All Products
Search

This Product

    Identity as a Service:CreateIdentityProvider

    Document Center

    Identity as a Service:CreateIdentityProvider

    Last Updated:Jan 23, 2026

    Creates an identity provider (IdP).

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    eiam:CreateIdentityProvider

    create

    *IdentityProvider

    acs:eiam:{#regionId}:{#accountId}:instance/{#InstanceId}/identityprovider/*

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    InstanceId

    string

    Yes

    The instance ID.

    idaas_ue2jvisn35ea5lmthk267xxxxx
    IdentityProviderName

    string

    Yes

    The name of the IdP.

    test
    IdentityProviderType

    string

    Yes

    The synchronization type of the IdP.

    • Inbound DingTalk: urn:alibaba:idaas:idp:alibaba:dingtalk:pull

    • Outbound DingTalk: urn:alibaba:idaas:idp:alibaba:dingtalk:push

    • Inbound WeCom: urn:alibaba:idaas:idp:tencent:wecom:pull

    • Inbound Lark: urn:alibaba:idaas:idp:bytedance:lark:pull

    • Inbound AD: urn:alibaba:idaas:idp:microsoft:ad:pull

    • Inbound LDAP: urn:alibaba:idaas:idp:unknown:ldap:pull

    • Standard OIDC: urn:alibaba:idaas:idp:standard:oidc

    • SASE-specific OIDC: urn:alibaba:idaas:idp:alibaba:sase

    urn:alibaba:idaas:idp:alibaba:dingtalk:push
    UdPushConfig

    object

    No

    The outbound synchronization configurations.

    IncrementalCallbackStatus

    string

    No

    The status of incremental callbacks. This parameter is not yet available. Ignore this parameter.

    disabled
    PeriodicSyncStatus

    string

    No

    The status of scheduled synchronization. This parameter is not yet available. Ignore this parameter.

    disabled
    UdSyncScopeConfigs

    array<object>

    No

    The outbound synchronization configurations.

    object

    No

    SourceScopes

    array

    No

    The list of source nodes for synchronization.

    string

    No

    The source node for synchronization. Enter the organization ID.

    ou_lyhyy6p7yf7mdrdiq5xxxx
    TargetScope

    string

    No

    The target node for synchronization.

    ou_lyhyy6p7yf7mdrdiq5xxxx
    PeriodicSyncConfig

    object

    No

    The scheduled synchronization configurations.

    PeriodicSyncType

    string

    No

    The type.

    Valid values:

    • cron :

      cron

    • time :

      time

    cron

    PeriodicSyncCron

    string

    No

    The cron expression.

    0 45 1 * * ?

    PeriodicSyncTimes

    array

    No

    The time points when the task is run.

    integer

    No

    A time point when the task is run.

    3
    UdPullConfig

    object

    No

    The inbound synchronization configurations.

    GroupSyncStatus

    string

    No

    Specifies whether to synchronize groups. Default value: disabled. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    disabled
    IncrementalCallbackStatus

    string

    No

    The status of incremental callbacks. This parameter specifies whether to process incremental callback data from the IdP. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    disabled
    PeriodicSyncStatus

    string

    No

    The status of scheduled synchronization. This parameter specifies whether to periodically check for data differences between IDaaS and the IdP. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    disabled
    UdSyncScopeConfig

    object

    No

    The synchronization scope configurations.

    SourceScopes

    array

    No

    The list of source nodes for synchronization.

    string

    No

    The source node for synchronization.

    ou_lyhyy6p7yf7mdrdiq5xxxx
    TargetScope

    string

    No

    The target node for synchronization. Enter the IDaaS organization ID.

    ou_lyhyy6p7yf7mdrdiq5xxxx
    PeriodicSyncConfig

    object

    No

    The periodic validation configuration.

    PeriodicSyncType

    string

    No

    The type.

    cron
    PeriodicSyncCron

    string

    No

    The cron expression.

    0 45 1 * * ?
    PeriodicSyncTimes

    array

    No

    The time points when the task is run.

    integer

    No

    A time point when the task is run.

    3
    AuthnConfig

    object

    No

    The authentication configurations.

    AuthnStatus

    string

    No

    Specifies whether the IdP supports authentication. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    enabled
    AutoUpdatePasswordStatus

    string

    No

    Specifies whether to automatically update passwords. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    enabled
    BindingConfig

    object

    No

    The account binding rule configurations for the OIDC IdP.

    AutoMatchUserProfileExpressions

    array<object>

    No

    The list of rules for automatically matching accounts.

    object

    No

    ExpressionMappingType

    string

    No

    The type of the expression. Valid values:

    • Field: field

    • Expression: expression

    filed
    SourceValueExpression

    string

    No

    The expression for the value of the mapped property.

    idpUser.phoneNumber
    TargetField

    string

    No

    The name of the target mapped property.

    user.username
    TargetFieldDescription

    string

    No

    The name of the target mapped property.

    用户名称
    AutoMatchUserStatus

    string

    No

    Specifies whether to automatically match accounts. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    disabled
    MappingBindingStatus

    string

    No

    Specifies whether to allow users to manually bind accounts. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    enabled
    DingtalkAppConfig

    object

    No

    The DingTalk configurations.

    AppKey

    string

    No

    The AppKey of the enterprise-internal DingTalk application.

    Xczngvfemo4e
    AppSecret

    string

    No

    The AppSecret of the enterprise-internal DingTalk application.

    5d405a12a6f84ad4ab05ee09axxxx
    CorpId

    string

    No

    The CorpId of the enterprise-internal DingTalk application.

    307568042478613xxxx
    DingtalkVersion

    string

    No

    The DingTalk version. Valid values:

    • Standard DingTalk: public_dingtalk

    • Proprietary DingTalk: private_dingtalk

    public_dingtalk
    EncryptKey

    string

    No

    The EncryptKey of the DingTalk application.

    VkdWw91mdkrjVFr3ObNwefap21dfxxxx
    VerificationToken

    string

    No

    The VerificationToken of the DingTalk application.

    myDingApp_VerifyTokenxxxxx
    LdapConfig

    object

    No

    The AD/LDAP configurations.

    AdministratorPassword

    string

    No

    The administrator password.

    xxxx
    AdministratorUsername

    string

    No

    The administrator account.

    DC=example,DC=com
    CertificateFingerprintStatus

    string

    No

    Specifies whether to authenticate the certificate fingerprint. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    enabled
    CertificateFingerprints

    array

    No

    The list of certificate fingerprints.

    string

    No

    The SHA-256 fingerprint of the public key certificate.

    asdasd2221asdawqeda
    GroupMemberAttributeName

    string

    No

    The identifier for group members.

    member
    GroupObjectClass

    string

    No

    The objectClass for groups.

    group
    GroupObjectClassCustomFilter

    string

    No

    The custom filter for groups.

    (|(cn=test)(group=test@test.com))
    LdapProtocol

    string

    No

    The communication protocol.

    ldap
    LdapServerHost

    string

    No

    The address of the AD/LDAP server.

    123.xx.xx.89
    LdapServerPort

    integer

    No

    The port number of the AD/LDAP server.

    636
    OrganizationUnitObjectClass

    string

    No

    The objectClass for organizations.

    organizationUnit,top
    StartTlsStatus

    string

    No

    Specifies whether to enable StartTLS. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    enabled
    UserLoginIdentifier

    string

    No

    The user logon identifier.

    userPrincipalName, mail
    UserObjectClass

    string

    No

    The objectClass for users.

    person,user
    UserObjectClassCustomFilter

    string

    No

    The custom filter for users.

    (|(cn=test)(mail=test@test.com))
    PasswordSyncStatus

    string

    No

    Specifies whether to enable password synchronization. Valid values: enabled and disabled.

    enabled
    UserRdn

    string

    No

    The relative distinguished name (RDN) of the user.

    cn
    OrganizationalUnitRdn

    string

    No

    The RDN of the organization.

    ou
    WeComConfig

    object

    No

    The WeCom configurations.

    AgentId

    string

    No

    The agent ID of the custom WeCom application.

    278231941749863339
    AuthorizeCallbackDomain

    string

    No

    The authorization callback domain.

    https://xxx.aliyunidaas.com/xxxx
    CorpId

    string

    No

    The CorpId of the custom WeCom application.

    3756043633237690761
    CorpSecret

    string

    No

    The CorpSecret of the custom WeCom application.

    CSEHDddddddxxxxuxkJEHPveWRXBGqVqRsxxxx
    TrustableDomain

    string

    No

    The trusted domain name.

    https://xxx.aliyunidaas.com/
    OidcConfig

    object

    No

    The OIDC IdP configurations.

    AuthnParam

    object

    No

    The OIDC client authentication configurations.

    AuthnMethod

    string

    No

    The OIDC authentication method. Valid values:

    • client_secret_basic

    • client_secret_post

    client_secret_post
    ClientId

    string

    No

    The OIDC client ID.

    mkv7rgt4d7i4u7zqtzev2mxxxx
    ClientSecret

    string

    No

    The OIDC client secret.

    CSEHDddddddxxxxuxkJEHPveWRXBGqVqRsxxxx
    EndpointConfig

    object

    No

    The OIDC endpoint configurations.

    AuthorizationEndpoint

    string

    No

    The OIDC authorization endpoint.

    https://example.com/auth/authorize
    Issuer

    string

    No

    The OIDC issuer.

    https://example.com/auth
    JwksUri

    string

    No

    The OIDC JSON Web Key Set (JWKS) URI.

    https://example.com/auth/jwks
    TokenEndpoint

    string

    No

    The OIDC token endpoint.

    https://example.com/auth/token
    UserinfoEndpoint

    string

    No

    The OIDC user information endpoint.

    https://example.com/auth/userinfo
    GrantScopes

    array

    No

    The collection of OIDC authorization scopes.

    openid

    string

    No

    The OIDC authorization scope. The value can be an organization ID or a group ID.

    ou_lyhyy6p7yf7mdrdiq5xxxx
    GrantType

    string

    No

    The OIDC grant type.

    authorization_code
    PkceChallengeMethod

    string

    No

    The PKCE algorithm. Valid values:

    • SHA256: S256

    • Plaintext: plain

    S256
    PkceRequired

    boolean

    No

    Specifies whether to use Proof Key for Code Exchange (PKCE) in authorization code flow.

    true
    NetworkAccessEndpointId

    string

    No

    The ID of the network access endpoint.

    nae_examplexxxx
    AutoCreateUserConfig

    object

    No

    The configurations of the rule for automatically creating accounts.

    AutoCreateUserStatus

    string

    No

    Specifies whether to automatically create accounts. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    disabled
    TargetOrganizationalUnitIds

    array

    No

    The IDs of target organizations.

    string

    No

    The ID of the target organization.

    ou_lyhyy6p7yf7mdrdiq5xxxx
    AutoUpdateUserConfig

    object

    No

    The configurations of the rule for automatically updating accounts.

    AutoUpdateUserStatus

    string

    No

    Specifies whether to automatically update accounts. Valid values:

    • disabled: The feature is disabled.

    • enabled: The feature is enabled.

    disabled
    LarkConfig

    object

    No

    The Lark configurations.

    AppId

    string

    No

    The AppId of the Lark application.

    cli_xxxx
    AppSecret

    string

    No

    The secret of the Lark application.

    KiiLzh5Dueh4wbLxxxx
    EnterpriseNumber

    string

    No

    The enterprise code for Lark.

    FSX123111xxx
    EncryptKey

    string

    No

    The EncryptKey of the custom Lark application.

    VkdWw91mdkrjVFr3ObNwefap21dfxxxx
    VerificationToken

    string

    No

    The VerificationToken of the custom Lark application.

    feishuVerifyTokenxxxxx
    LogoUrl

    string

    No

    The URL of the application logo.

    xxxx-image://xxxx_23aqr2ye554csg33dqpch5eu3q/tmp/d17d9adc-a943-45e7-ba0c-2838dddea678

    ClientToken

    string

    No

    A client token used to ensure the idempotence of the request. Generate a unique value for this parameter from your client. The token can contain only ASCII characters. Note: If you do not specify this parameter, the system automatically uses the request ID as the client token. The request ID may be different for each request.

    clientToken_20250704_Axxxxx

    Response elements

    Element

    Type

    Description

    Example

    object

    The response parameters.

    RequestId

    string

    The request ID.

    0441BD79-92F3-53AA-8657-F8CE4A2B912A
    IdentityProviderId

    string

    The ID of the IdP.

    idp_mwpcwnhrimlr2horxXXXX

    Examples

    Success response

    JSON format

    {
  "RequestId": "0441BD79-92F3-53AA-8657-F8CE4A2B912A",
  "IdentityProviderId": "idp_mwpcwnhrimlr2horxXXXX"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 InvalidParameter.OidcIssuer OidcIssuer format check failed, it must be an address that starts with http or https. OidcIssuer format check failed, it must be an address that starts with http or https.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.