All Products
Search

This Product

    Resource Access Management:Use Alibaba Cloud IDaaS to synchronize account data from DingTalk, WeCom, Lark, AD, and other sources to Alibaba Cloud RAM

    Document Center

    Resource Access Management:Use Alibaba Cloud IDaaS to synchronize account data from DingTalk, WeCom, Lark, AD, and other sources to Alibaba Cloud RAM

    Last Updated:Oct 23, 2026

    Alibaba Cloud IDaaS supports System for Cross-domain Identity Management (SCIM) synchronization. With IDaaS, you can synchronize your enterprise's existing account data, such as DingTalk, Lark, and AD, to Resource Access Management (RAM). For more information, see Identity Providers. This topic uses AD as an example to describe how to synchronize accounts to RAM by using SCIM.

    Step 1: Activate an IDaaS instance

    1. Log on to the Alibaba Cloud IDaaS management console. You can also use the product and service navigation pane to find Application Identity Service and click it to open the Application Identity Service management console.

    2. Click Create an instance for free.

      In the Application Identity Service console, in the left-side navigation pane, choose EIAM, and then click the IDaaS tab.

    Step 2: Synchronize AD data to IDaaS

    This topic uses AD as an example. Select the appropriate option based on your enterprise's actual requirements:

    Note

    If you need to sign in using AD authentication, make sure that delegated authentication is enabled. For more information, see Log on to third-party applications by using AD/LDAP authentication.

    After synchronization is complete, you can view the synchronized accounts on the Accounts page.

    Step 3: Synchronize data from IDaaS to RAM

    After you import your existing account data into IDaaS, you can synchronize the imported accounts to RAM by using the SCIM protocol. For the integration procedure, see Synchronize accounts to RAM by using SCIM.

    Step 1: Create and authorize an OAuth application in the RAM console

    1. Create an OAuth application.

      1. Log on to the RAM console.

      2. In the left-side navigation pane, choose Integrations > OAuth (Preview).

      3. On the Enterprise Applications tab, click Create Application.

      4. On the Create Application page, set the application parameters.

        1. Enter an Application Name and a Display Name.

        2. For Application Type, select Native Application.

        3. Set the Access Token Validity Period.

        4. Set the Refresh Token Validity Period.

      5. Click Create Application.

    2. Authorize the application scope.

      1. On the Enterprise Applications tab, click the name of the target application.

      2. On the OAuth Scope tab, click Add OAuth Scopes.

      3. In the Add OAuth Scopes panel, select /acs/scim.

      4. Click OK.

    3. Create an application secret.

      1. Click the App Secrets tab and then click Create Secret.

      2. In the Create Secret dialog box, view and copy the application secret, and then click close.

        Important

        The application secret (AppSecretValue) is displayed only once. Copy and store it securely, because it cannot be retrieved later.

    Step 2: Configure SCIM synchronization in IDaaS

    In the left-side navigation pane, choose Applications to go to the SCIM API configuration page. The egress IP address displayed at the top of the page is 112.124.239.96/27. In SCIM Base URL, enter the SCIM service address, such as https://scim.alibabacloud.com. For API Authorization, select OAuth 2.0 Client Credentials. In Token Endpoint, enter the token URL, such as https://oauth.aliyun.com/v1/token. For Authentication Method, select client_secret_basic, and enter the corresponding client_id and client_secret. In the Enabled Operations section, select Create Account (CREATE /Users), and then click Save.

    Step 3: Synchronize the accounts

    Click Push Now to synchronize the accounts within the synchronization scope to RAM.

    On the synchronization configuration page, make sure that the Enabled Operations section has Create Account CREATE /Users, Update Account UPDATE /Users, and Delete Account DELETE /Users selected, and that the Full Push Scope section has Account selected.