From e40d0ea6a10314e135ad739d359bc054f2a84c06 Mon Sep 17 00:00:00 2001 From: Alexa Date: Mon, 12 Oct 2026 10:59:25 -0500 Subject: [PATCH 1/2] docs: match SSO setup to the connection dialog (ENGDOCS-3407) Step 3 told every reader to select SAML 2.0 and copy Entity ID, ACS URL, and Connection ID, so Azure AD (OIDC) setup copied the wrong values. Split that step by the two dialog types, map the Entra Application (client) ID and secret Value to the Docker Client ID and Client Secret fields, and explain why the secret Value is not the Secret ID. Co-Authored-By: Claude Co-authored-by: Cursor --- .../authentication/single-sign-on/connect.md | 55 +++++++++++++++---- 1 file changed, 43 insertions(+), 12 deletions(-) diff --git a/content/manuals/security/authentication/single-sign-on/connect.md b/content/manuals/security/authentication/single-sign-on/connect.md index f891d6ef2fd..0f800d0e6f1 100644 --- a/content/manuals/security/authentication/single-sign-on/connect.md +++ b/content/manuals/security/authentication/single-sign-on/connect.md @@ -117,15 +117,34 @@ hours. Docker automatically checks for the record during this time. 1. From [app.docker.com](https://app.docker.com), choose your organization. 1. Select **Identity & auth**, then **SSO and SCIM**. -1. Select **Create Connection**. Name the connection, then choose **SAML 2.0**. -1. Keep this window open. You need to copy and paste these values in your IdP - window: - - **Entity ID** - - **ACS URL** - - **Connection ID** +1. Select **Create Connection** and name the connection. -You will return here to finish connecting after creating an SSO connection in -your IdP. +The dialog offers two connection types. Select the type that matches the +identity provider tab you use in the next step. + +{{< tabs >}} +{{< tab name="SAML 2.0" >}} + +Use this type for the Okta SAML and Entra ID SAML 2.0 tabs. + +1. Select **SAML 2.0**. +1. Copy **Entity ID**, **ACS URL**, and **Connection ID**. For SAML + configuration, paste these values into your identity provider. + +{{< /tab >}} +{{< tab name="Azure AD (OIDC)" >}} + +Use this type for the Azure OpenID Connect (OIDC) tab. + +1. Select **Azure AD (OIDC)**. +1. Copy **Redirect URI**. For Azure AD configuration, paste the Redirect + URI, also called the **Reply URL**, into your identity provider. + +{{< /tab >}} +{{< /tabs >}} + +Keep this window open. You will return here to finish connecting after +creating an SSO connection in your IdP. ### Step 4: Create an SSO connection in your IdP @@ -192,13 +211,25 @@ permissions. 1. Name the application "Docker". 1. Set account types and paste the **Redirect URI** from Docker. 1. Select **Register**. -1. Copy the **Client ID**. +1. On the app registration **Overview** page, copy **Application (client) + ID**. This value is the Docker **Client ID**. #### Create client secrets 1. In your app, go to **Certificates & secrets**. 1. Select **New client secret**, describe and configure duration, then **Add**. -1. Copy the **value** of the new secret. +1. Copy the secret **Value**, not the **Secret ID**. The **Value** is the + Docker **Client Secret**. + + **Value** is the secret string Entra generated. Docker uses it when someone + signs in with this connection. Entra shows the **Value** on this screen + only. If you leave the page or refresh it, the column is blank. Create a + new secret and copy its **Value** before you leave. + + **Secret ID** is the identifier for that row. It stays visible so you can + tell two secrets apart, see which secret is about to expire, or delete a + specific one. Entra does not accept the **Secret ID** as the **Client + Secret**. #### Set API permissions @@ -251,8 +282,8 @@ Complete the integration by pasting your IdP values into Docker. 1. Return to Docker Home. 1. Paste the following values: - - **Client ID** - - **Client Secret** + - **Client ID**: the **Application (client) ID** you copied + - **Client Secret**: the secret **Value** you copied - **Azure AD Domain** 1. Optional. Select a default team, if required by your org. 1. Review and select **Create connection**. From 11daff5bebcd3898c81aec7fe7023ec378ae155a Mon Sep 17 00:00:00 2001 From: Alexa Date: Mon, 12 Oct 2026 13:26:40 -0500 Subject: [PATCH 2/2] docs: explain the Entra application-not-found SSO error Readers who paste the Entra Secret ID into Docker Client ID get AADSTS700016, and the troubleshooting page had no entry for that error. Add the error, the Client ID cause, and the steps to replace it with Application (client) ID. Co-Authored-By: Claude Co-authored-by: Cursor --- .../single-sign-on/troubleshoot-sso.md | 42 ++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md b/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md index 2e8833d1f98..258d7ed4358 100644 --- a/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md +++ b/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md @@ -7,7 +7,7 @@ description: >- weight: 40 keywords: sso troubleshooting, single sign-on errors, authentication issues, identity provider problems, JIT provisioning, SCIM errors, domain - verification + verification, AADSTS700016 tags: [Troubleshooting] toc_max: 2 aliases: @@ -297,3 +297,43 @@ In your IdP, ensure the Name ID attribute format is correct: 1. Verify that the Name ID attribute format in your IdP is set to `EmailAddress`. 1. Adjust your IdP settings to return the correct Name ID format. + +## Application was not found in the directory + +### Error message + +During Azure AD (OIDC) sign-in, Microsoft Entra can return: + +```text +AADSTS700016: Application with identifier '{identifier}' was not found in the directory '{directory}'. +``` + +### Causes + +The **Client ID** on the Docker SSO connection is not the **Application +(client) ID** from the app registration **Overview** page. Pasting the +**Secret ID** into **Client ID** makes Entra search for an application that +does not exist. + +Entra also returns this error when the sign-in request goes to a directory +that does not contain the app registration. + +### Solutions + +Replace the application identifier in Docker: + +1. In the [Microsoft Entra admin center](https://entra.microsoft.com/), open + the app registration. +1. On the **Overview** page, copy **Application (client) ID**. +1. Sign in to [Docker Home](https://app.docker.com/) and select your + organization. +1. Select **Identity & auth**, then **SSO and SCIM**. +1. In the SSO connections table, select the **Action** menu, then **Edit + connection**. +1. Paste **Application (client) ID** into **Client ID**. The **Secret ID** + and the secret **Value** are not application identifiers. + +If the directory named in the error is not the tenant where you registered +the app, update **Azure AD Domain** on the Docker connection so sign-in uses +that tenant. For the connection steps, see +[Set up single sign-on](/manuals/security/authentication/single-sign-on/connect.md).