diff --git a/content/manuals/security/authentication/single-sign-on/connect.md b/content/manuals/security/authentication/single-sign-on/connect.md index f891d6ef2fd..0f800d0e6f1 100644 --- a/content/manuals/security/authentication/single-sign-on/connect.md +++ b/content/manuals/security/authentication/single-sign-on/connect.md @@ -117,15 +117,34 @@ hours. Docker automatically checks for the record during this time. 1. From [app.docker.com](https://app.docker.com), choose your organization. 1. Select **Identity & auth**, then **SSO and SCIM**. -1. Select **Create Connection**. Name the connection, then choose **SAML 2.0**. -1. Keep this window open. You need to copy and paste these values in your IdP - window: - - **Entity ID** - - **ACS URL** - - **Connection ID** +1. Select **Create Connection** and name the connection. -You will return here to finish connecting after creating an SSO connection in -your IdP. +The dialog offers two connection types. Select the type that matches the +identity provider tab you use in the next step. + +{{< tabs >}} +{{< tab name="SAML 2.0" >}} + +Use this type for the Okta SAML and Entra ID SAML 2.0 tabs. + +1. Select **SAML 2.0**. +1. Copy **Entity ID**, **ACS URL**, and **Connection ID**. For SAML + configuration, paste these values into your identity provider. + +{{< /tab >}} +{{< tab name="Azure AD (OIDC)" >}} + +Use this type for the Azure OpenID Connect (OIDC) tab. + +1. Select **Azure AD (OIDC)**. +1. Copy **Redirect URI**. For Azure AD configuration, paste the Redirect + URI, also called the **Reply URL**, into your identity provider. + +{{< /tab >}} +{{< /tabs >}} + +Keep this window open. You will return here to finish connecting after +creating an SSO connection in your IdP. ### Step 4: Create an SSO connection in your IdP @@ -192,13 +211,25 @@ permissions. 1. Name the application "Docker". 1. Set account types and paste the **Redirect URI** from Docker. 1. Select **Register**. -1. Copy the **Client ID**. +1. On the app registration **Overview** page, copy **Application (client) + ID**. This value is the Docker **Client ID**. #### Create client secrets 1. In your app, go to **Certificates & secrets**. 1. Select **New client secret**, describe and configure duration, then **Add**. -1. Copy the **value** of the new secret. +1. Copy the secret **Value**, not the **Secret ID**. The **Value** is the + Docker **Client Secret**. + + **Value** is the secret string Entra generated. Docker uses it when someone + signs in with this connection. Entra shows the **Value** on this screen + only. If you leave the page or refresh it, the column is blank. Create a + new secret and copy its **Value** before you leave. + + **Secret ID** is the identifier for that row. It stays visible so you can + tell two secrets apart, see which secret is about to expire, or delete a + specific one. Entra does not accept the **Secret ID** as the **Client + Secret**. #### Set API permissions @@ -251,8 +282,8 @@ Complete the integration by pasting your IdP values into Docker. 1. Return to Docker Home. 1. Paste the following values: - - **Client ID** - - **Client Secret** + - **Client ID**: the **Application (client) ID** you copied + - **Client Secret**: the secret **Value** you copied - **Azure AD Domain** 1. Optional. Select a default team, if required by your org. 1. Review and select **Create connection**. diff --git a/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md b/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md index 2e8833d1f98..258d7ed4358 100644 --- a/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md +++ b/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md @@ -7,7 +7,7 @@ description: >- weight: 40 keywords: sso troubleshooting, single sign-on errors, authentication issues, identity provider problems, JIT provisioning, SCIM errors, domain - verification + verification, AADSTS700016 tags: [Troubleshooting] toc_max: 2 aliases: @@ -297,3 +297,43 @@ In your IdP, ensure the Name ID attribute format is correct: 1. Verify that the Name ID attribute format in your IdP is set to `EmailAddress`. 1. Adjust your IdP settings to return the correct Name ID format. + +## Application was not found in the directory + +### Error message + +During Azure AD (OIDC) sign-in, Microsoft Entra can return: + +```text +AADSTS700016: Application with identifier '{identifier}' was not found in the directory '{directory}'. +``` + +### Causes + +The **Client ID** on the Docker SSO connection is not the **Application +(client) ID** from the app registration **Overview** page. Pasting the +**Secret ID** into **Client ID** makes Entra search for an application that +does not exist. + +Entra also returns this error when the sign-in request goes to a directory +that does not contain the app registration. + +### Solutions + +Replace the application identifier in Docker: + +1. In the [Microsoft Entra admin center](https://entra.microsoft.com/), open + the app registration. +1. On the **Overview** page, copy **Application (client) ID**. +1. Sign in to [Docker Home](https://app.docker.com/) and select your + organization. +1. Select **Identity & auth**, then **SSO and SCIM**. +1. In the SSO connections table, select the **Action** menu, then **Edit + connection**. +1. Paste **Application (client) ID** into **Client ID**. The **Secret ID** + and the secret **Value** are not application identifiers. + +If the directory named in the error is not the tenant where you registered +the app, update **Azure AD Domain** on the Docker connection so sign-in uses +that tenant. For the connection steps, see +[Set up single sign-on](/manuals/security/authentication/single-sign-on/connect.md).