Identity as a Service:Connect to WeCom

Step 1: Create an application

1. Create on the WeCom side.

   1. Create a self-built application in WeCom

      Log on to the WeCom admin console, and in App Management > App, create a self-built application.

   2. Configure application information

      Upload an App Logo, enter an App Name and an App Description (Optional), and select the Visible To scope based on your requirements. The visible scope is the contacts that IDaaS EIAM is authorized to access for data synchronization and logon. Return to the application management page.

   3. View the created application

      Return to the application management page. The application that you created appears in the Self-built section.

2. Create on the IDaaS side.

   1. Start the WeCom integration process in the IDaaS console

      Log on to the Alibaba Cloud IDaaS console and select your IDaaS instance. In the IdPs menu, click Other IdPs > WeCom to start the integration process.

      Important

      If no dedicated endpoint is available for the current instance, you must add one first. For more information, see Add a dedicated endpoint.

   2. Enter basic information

      Enter the Display Name and the Enterprise ID.

      • Display Name: Users may see this name when they log on to or use IDaaS EIAM.

      • Enterprise ID: Log onto the WeCom admin console. Go to My Enterprise > Enterprise to get the Enterprise ID.

   3. Enter application information

      Enter the application information: AgentId and Secret.

      1. In the WeCom admin console, get the application information from the self-built application on the application details page under Application Management > Applications.

      2. In the Secret section of the application details page, click View.

      3. After you confirm sending in the dialog box, you can view the secret as prompted in the WeCom Team message.

   4. Enter development information

      Note

      The following steps use a self-provided domain name as an example. If you select a custom domain name, go to Branding > Custom Domain Name > Add Custom Domain Name in your IDaaS EIAM instance to complete the custom domain name configuration.

      1. Trusted Domain Name.

         Domain Name Type affects the WeCom capabilities that you can use and how the development information below is generated. The differences between the domain name types are as follows:

         Category	Self-provided domain name	Custom domain name
         Feature differences	Supports only non-sensitive data synchronization and QR code logon.	In addition to non-sensitive data synchronization and QR code logon, also supports sensitive data synchronization and web authorization logon, that is, SSO from the WeCom workbench.
         Configuration differences	Prepare a dedicated domain name as the trusted domain name. The owner of this domain name must be the same as the authenticated entity in WeCom. This domain name has no business logic in IDaaS EIAM. The other addresses in the development information are generated by default.	Select an available Custom domains whose owner must be the same as the authenticated entity in WeCom. This domain name is used by all WeCom features and must remain stable and available. The other addresses in the development information are generated based on the custom domain name that you select.

         1. On the application details page in the WeCom admin console, click Set trusted domain.

         2. Enter the trusted domain name for the OAuth2 web authorization feature of the application.

            Note

            WeCom requires the configured trusted domain name to correspond to the corporate entity. The domain name is independent of the protocol header and URL path.

         3. After the verification passes, follow the WeCom instructions to complete domain ownership verification.

      2. Enterprise Trusted IP. Click the drop-down list and select a dedicated network endpoint.

         1. You must use the dedicated public network access of network endpoints (see Configure a dedicated public egress IP address) so that your IDaaS EIAM instance accesses WeCom by using your IP address.

         2. On the IDaaS EIAM configuration page, select the network endpoint and view the Dedicated Outbound Public IP Address.

         3. You can then see the public IP addresses that the instance can use. Click Copy All IP Addresses.

         4. In your application in the WeCom admin console, configure the copied IP addresses as the Enterprise Trusted IP.

         Important

         All WeCom APIs that IDaaS EIAM uses are called through trusted IP addresses. If the trusted IP addresses are configured incorrectly or are unavailable, all features, such as WeCom data synchronization and QR code logon, are affected. Because the verification logic of WeCom trusted IP addresses is not publicly disclosed, you should also retain other ways to log on to IDaaS, such as an account password or an SMS verification code.

      3. Authorization callback domain.

         1. On the Bind WeCom - Inbound configuration page, copy the authorization callback domain.

         2. In your application in the WeCom admin console, click ConfigurationWeCom Login Authorization.

         3. In the Webpage section, click Set authorization callback domain. Enter the authorization callback domain that you copied from the IDaaS configuration page.

            Note

            If Domain Name Type is set to Custom domain name, you must also set the application homepage URL (web page) on the application details page. This is the address that users are redirected to after SSO from the WeCom workbench.

      After you complete the preceding configurations, click Next to proceed to the Assign Permissions step.

Manage the WeCom identity provider

After the integration is complete, you are automatically redirected to the IdPs menu. In this menu, you can manage the different features that are linked with the identity provider.

Important notes