Secure Access Service Edge:Use IDaaS to synchronize DingTalk data to SASE

Process

Before you use SASE to manage the access permissions of DingTalk users, you must synchronize DingTalk data to IDaaS and connect your IDaaS identity provider (IdP) to SASE.

Step 1: Create a DingTalk application

To synchronize DingTalk data to SASE, you must create a DingTalk application in DingTalk Open Platform. After you create a DingTalk application, you can obtain the values of the AppKey and AppSecret parameters that are used for logon-free authentication.

1. Use the administrator account to log on to DingTalk Open Platform.

2. In the top navigation bar, click Application Development.

3. In the left-side navigation pane, click DingTalk Application. On the page that appears, click Create an application.

4. In the Create an application panel, configure the parameters. The following table describes the parameters.

   Parameter	Description	Example
   Application Name	The name of the application. The application name can contain letters and digits.	AlibabaCloudSASE
   Application Description	The description of the application.	AlibabaCloudSASE
   App Icon	The icon of the application. The uploaded icon image must meet the following requirements: JPG or PNG format, 240 × 240 pixels or higher, 1:1 aspect ratio, no greater than 2 MB in size, and no rounded corner.

5. Click save.

Step 2: Add an authentication source

You must add an authentication source to enable external authentication. This way, you can use DingTalk accounts to log on to the SASE client.

1. Use the administrator account to log on to the IDaaS console. On the EIAM > Legacy Version tab, click the ID of the instance that you created.

2. In the left-side navigation pane, choose Authentication > Authentication Sources.

3. In the upper-right corner of the Authentication Sources page, click Add DingTalk source.

4. On the page that appears, find DDTalk micro APP and click Add Authentication Source in the Actions column.

5. In the Add Authentication Source (DDTalk micro APP) panel, configure the parameters and click Submit. The following table describes the parameters.

   Parameter	Description	Example
   Name	The name of the authentication source. Retain the default value DDTalk micro APP.	DDTalk micro APP
   AgentID	You can obtain the value of the AgentID parameter from the Credentials and basic information page of the DingTalk application that you created in DingTalk Open Platform.	320543****
   CorpID	You can obtain the value of the CorpID parameter from the front page of DingTalk Open Platform.	ding191d0eb30a8aadf2ee0f45d8e4f7****
   AppKey	You can obtain the value of the AppKey parameter from the Credentials and basic information page of the DingTalk application that you created in DingTalk Open Platform.	ding191d0eb30a8aadf2ee0f45d8e4f7****
   AppSecret	You can obtain the value of the AppSecret parameter from the Credentials and basic information page of the DingTalk application that you created in DingTalk Open Platform.	7G2uP_iIvyQ8L4phZ1neu1bKpPQZT4B_s3xFD_EChpxJscqGiOopPIYuWXI5****

6. After you add the authentication source, go back to the Authentication Sources page and turn on the switch in the Status column to enable DDTalk micro APP.

Step 3: Configure and release the DingTalk application

After you add and enable the authentication source, you must perform the following operations to configure and release the DingTalk application.

1. Use the administrator account to log on to DingTalk Open Platform.

2. In the top navigation bar, click Application Development.

3. In the left-side navigation pane, click DingTalk Application.

4. On the DingTalk Application page, click the AlibabaCloudSASE application that you created.

5. In the left-side navigation pane, choose Development Configuration > Security Settings.

6. On the Security Settings page, configure the Server egress IP and In-terminal free address parameters.

   Note

   • You can contact the IDaaS service team to obtain the egress IP address of the IDaaS server.

   • You can obtain the homepage URL of the application from the Authentication Source Details panel of the added authentication source in the IDaaS console.

     For example, the homepage URL can be https://aliyundoc.com/api/public/bff/v1.2/authenticate/ddMicro/login?agentId={id}&appId={id}, where agentId indicates AgentId of the DingTalk application and appId indicates the ID of the Security Assertion Markup Language (SAML) application created in IDaaS. For more information, see Step 2: Create a SAML application and grant the permissions to access the application.

7. On the Version management and release page, click the corresponding button to release the application.

Step 4: Synchronize the DingTalk data

After the DingTalk application is released, you must perform the following operations to synchronize the DingTalk data.

1. Use the administrator account to log on to the IDaaS console. On the EIAM > Legacy Version tab, click the ID of the instance that you created.

2. Synchronize the DingTalk data.

   1. In the left-side navigation pane, choose Users > Organizations and Groups.

   2. On the OUs and Groups page, click Configure DingTalk.

   3. In the DDtalk sync configuration panel, click Create.

   4. Configure the parameters and click Save. The following table describes the parameters.

      Parameter	Description	Example
      ConfigName	Specify a name for the DingTalk synchronization configuration. The name can contain letters and digits.	SASEtest
      corpld	You can obtain the value of the corpld parameter from the front page of DingTalk Open Platform.	ding191d0eb30a8aadf2ee0f45d8e4f7****
      appKey	You can obtain the value of the appKey parameter from the Credentials and basic information page of the DingTalk application that you created in DingTalk Open Platform.	ding191d0eb30a8aadf2ee0f45d8e4f7****
      appSecret	You can obtain the value of the appSecret parameter from the Credentials and basic information page of the DingTalk application that you created in DingTalk Open Platform.	7G2uP_iIvyQ8L4phZ1neu1bKpPQZT4B_s3xFD_EChpxJscqGiOopPIYuWXI5****
      Enable	You must turn on the switch. Otherwise, the DingTalk data cannot be synchronized.	Enabled
      EmailField	Specify an identifier field for primary email addresses.	email
      Default Password	Specify a default password that is used to log on to the IDaaS console. Important You must specify a password that meets the requirements in the current password policy. Otherwise, the DingTalk data cannot be synchronized.	****

   5. On the OUs and Groups page, choose Import > DDtalk Sync > OU.

   6. In the panel that appears, select the DingTalk application that you want to manage and click Import. Then, confirm the import operation.

3. Grant DingTalk accounts the permissions to access the SAML application.

   1. In the left-side navigation pane, choose Authorization > Application Authorization.

   2. In the left-side application section of the Application authorization subject tab, click the application. On the right-side Account tab, select the accounts that you want to manage and click Save. In the message that appears, click OK.

Step 5: Connect your IDaaS IdP to SASE

After you synchronize the DingTalk data to IDaaS, you must connect your IDaaS IdP to SASE. This way, you can use SASE to manage the access permissions of DingTalk users. For more information about how to connect an IDaaS IdP to SASE, see Use SASE to ensure secure access of IDaaS (old version) users.