instead of `Owner`. If set up this way, then you can use expression mapping to `SingleAppRoleAssignment([appRoleAssignments])`. Otherwise, a custom switch will have to be used. See [Expression mapping](#expression-mapping). To add a user: 1. Select **YOUR APP**, then **Users and groups**. 2. Select **Add user/groups**, select the user you want to add, then **Select** their desired role. To add a group: 1. Select **YOUR APP**, then **Users and groups**. 2. Select **Add user/groups**, select the user you want to add, then **Select** their desired role. If you used direct mapping in the previous step, go to **Microsoft Graph Explorer** and sign in to your tenant. You need to be a tenant admin to use this feature. Use the Microsoft Graph API to assign the extension attribute to the user with the value that corresponds to what the attribute was mapped to. See the [Microsoft Graph API documentation](https://learn.microsoft.com/en-us/graph/extensibility-overview?tabs=http) on adding or updating data in extension attributes. {{< /tab >}} {{< /tabs >}} See the documentation for your IdP for additional details: - [Okta](https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-add-custom-user-attributes.htm) - [Entra ID (formerly Azure AD)](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/customize-application-attributes#provisioning-a-custom-extension-attribute-to-a-scim-compliant-application) ## Disable SCIM If SCIM is disabled, any user provisioned through SCIM will remain in the organization. Future changes for your users will not sync from your IdP. User de-provisioning is only possible when manually removing the user from the organization. {{< tabs >}} {{< tab name="Admin Console" >}} {{% admin-scim-disable product="admin" %}} {{< /tab >}} {{< tab name="Docker Hub" >}} {{% include "hub-org-management.md" %}} {{% admin-scim-disable %}} {{< /tab >}} {{< /tabs >}} ## More resources The following videos demonstrate how to configure SCIM for your IdP: - [Video: Configure SCIM with Okta](https://youtu.be/c56YECO4YP4?feature=shared&t=1314) - [Video: Attribute mapping with Okta](https://youtu.be/c56YECO4YP4?feature=shared&t=1998) - [Video: Configure SCIM with Entra ID (Azure)](https://youtu.be/bGquA8qR9jU?feature=shared&t=1668) - [Video: Attribute and group mapping with Entra ID (Azure)](https://youtu.be/bGquA8qR9jU?feature=shared&t=2039)

This section describes how to assign users and groups to roles in Docker Hub after configuring either expression or direct mapping in Azure AD. It details the steps for adding users/groups via the Azure portal or using the Microsoft Graph API for direct mapping. Additionally, it explains how to disable SCIM provisioning, noting that existing users will remain but future changes won't sync from the IdP, and user de-provisioning must be done manually. It also includes links to documentation for Okta and Entra ID, as well as instructional videos on configuring SCIM with both platforms.