Skip to content

Fix issue #24065: add SSO certificate expiration workarounds #24446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dvdksn wants to merge 3 commits into
base: main
Choose a base branch
from
+13 −3
Open

Fix issue #24065: add SSO certificate expiration workarounds #24446

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6c528b9
Fix issue #24065: add SSO certificate expiration workarounds
dvdksn Mar 20, 2026
950b645
Fix style violation: remove marketing-style list formatting
dvdksn Mar 20, 2026
1bb657e
Revert package-lock.json to main
dvdksn Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions content/manuals/enterprise/security/single-sign-on/FAQs/idp-faqs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ description: Frequently asked questions about Docker SSO and identity provider c
keywords: identity providers, SSO IdP, SAML, Azure AD, Entra ID, certificate management
tags: [FAQ]
aliases:
- /single-sign-on/idp-faqs/
- /faq/security/single-sign-on/idp-faqs/
- /security/faqs/single-sign-on/idp-faqs/
- /single-sign-on/idp-faqs/
- /faq/security/single-sign-on/idp-faqs/
- /security/faqs/single-sign-on/idp-faqs/
---

## Can I use multiple identity providers with Docker SSO?
Expand All @@ -29,6 +29,16 @@ To turn on SSO in Docker, you need the following from your IdP:

If your certificate expires, contact your identity provider to retrieve a new X.509 certificate. Then update the certificate in the [SSO configuration settings](/manuals/enterprise/security/single-sign-on/manage.md#manage-sso-connections) in the Docker Admin Console.

### Workarounds if users are locked out
Copy link
Copy Markdown
Contributor

@docker-agent docker-agent bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent heading hierarchy

The subsection 'Workarounds if users are locked out' uses a level-3 heading (###) which is inconsistent with the FAQ page structure. All other content uses level-2 headings (##) for each FAQ question.

This makes the new section appear subordinate when it's actually a distinct set of workarounds that deserve equal visibility. Consider making this a level-2 heading like the other FAQs.


If the certificate has already expired and users cannot access Docker Hub to update the certificate:

- Contact Docker Support to help you regain access to update the certificate
- Sign in with your Docker username and password to access the Admin Console (if SSO enforcement is not turned on)
- Maintain a dedicated administrator account (sometimes called a "break-glass" or "guest user" account) that is not subject to SSO for emergency access
Copy link
Copy Markdown
Contributor

@docker-agent docker-agent bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Misplaced content: preventive measure listed as lockout workaround

The bullet point 'Maintain a dedicated administrator account...' is a recommendation for future action, not a workaround for an existing lockout. This doesn't fit the subsection heading 'Workarounds if users are locked out'.

The first two bullets are appropriate reactive measures for an existing lockout. However, maintaining a break-glass account is preventive advice - you can't create this account after you're already locked out. This bullet belongs in a prevention/best practices section, not under emergency workarounds.

The following sentence about monitoring certificates is correctly placed as prevention advice, but mixing prevention with workarounds creates confusion about when to take each action.


To prevent lockouts, monitor your certificate expiration dates and renew certificates before they expire.

## What happens if my IdP goes down when SSO is turned on?

If SSO is enforced, users can't access Docker Hub when your IdP is down. Users can still access Docker Hub images from the CLI using personal access tokens.
Expand Down