Skip to content

docs: document OIDC connection limits by subscription #26367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
akristen merged 2 commits into from
Oct 16, 2026
Merged

docs: document OIDC connection limits by subscription #26367

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78abc5f
docs: document OIDC connection limits by subscription
akristen Oct 16, 2026
61fd207
docs: add Docker-Sponsored Open Source to OIDC connection limits
akristen Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions content/manuals/security/authentication/oidc-connections/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
title: OIDC connections overview
linkTitle: OIDC connections
description: Authenticate GitHub Actions to Docker with short-lived OpenID Connect tokens
keywords: oidc connections, openid connect, github actions, jwt, subject claims, rulesets, enterprise security, workload authentication
keywords: oidc connections, openid connect, github actions, jwt, subject claims, rulesets, connection limits, enterprise security, workload authentication
tags: [admin]
weight: 35
aliases:
Expand All @@ -20,8 +20,9 @@ vendor that can grant fine-grained access to your Docker resources.

OIDC connections follow the OpenID Connect (OIDC) standard. Establishing a
trust relationship involves creating the connection, configuring a
workflow, and testing. A connection, then, is the named trust relationship in Docker Home that workflows point to. For example, a trust relationship between Docker and
GitHub follows these steps:
workflow, and testing. A connection, then, is the named trust relationship
in Docker Home that workflows point to. For example, a trust relationship
between Docker and GitHub follows these steps:

- GitHub issues a JWT ID token for the workflow run.
- During authentication, Docker:
Expand All @@ -37,6 +38,25 @@ and issued on a per-workflow basis.
For how OIDC connections compare to organization access tokens, see
[Access tokens](/manuals/security/access-tokens/_index.md).

## Connection limits

The number of OIDC connections an organization can have depends on its
subscription:

| Subscription | Maximum OIDC connections |
| :----------- | :----------------------- |
| Team | 10 |
Comment thread
akristen marked this conversation as resolved.
| [Docker-Sponsored Open Source](/manuals/docker-hub/repos/manage/trusted-content/dsos-program.md) | 10 |
| Business | 100 |

Active and deactivated connections count toward the limit, but deleted
connections don't. When your organization reaches the limit, the
**Create OIDC connection** button is disabled. To create another
connection, delete one you no longer need.

Each connection can have up to five rulesets. See
[Rulesets](/manuals/security/authentication/oidc-connections/rulesets-claims.md#rulesets).

## Next steps

- [Create an OIDC connection](/manuals/security/authentication/oidc-connections/create-manage.md)
Expand Down
4 changes: 3 additions & 1 deletion content/manuals/security/authentication/oidc-connections/rulesets-claims.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,9 @@ Each ruleset has these fields:

You can add one to five rulesets on a connection. If more than one
ruleset matches a token, Docker grants the union of their resources and
scopes.
scopes. Your subscription also limits how many connections your
organization can have. See
[Connection limits](/manuals/security/authentication/oidc-connections/_index.md#connection-limits).

## Subject claims

Expand Down