Drive and Photo Service:Configure DingTalk login

Step 1: Create a DingTalk internal application

1. Go to the DingTalk Open Platform and log in to your developer account.

2. In the top navigation bar, click Developer Console.

3. In the top navigation bar, click Application Development to go to the application list.

4. Click Create Application on the right, enter the application information, and then click Save.

5. After the application is created, its details page opens automatically.

Step 2: Configure redirect URL and permissions

1. Configure the redirect URL.

   In the left-side navigation pane of the application details page, choose Development Configuration > Security Settings and add a redirect URL.

   Important

   Replace domainId with your actual domainId.

   • The redirect URL format is https://domainId.api.aliyunpds.com/v2/oauth/callback.

   • If you have activated and configured a logon authentication domain name, the redirect URL format is https://www.example.com/v2/oauth/callback.

   • If you have activated a logon authentication domain name but have not configured the domain name, the redirect URL format is https://domainId.auth.aliyunpds.com/v2/oauth/callback.

   • If you are using a domain created before March 2, 2023, the redirect URL format is https://domainId.auth.aliyunpds.com/v2/oauth/callback.

2. Enable required permissions

   1. In the left-side navigation pane of the application details page, choose Development Configuration > Permissions.

   2. For Permission Scope, select All Employees or Part of Employees based on your needs.

      If you select Part of Employees, the number of authorized users must match the number of users to be synchronized to your drive.

   3. Two types of permissions are required:

      1. Address book personal information reading permission.

         On the permission management page, select Personal permissions from the list on the left and select the Address book personal information reading permission checkbox.

      2. All permissions for address book management.

         On the permission management page, select Address book management from the list on the left and select all permission checkboxes. Make sure to check all pages.

      3. After you select the permissions, click Batch Apply in the upper-right corner.

Step 3: Configure DingTalk login

1. Obtain the Client ID and Client Secret for your DingTalk application.

   1. In the left-side navigation pane of the application details page, choose Basic information > Voucher and basic information.

   2. From the Application Credentials section, copy and save the Client ID and Client Secret.

2. Configure DingTalk login in Drive and Photo Service (Developer Edition).

   1. In the Drive and Photo Service (Developer Edition) console, go to the domain list.

   2. Find the domain where you want to configure DingTalk login and click Details in the rightmost column.

   3. On the domain details page, select User Systems, click Configure, and open Configure PDS Logon Page.

   4. Turn on the Enable Logon by DingTalk switch. Enter the DingTalk Client ID in the AppID field and the DingTalk Client Secret in the AppSecret field. Click OK.

Step 4: Configure DingTalk sync

1. Log in to the Management Console of Drive and Photo Service (Developer Edition) with an administrator account.

2. In the left-side navigation pane, choose Exclusive Logon Configuration > DingTalk Configuration.

3. In the Synchronization settings section, click Edit.

4. Configure synchronization options.

   • If you do not need to enable DingTalk synchronization, skip this step. If you enable only the DingTalk login feature without configuring synchronization, any DingTalk user within your organization can log in to the corporate drive. The system automatically creates an account for them upon login, but without any organizational structure.

   • If you enable synchronization, you can import users and organizational structures from DingTalk. Follow these steps:

     On the synchronization settings page, turn on the Synchronization settings switch and configure the settings.

     Warning

     Exercise caution when you change the synchronization scope. After a change, users outside the new scope are disabled but not automatically deleted. If you later add a disabled user back into the scope, they are not automatically re-enabled. An administrator must manually enable them.

• Click Configuration Detection to check the number of departments and employees to be synchronized. If an error occurs, verify that you granted the required permissions in the previous step.

• For Synchronization Time Setting, select Manual synchronization or Automatic synchronization.

  • Manual synchronization: Manually syncs organizations or users to the drive. With manual sync, changes to the source data are not automatically reflected in the drive. You must run the synchronization again to apply updates. For example, if new employees are added to your organization, they cannot log in to the drive until a manual sync is performed.

  • Automatic synchronization: Syncs organizations or users to the drive at a specified frequency and time. You can set the frequency to daily, weekly, or monthly, and choose any hour of the day for the synchronization time.

• For Sync phone number/email, enable options as needed.

  • Enable sync phone number: Syncs the phone numbers of employees from DingTalk. After a successful sync, employees can use their phone numbers to log in.

  • Enable sync email: Syncs the email addresses of employees from DingTalk.

• View the import results.

  1. Click Sync now.

  2. After the synchronization is complete, the Import results are displayed. If an import fails, the Import results show the reason.

6. View the last synchronization information.

   In the Last synchronization information section, you can view the Last synchronization time and Last synchronization status. Click Details on the right for more information about the last synchronization.

Step 5: Log in with DingTalk

When you log in to Drive and Photo Service in a browser, the DingTalk login option appears below other login methods.