Identity as a Service:Connect to DingTalk

Start the quick DingTalk binding

In the Quick Start or Identity Provider menu, click Bind DingTalk > Outbound to start the quick DingTalk binding - Outbound workflow. The binding wizard displays four configuration steps: Create Application, Assign Permissions, Select Scenario, and Field Mapping. Complete them in order.

Step 1: Create an application

1. Enter basic information.

   1. Display name: the name that users may see when they log on to and use IDaaS.

   2. CorpId: get it from the DingTalk Open Platform - Homepage. After you log on, the page displays the CorpId field and its value, which you can copy directly.

2. Enter application information.

   1. In DingTalk Open Platform - Internal Enterprise Development, click Create Application.

      Internal Enterprise Development page: the H5 Micro Application tab lists the existing applications. The Create Application button is in the upper-right corner.

   2. In Credentials and Basic Information, get AppKey and AppSecret. AppKey is displayed directly, and AppSecret is hidden by default. A Copy button appears to the right of each field.

3. Development information.

   You also need to enter the following information in DingTalk. Three fields and their values are displayed: Callback domain name, Application homepage URL, and Server Outbound IP. Each field has a Copy button on its right, so you can copy a value and enter it in the DingTalk configuration for that field.

   1. Callback domain name: enter it in . This field is used for DingTalk QR code login. If you leave it blank, users cannot log on to IDaaS by scanning a DingTalk QR code. The page provides a URL input box for the callback domain name. After you enter the value, click Save.

   2. Application homepage URL: enter it in Security Setting. After you configure this field, users can use single sign-on to access the IDaaS application portal when they click the application in the DingTalk console. You can set the visibility scope of the application in Version Management And Publishing. The procedure is similar to that for the callback domain name. On the Security Settings page, find the In-app Login-free Address input box, paste the application homepage URL, and then save it.

   3. Server Outbound IP: if you want to allow only IDaaS to request this DingTalk application, go to Security Setting on the DingTalk application page and fill in Outbound IP Address.

Step 2: Assign permissions

1. Assign permissions in the current DingTalk application. Click Permission Management, select all permissions under Personal Permissions, Address Book Management, and Application Management, and then click Batch Request. For the permission scope, select All Employees.

   Permission Management page: several permission category tabs appear at the top, and a grid below shows a check box for each permission item. Select the check boxes and click Batch Request to submit the requests together.

   Take the Personal Permissions tab as an example: after you select all permission items, all of them are displayed as selected. Select all permissions on the Address Book Management tab in the same way as on the Personal Permissions tab.

2. After authorization is complete, click Next in IDaaS. IDaaS then checks whether the application has the DingTalk address book management permission. If the check passes, the configuration is complete.

Step 3: Select a scenario

Capability description

• Synchronization direction: the IDaaS account and organization data of the selected synchronization source is imported under this DingTalk node. For the target node, enter the DingTalk department ID. You can find the ID when you edit a department in the DingTalk Admin Console. The ID of the DingTalk root department is 1 by default. The page also includes the Incremental synchronization and DingTalk QR code login toggle options, and an Organization/Account selector for the synchronization source.

• Incremental synchronization: after you enable it, changes to IDaaS account and organization data are synchronized to the DingTalk address book in real time. For accounts exported to DingTalk, IDaaS matches each account with a DingTalk user based on the Field Mapping setting, specifically the Mapping Identity. You can customize the matching rules in field mapping. If a match is found, the DingTalk user is overwritten; otherwise, an account is created.

• DingTalk QR code login: after you select it, the Login menu displays a new DingTalk QR Code Login entry. The entry is enabled, so users can log on directly by scanning the QR code.

Step 4: Field mapping

Configure field mapping in this step if DingTalk already has existing data and you need to bind IDaaS accounts and organizations to DingTalk users and departments. Field mapping is also required if you want to use certain IDaaS account data as DingTalk user data. For example, you can use the display name of an IDaaS account as the name of the DingTalk user. The configuration page lists field mapping in a table with four columns: Field name, Field identifier, IDaaS source field, and Mapping type.

1. By default, IDaaS supports customizing the values of DingTalk fields such as name, mobile phone number, email, position, and employee ID. To use other fields (for example, office location), click Add Field.

   • Field name: displayed and used in IDaaS only.

   • Field identifier: use the DingTalk field name. The identifier must be unique within the current identity provider. For example, the field identifier for office location is work_place. For more DingTalk fields, see All DingTalk user fields and All DingTalk department fields.

   For more information about field mapping, see Field mapping.

2. If you are sure that the field mapping configuration is correct, select Save and Push. IDaaS then runs a full synchronization to push the IDaaS data selected in Select Scenario to DingTalk. If you are not sure whether the field mapping configuration is correct, select Save Only and modify it later in Modify > Configure Field Mapping of the identity provider.