Identity as a Service:Connect to Feishu

Process overview

Connecting Feishu to IDaaS takes four steps:

1. Configure application permissions: Configure the required permissions for your application on the Feishu Open Platform so that it can access the data and features that you need.

2. Configure development settings: Complete development-related configuration in the IDaaS console, such as the callback URL and application credentials.

3. Select scenarios: Select the integration scenarios and authentication methods that suit your business needs.

4. Configure field mapping: Map Feishu user attributes to IDaaS user attributes so that user data synchronizes correctly.

Use cases

After you connect Feishu, you can use the following capabilities.

Connect to Feishu

In the IdPs menu, click Other IdPs > Feishu to start the connection process.

Step 1: Configure application permissions

1. Create a Feishu application.

   1. Go to the Feishu Open Platform, log on to the developer console, and create a custom enterprise application.

   2. After the application is created, the Feishu application details page opens automatically. Click the Credentials & Basic Info menu to get the App ID and App Secret, and then enter them in IDaaS.

2. In IDaaS, enter the App ID and App Secret that you obtained.

3. On the Feishu application details page, click Permission Management > Enable Permissions. In the Contacts section, grant the following permissions. These are all read permissions on Contacts, which enable data synchronization and user logon. In the dialog box that appears, click the App Identity Permissions tenant_access_token tab. In the filter area on the left, select the Contacts category, select the required permissions, and then click Confirm and Enable Permissions. The following permissions are required:

   Permission	Permission value	Notes
   Obtain basic contact information	contact:contact.base:readonly	--
   Obtain user IDs	contact:user.employee_id:readonly	--
   Obtain basic department information	contact:department.base:readonly	--
   Obtain department organizational structure information from Contacts	contact:department.organize:readonly	After you apply for this permission, you must submit a version release application. The permission takes effect only after the application is approved.
   Obtain basic user information	contact:user.base:readonly	--
   Obtain user organizational structure information	contact:user.department:readonly	After you apply for this permission, you must submit a version release application. The permission takes effect only after the application is approved.
   Obtain user email address information	contact:user.email:readonly	This permission is optional. Enable it only if you want to synchronize this field to IDaaS.
   Obtain user mobile phone numbers	contact:user.phone:readonly	After you apply for this permission, you must submit a version release application. The permission takes effect only after the application is approved. This permission is optional. Enable it only if you want to synchronize this field to IDaaS.

   Note

   After you submit the release application, Feishu notifies the administrators, who must review it in the Feishu Admin Console.

4. Enable Feishu data permissions.

   1. In the Permission Management section, click Accessible Data Range to Configure the data permissions.

   2. Select permissions based on your requirements. This scope determines which user and organization data can be synchronized to IDaaS and used for Feishu logon. Select Consistent with the Available Scope of the Application, and then click Save.

5. Submit in IDaaS. After you complete the preceding permission configuration, click Next in IDaaS. IDaaS then checks the API permissions and data permissions. After all required permissions are in place, you can proceed to the next step.

Step 2: Configure development settings

1. Enter basic information.

   1. Enter the Display Name.

   2. Enter the Enterprise ID. You can get the Enterprise ID from the Feishu Admin Console.

      In the left-side navigation pane of the Feishu Admin Console, choose Enterprise Management > Enterprise Overview. You can view the Enterprise ID (which starts with FE) below the enterprise name at the top of the page.

2. Configure development information.

   1. Redirect URL.

      1. View in IDaaS. This URL handles user logon requests. On the Development Information page in IDaaS, find the Redirect URL field and copy the two URLs displayed there.

      2. Configure in Feishu. In the Security Settings > Redirect URLs field of the Feishu application details, enter the URL, and then click Add.

   2. Application Homepage.

      1. View in IDaaS. On the Development Information page in IDaaS, find the Application Homepage field and copy the URL displayed there. Configure this homepage if you want users to log on to the IDaaS user portal from the Feishu workbench by using SSO.

      2. Configure in Feishu. In the Add Application Capability section of the Feishu application details, add Web Application. In the left-side navigation pane, click Add App Features. On the Add by Feature tab, find the Web App card and click the + Add button below it.

         After you add the feature, enter the URL in the desktop homepage and mobile homepage fields. On the web application configuration page, enter the Desktop Homepage and Mobile Homepage addresses. In the Open Method Configuration section, select Open in a New Tab in Feishu (recommended) or Open in Browser. Then, click Save.

   3. IP address allowlist.

      1. View in IDaaS. After you select Shared Endpoint or Dedicated Endpoint, the corresponding egress IP addresses are displayed below. Click Expand to view the complete IP address list. Click Copy in the Format Required by Feishu to copy the IP addresses and add them to the IP address allowlist in the security settings of your Feishu application.

         • Shared endpoint: A shared endpoint is the default network endpoint that an EIAM instance uses for network access. All EIAM instances share this endpoint. It supports access over the Internet only.

         • Dedicated endpoint: A dedicated endpoint is a network endpoint dedicated to your EIAM instance. With a dedicated endpoint, you can use dedicated IP addresses for Feishu data synchronization and delegated authentication. For more information about dedicated endpoints, see Network access endpoints.

      2. Configure in Feishu. To restrict network access by source IP address, copy the IDaaS egress IP address list and add it to the Application Security Settings > IP allowlist of your Feishu application by using Batch Modify.

Step 3: Select scenarios

Select the scenario capabilities that you want to use.

Capability descriptions

• Synchronization target: Select Alibaba Cloud IDaaS from the drop-down list. Feishu Contacts data is imported under this node in IDaaS.

• Scheduled verification: By default, IDaaS performs a full synchronization of Feishu data in the early morning every day to keep data consistent on both sides. Field mapping specifies the matching rules between IDaaS accounts and Feishu users, such as matching the account name to userid. If a match is found, the binding is updated. Otherwise, a new account is created. To synchronize data in real time, you can manually trigger a full synchronization task. A built-in protection mechanism automatically stops the synchronization when it detects that more than 30 accounts or 10 organizations would be deleted, which prevents accidental deletion. Adjust this threshold based on the size of your enterprise.

• Scheduled verification cycle: The synchronization cycle is set to once per day by default, and you can customize the time by using a cron expression. During synchronization, IDaaS uses a built-in protection mechanism that automatically stops the task when it detects many account or organization deletions, such as more than 30 accounts or 10 organizations, to prevent accidental deletion.

• Incremental synchronization: This feature is disabled by default and must be enabled manually after the connection is complete. Incremental synchronization cannot be enabled if event notifications are not configured. Adjust the related settings during the add or modify process to activate this feature.

  • On the Identity Providers page, find the Feishu application that you created and click Modify.

  • In the event configuration section, enter the Encrypt Key and Verification Token. You can get these values from Events and Callbacks > Encryption Strategy. After the modification, the Event Configuration page displays the Encrypt Key, Verification Token, and Request URL fields. The Add Event area below lists the subscribed events: contact.department.created_v3 (department created), contact.department.deleted_v3 (department deleted), contact.department.updated_v3 (department information changed), contact.user.created_v3 (employee onboarded), contact.user.deleted_v3 (employee offboarded), contact.user.updated_v3 (employee information changed), and contact.scope.updated_v3 (contact scope permissions updated).

  • Enter the Request URL in Events and Callbacks > Configure Event of the Feishu application details, and then enter this URL as the request address for sending events to the developer server. In the left-side navigation pane of the Feishu application details page, click Events and Callbacks and select the Event Configuration tab. For Subscription Method, confirm that “Send events to the developer server” is selected, and enter the server callback URL in the Request URL field.

• QR code logon: After this feature is enabled, the IDaaS logon page provides a Feishu QR code logon option, and users can scan the QR code to complete authentication. If the application homepage is also configured, users can access IDaaS from the Feishu workbench by using SSO, which improves convenience.

Step 4: Configure field mapping

If IDaaS already contains data and you need to bind Feishu members and departments to IDaaS accounts and organizations, configure field mapping in this step. Also configure field mapping if you want to use certain Feishu member fields as IDaaS account data, such as the Feishu user name as the display name of the IDaaS account.

Manage the Feishu identity provider

After the connection is complete, you are redirected to the IdPs menu, where you can manage the features that are integrated with the identity provider.