Docker SCIM provisioning from Google Workspace

Docker supports SCIM on Docker Business, on top of an SSO connection. When you enable SCIM on the connection, Docker Home shows a SCIM base URL and an API token. AnySCIM uses them to add people from Google Workspace to your Docker organization, keep their names in sync and deactivate their Docker accounts when they leave.

Requirements

• A Docker Business subscription.
• An SSO connection in Docker Home with your email domain verified. Docker supports any SAML 2.0 or OIDC identity provider, so Google Workspace can be the identity provider through a custom SAML app.
• Administrator access to Docker Home.

Enable SCIM in Docker

1. Sign in to Docker Home and open Identity & auth → SSO and SCIM.
2. In the SSO connections table, open the Actions menu for your connection and choose Enable SCIM, then confirm.
3. Copy the SCIM Base URL and the API Token. To see them again later, choose Actions → Edit SCIM.

Connect Docker in AnySCIM

1. Open Connections → New connection and choose Docker.
2. Paste the SCIM Base URL and the API Token from Docker Home, then click Test connection.
3. In Scope, select the people who should be Docker members, for example your engineering groups. Leave Push group membership off: AnySCIM manages Docker members, and you keep managing teams in Docker.
4. Review the dry-run and activate.

How users are synced

• New users in scope are added to the organization of the SSO connection, matched by email: Docker uses the primary email as the SCIM userName. An existing Docker account with the same email is linked, not duplicated.
• New members get the member role. AnySCIM doesn't send Docker's dockerRole, dockerOrg or dockerTeam attributes, so change roles and teams in Docker.
• First and last name changes are pushed with PATCH.
• When a Google user is suspended, AnySCIM sets active: false and Docker deactivates the account. If the user comes back into scope, it's reactivated.

Troubleshooting

• Members outside SCIM: only members whose email domain is verified on the SSO connection are managed through SCIM. Verify every domain you use in Google Workspace.
• Names or teams keep changing back: Docker turns on just-in-time (JIT) provisioning by default when you set up SSO, and JIT and SCIM can overwrite each other. Docker recommends a single provisioning source: once the AnySCIM connection works, turn JIT off.
• Can't disable SCIM: Docker only lets you disable SCIM while JIT provisioning is on. Turn JIT back on first.

FAQ

Which Docker plan supports SCIM?

Docker Business. SSO and SCIM are both Business features, and SCIM runs on top of an existing SSO connection.

Does Docker SCIM work with Google Workspace?

Yes. Docker accepts any SAML 2.0 or OIDC identity provider for SSO, and its SCIM endpoint works with any SCIM client. AnySCIM connects Google Workspace to it.

What happens to a Docker account when someone leaves?

When their Google account is suspended, AnySCIM sends active: false and Docker deactivates the account. Docker reactivates it if the person is provisioned again later.