Connect Alibaba Cloud IDaaS to DingTalk for inbound provisioning to synchronize your organizational structure and users. The integration improves the efficiency and security of enterprise identity management.
Use cases
IDaaS uses the identity provider (IdP) concept to manage connections between IDaaS and the identity systems that your enterprise already uses. As an Alibaba Cloud product, DingTalk integrates natively with IDaaS. The connection process is simple: scan a QR code and grant authorization, and the connection is complete in 2 minutes. This configuration provides the following capabilities:
Category | Capabilities |
Accounts |
|
Logon |
|
Applications |
|
Two methods to connect to DingTalk
In the Identity Providers menu, add DingTalk as an identity provider in IDaaS and enable all related capabilities during the connection process.
To import data from DingTalk, IDaaS supports two methods:
Method | Description |
Third-party application method (quick connection to DingTalk) | Uses the DingTalk third-party enterprise application method. Scan a QR code and grant authorization to complete the configuration. Pros: minimal configuration and easy activation. Note You do not need to enter any information during the configuration. Scan the QR code and grant authorization to complete the entire setup. Cons: user mobile numbers and email addresses cannot be retrieved in bulk. An administrator must enter them, or users must grant authorization at logon. |
First-party application method (DingTalk advanced configuration) | Builds on the third-party application method. A DingTalk administrator must create a first-party DingTalk application, grant the required permissions, and configure the application information in IDaaS. Pros: flexible permissions and access to complete user information. Cons: longer configuration cycle. |
Quick connection to DingTalk
In the Quick Start or the IdPs menu, click Bind DingTalk to start the quick DingTalk connection process for inbound provisioning.
Step 1: Select features
In this step, select the features that you want to enable for DingTalk. If you have no preference, go directly to the next step.
Feature descriptions
Sync Target: the node in IDaaS under which the DingTalk address book data is imported.
Incremental Sync: after this feature is enabled, IDaaS calls the DingTalk API to listen for address book events. When the DingTalk address book changes, the changed data is synchronized to IDaaS in real time.
You can set a mapping identifier in field mapping to match a field of the IDaaS account, such as a mobile number, against a field of the DingTalk user, such as a mobile number. If a match is found, the existing account is overwritten with the updated data. Otherwise, an IDaaS account is created.
(Recommended) Run a full synchronization before you enable incremental synchronization. Otherwise, some data may fail to synchronize.
If a single account record fails to import, the import of the other records is not affected.
You can view failure details in Details.
DingTalk QR code logon: after you select this option, a logon method is created in the Login menu, named DingTalk QR code logon. The method is enabled, so users can log on directly by scanning the QR code.
Trigger a full sync: after you select this option, all data within the authorized scope of the DingTalk address book is imported after the connection is complete.
Step 2: Scan to activate
In this step, a DingTalk administrator scans the QR code to activate the free third-party application for the DingTalk enterprise.
The page displays a QR code and instructions. If the application is already activated, click Confirm application activated, Next to go directly to the scan-to-connect step.
After you scan the QR code in DingTalk, you are redirected to the application activation page to complete the activation. The activation has three steps: on the application details page, click Activate for Free; select the scope of use and click Activate Now; after activation succeeds, click Open Application to finish the connection.
After the connection is complete, to adjust the scope of the DingTalk address book that is synchronized to IDaaS, change the setting on the DingTalk Admin Console - Application Management page for the Alibaba Cloud IDaaS application. IDaaS uses the authorization scope of this application during synchronization.
Step 3: Scan to connect
In this final step, a DingTalk administrator clicks DingTalk Admin Scan to Bind in the application, scans the QR code in this step, and confirms the request. The connection is then complete. IDaaS runs a full or incremental synchronization based on your configuration, and DingTalk users can scan the QR code to log on to IDaaS.
Manage the DingTalk identity provider
After you connect DingTalk, you are automatically redirected to the IdPs menu, where you can manage the features that integrate with the identity provider. The management panel contains three feature areas: QR Scan Sign-In, Sync to IDaaS, and Advanced Configuration. You can enable or disable each area independently and use action entries such as View Logs, Trigger Sync, and Modify Configuration.
Check the import status
Import notification: if you selected Push/Pull Now during the connection, the page displays Importing.... Click Logs to go to Synchronization Tasks and check the progress.
Handle missing mobile numbers or email addresses: after the synchronization is complete, a notification appears on the IdPs page. The imported accounts can immediately use DingTalk QR code logon for IDaaS or its applications. However, newly imported accounts are missing mobile numbers or email addresses. Ask users to add a mobile number or an email address. Otherwise, features such as two-factor authentication and password recovery are unavailable. For more information, see Log on with a DingTalk QR code.
Modify the sync target: if you need to change the sync target, manually trigger a full synchronization after the change and verify that the organizational structure meets expectations.
DingTalk QR code logon: if you selected DingTalk Scan to Log On Version during the connection, IDaaS creates a DingTalk QR code logon method in the Login menu. You can manage this feature in the Identity Providers or the Login menu. Users can go to the logon page and log on by scanning the DingTalk QR code. For more information, see Log on with a DingTalk QR code.
Connect multiple DingTalk organizations: IDaaS supports connecting to multiple DingTalk address books. An administrator from each DingTalk enterprise completes the scan-to-activate process. When you manage multiple enterprises, you can synchronize the accounts of different enterprises to different target nodes to keep them separate. For example, to import the address books of DingTalk Enterprise A and Enterprise B into IDaaS for unified management, first create Organization A and Organization B under the root node of the IDaaS organizational structure. Then, when you connect DingTalk, specify that Enterprise A synchronizes to Organization A and Enterprise B synchronizes to Organization B. Conversely, one DingTalk enterprise can be connected to only one IDaaS instance. If you need to connect the same DingTalk enterprise to multiple IDaaS instances, wait for a future release.
Enable DingTalk advanced configuration
After you connect DingTalk, you can enable DingTalk advanced configuration on the identity provider page as needed. After advanced configuration is enabled, you can retrieve complete DingTalk user information.
If you use DingTalk Enterprise with the exclusive account feature enabled, IDaaS cannot retrieve the mobile numbers of exclusive accounts because of the security design of DingTalk Enterprise. To use mobile numbers, an administrator must add them in the console, or employees must add them manually in the application portal.
In the Advanced Configuration area on the right side of the identity provider management panel, click the Disabled toggle to enable advanced configuration.
Step 1: Select features
In this step, no configuration options are available yet. Go directly to the next step.
Step 2: Create an application
In this step, configure the application information from DingTalk in IDaaS. The page displays three configuration items: CorpId (pre-filled), AppKey, and AppSecret.
Log on to the DingTalk Open Platform - In-house Enterprise Development and click Add Application to enter the basic information for the in-house enterprise application.
In the Create an in-house enterprise application dialog box, set Application Type to H5 microapp, enter the Application Name and Application Description, set Development Mode to Enterprise Self-development, and then click Create.
After the application is created, you are automatically redirected to the application details page in DingTalk. Copy the AppKey and the AppSecret, and paste them into IDaaS in that order.
These credentials are in the Application Credentials area of the application details page.
After you complete the fields, click Complete Authorization. IDaaS tests the connection to DingTalk. If the information is correct, you can go to Next.
Step 3: Assign permissions
In this step, assign permissions in the current DingTalk application. Click Permission Management, select all permissions in both User Base Management and Application Management, and then click Batch Request.
For the permission scope, select All Employees. To adjust the scope of the DingTalk address book that is synchronized to IDaaS, change the setting on the DingTalk Admin Console - Application Management page, in the Alibaba Cloud IDaaS application. IDaaS uses the authorization scope of this application during synchronization.
After you grant authorization, click Confirm Authorization in IDaaS. IDaaS checks whether the application has the DingTalk address book management permission. If the check passes, the configuration is complete, and IDaaS can retrieve information such as employee mobile numbers and email addresses.
If you want only IDaaS to make requests to this DingTalk application, go to the Security Setting section of the DingTalk application page and enter the server egress IP address. You can enter multiple IP addresses separated by commas. The supported formats are IPv4, wildcard IPv4, IPv6, and IPv6 CIDR. Because this application is used mainly to synchronize data rather than for daily employee use, enter any address for the Application Homepage URL.
Step 4: Adjust field mapping (optional)
To use DingTalk mobile numbers and email addresses as the username or mobile number of an IDaaS account, or to bind a DingTalk user to an IDaaS account with the same mobile number, configure the rules in Field mapping.