Synchronize accounts from DingTalk, WeCom, Lark, and AD to RAM using IDaaS - Resource Access Management

Alibaba Cloud IDaaS supports System for Cross-domain Identity Management (SCIM) synchronization. You can synchronize accounts from corporate identity providers, such as DingTalk, Lark, and AD, to Resource Access Management (RAM). For more information, see identity providers. This topic uses AD as an example to describe how to synchronize accounts to RAM by using SCIM.

Step 1: Activate an IDaaS instance

Go to the Alibaba Cloud IDaaS management console. Alternatively, in the product and service navigation pane, find and click Application Identity Service.
Click Create an instance for free.

In the left-side navigation pane of the Application Identity Service console, choose EIAM, and then click the IDaaS tab.

Step 2: Synchronize AD data to IDaaS

AD is used as an example in this topic. Select the option that matches your scenario:

To synchronize DingTalk accounts to IDaaS, see Bind DingTalk - Inbound.
To synchronize WeCom accounts to IDaaS, see Bind WeCom.
To synchronize Lark accounts to IDaaS, see Bind Lark.
To synchronize AD accounts to IDaaS, see Bind AD - Inbound.
To synchronize OpenLDAP accounts to IDaaS, see Bind OpenLDAP - Inbound.
To synchronize accounts from international identity providers such as Okta or Azure to IDaaS, see Bind an OIDC identity provider.

Note

If you need to log on by using AD authentication, make sure that the delegated authentication feature is enabled. For more information, see Use AD/LDAP authentication to log on to a third-party application.

After the synchronization is complete, you can view the synchronized accounts on the Accounts page.

Step 3: Synchronize data from IDaaS to RAM

After you import account data to IDaaS, you can synchronize it to RAM by using SCIM. For more information, see Synchronize accounts to RAM by using SCIM.

Step 1: Create and authorize an OAuth application

Create an OAuth application.
1. Log on to the RAM console.
2. In the left-side navigation pane, choose Integrations > OAuth (Preview).
3. On the Enterprise Applications tab, click Create Application.
4. On the Create Application page, set the application parameters.
  1. Enter an Application Name and a Display Name.
  2. For Application Type, select Native Application.
  3. Set the Access Token Validity Period.
  4. Set the Refresh Token Validity Period.
5. Click Create Application.
Authorize the application scope.
1. On the Enterprise Applications tab, click the name of the target application.
2. On the OAuth Scope tab, click Add OAuth Scopes.
3. In the Add OAuth Scopes panel, select /acs/scim.
4. Click OK.
Create an application secret.
1. Click the App Secrets tab and then click Create Secret.
2. In the Create Secret dialog box, view and copy the application secret, and then click close.
  
  Important
  The application secret (AppSecretValue) is displayed only once. Copy and store it securely, because it cannot be retrieved later.

Step 2: Configure SCIM synchronization in IDaaS

In the left-side navigation pane, choose Applications to go to the SCIM API configuration page. The egress IP address is displayed at the top of the page, such as 112.124.239.96/27. In the SCIM Base URL field, enter the SCIM service URL, such as https://scim.aliyun.com. For API Authorization, select OAuth 2.0 Client Credentials. In the token endpoint field, enter the token endpoint URL, such as https://oauth.aliyun.com/v1/token. For Authentication Method, select client_secret_basic, and enter the client_id and client_secret. In the Enabled Operations section, you can select Create Account (CREATE /Users). Then, click Save.

Step 3: Perform synchronization

Click Push Now to synchronize the accounts within the specified scope to RAM.

On the synchronization configuration page, confirm that Create Account (CREATE /Users), Update Account (UPDATE /Users), and Delete Account (DELETE /Users) are selected in the Enabled Operations section, and Account is selected in the Full Push Scope section.