How to connect Secure Access Service Edge with Lark - Secure Access Service Edge

Connect to Lark so that your enterprise users log on to the client with their Lark accounts. After the connection is established, you manage the access permissions of Lark users in and protect your corporate office data.

Note

The information about the Feishu Open Platform is for reference only. For details, see the official Lark documentation.

Background information

SASE manages the internal network access permissions and the Internet access permissions of your employees and protects your corporate office data. If you already use Lark to manage the user information of your enterprise, connect SASE to Lark. Your enterprise users then log on to the SASE client with their Lark accounts, and you no longer maintain a separate SASE identity management system. This reduces the cost of maintaining user information.

The two platforms supply values to each other, so plan for one round trip between them. The custom application on the Feishu Open Platform supplies the App ID and App Secret that you enter in the console. The console supplies the redirect URL and the request URL that you enter in the custom application. Complete the steps in the order presented: when a substep in Step 1 requires a URL from the console, open the IdP creation wizard described in Step 3, copy the value, and then return to Step 1.

Prerequisites

Secure Access Service Edge

SASE is activated and the SASE client is installed. For more information, see Billing overview.

Lark accounts and permissions

A Lark administrator account that can create and release custom applications on the Feishu Open Platform.
Access to the Lark admin console with the permissions required to review and approve a custom application.
A Lark super administrator account, which is required to modify the availability scope of the custom application.

Step 1: Create and configure a custom Lark application

Create a custom application on the Feishu Open Platform before you connect Lark to SASE. The custom application provides the App ID and App Secret that verify user identities when users log on to the SASE client with their Lark accounts.

Log on to the Feishu Open Platform with a Lark administrator account.
Create a custom application for your enterprise.
1. On the Feishu Open Platform homepage, click Create Custom App.
2. In the Create Custom App dialog box, set the Name and Description for the custom application. Then, click Create.
3. In the Custom App section, click the application that you created.
4. In the left-side navigation pane, click Credentials & Basic Info. Perform the following operations and then click Save.
  - In the Credentials section, obtain the App ID and App Secret.
  - In the General info section, upload an application icon.
    (Recommended) Use the SASE icon as the application icon, as shown in the following figure:
Configure security settings.
1. Configure redirect URLs.
  Add both of the following redirect URLs: https://login.aliyuncsas.com/open-dev/feishu and https://login.aliyuncsas.com/ui/feishuAuth/.
  The first URL is the fixed Redirect URL value that the console displays for a Lark IdP. To read the value from the console, go to the IdP Management page. When you add the identity provider (IdP) information, set Enterprise IdP to Lark. For the navigation path to this page, see Step 3.
2. Configure an IP whitelist.
  Add an IP whitelist. Only requests from sources in the whitelist can call Open Platform API operations. Requests from sources that are not in the whitelist are rejected.

On the Permissions & Scopes page, configure the permissions for the custom application. Use either of the following methods. The permission table in Method 1 lists all of the permissions to configure.

Method 1: Add permissions manually

Click Add permission scopes to app and select the required Tenant token scopes and User token scopes from the following table.

Permission	Description
contact:contact	Update the address book
contact:contact.base:readonly	Read basic address book information
contact:department.base:readonly	Read basic department information
admin:app.info:readonly	Read basic application information
contact:department.hrbp:readonly	Read department HRBP information
contact:department.organize:readonly	Read the department structure in the address book
event:ip_list	Read the egress IP addresses of events
contact:user.base:readonly	Read basic user information
contact:user.employee_id:readonly	Read user IDs
contact:user.department:readonly	Read the department structure of users
contact:user.email:readonly	Read user email addresses
contact:user.phone:readonly	Read user mobile numbers

Method 2: Batch import permissions

Click Batch import/export scopes. On the Import tab, add the required permissions by using the following content, and then click Next, Review New Scopes. You can also export the configured scopes on the Export tab.

{
    "scopes": {
        "tenant": [
            "admin:app.info:readonly",
            "contact:department.organize:readonly",
            "contact:department.base:readonly",
            "contact:user.email:readonly",
            "contact:user.phone:readonly",
            "contact:user.employee_id:readonly",
            "contact:user.base:readonly",
            "contact:user.department:readonly",
            "contact:contact.base:readonly"
        ],
        "user": [
            "contact:department.organize:readonly",
            "contact:department.base:readonly",
            "contact:user.email:readonly",
            "contact:user.phone:readonly",
            "contact:user.employee_id:readonly",
            "contact:user.base:readonly",
            "contact:user.department:readonly",
            "contact:contact.base:readonly"
        ]
    }
}

Important

The preceding content does not include the contact:contact, contact:department.hrbp:readonly, and event:ip_list permissions that are listed in the permission table. If you import the permissions in batches, add these three permissions manually as described in Method 1.

On the Event Subscription page, configure event subscriptions for the custom application.
1. Set Encrypt Key, Verification Token, and Request URL.
  The request URL comes from the console. Go to the IdP Management page. When you add the IdP information, set Enterprise IdP to Lark and obtain the request URL. Open the IdP creation wizard described in Step 3, copy the request URL, and then return to this substep.
2. Enable the following event subscriptions.
  The event subscriptions include Department Created, Department Deleted, Department Info Changed, Employee Resigned, and Employee Info Changed. For more information about how to configure event subscriptions in Lark, see Event Subscriptions.
Before you continue to Step 2, verify that you have the App ID and App Secret, and that the redirect URLs, the permission scopes, and the event subscriptions are saved.

Step 2: Release and approve the custom application

A custom application takes effect only after you release a version of it and approve that version in the Lark admin console.

Create and release a version of the custom application.
1. Log on to the Feishu Open Platform with a Lark administrator account.
2. In the left-side navigation pane, click Version Management & Release.
3. On the Version Management & Release page, click Create a Version. Configure App version, Update Notes, Features, Scope changes, and Availability based on your business requirements. Then, click Save.
  Set both Default Mobile App Feature and Default PC App Feature to Webpage.
  The Availability setting determines which users can use this IdP. Users outside the specified availability scope cannot use this IdP to log on to the SASE client. If a user is denied access after logon, modify the availability scope of the application.
Approve the application.
1. Log on to the Lark admin console with a Lark administrator account. In the top menu bar, choose Product Features > Admin Console.
2. On the admin console page, click Enter Lark.
3. On the Homepage, in the Application Management section, click Go To Review.
4. On the Application Review page, find the application that you want to approve, click Review in the Actions column, and then click Approve.
Before you continue to Step 3, verify that the version is released and that the application is approved. The Feishu Open Platform configuration takes about 10 minutes to take effect.

Step 3: Connect Secure Access Service Edge to Lark

After you configure the custom application in Lark, connect SASE to Lark. In this step, you configure the IdP authentication parameters and the settings that synchronize the Lark organizational structure.

Log on to the Secure Access Service Edge console.
In the navigation pane on the left, choose Identity Authentication > Identity Access.
On the Identity synchronization tab, click Create IdP.
In the Create IdP panel, select Lark, click Configure, and complete the configuration as prompted by the wizard.

In the Basic Configurations wizard, configure the parameters described in the following table. (Recommended) Turn on Automatic Synchronization and Synchronize User Information so that changes in Lark reach SASE without manual operations.

Parameter	Description
IdP Name	A custom name for the IdP. The name must be 2 to 100 characters in length and can contain Chinese characters, letters, digits, hyphens (-), and underscores (_).
Description	A description for the configuration. The description is displayed as the logon title in the client, which helps you identify the IdP when you log on.
IdP Status	Configure the status of the IdP. Valid values: Enabled, the IdP is enabled after it is created; Closed, the IdP is disabled after it is created. If you disable an IdP, end users cannot use the app to access internal applications. Proceed with caution.
App ID	The application ID of the custom application on the Lark platform. Obtain this value from the Credentials section of the custom application.
App Secret	The application secret of the custom application on the Lark platform. Obtain this value from the Credentials section of the custom application.
Advanced Settings > Event Subscription	After you configure event subscriptions, the organizational structure of your employees is synchronized to . This keeps security policies up to date when the organizational structure of your employees changes or when employees resign. Encrypt Key: Get this value from the Address Book Synchronization page on the Feishu Open Platform. Verification Token: Get this value from the Address Book Synchronization page of the destination application on the Feishu Open Platform. Request URL: Use this value to configure the request URL for event subscriptions on the Feishu Open Platform. Subscribed events: Department Created, Department Deleted, Department Info Changed, Employee Resigned, and Employee Info Changed.
Redirect URL	Fixed value: `https://login.aliyuncsas.com/open-dev/feishu`. Use this value to configure the redirect URL on the Feishu Open Platform, in Developer Console > Custom App > Security Settings.
Automatic Synchronization	After you turn on Automatic Synchronization, the system automatically synchronizes the related information from Lark based on the synchronization mode. If you do not turn on Automatic Synchronization, you must manually synchronize the organizational structure. For more information, see .
Synchronize User Information	After you turn on Synchronize User Information, the system automatically synchronizes employee information from Lark based on the Automatic Synchronization Cycle. If you do not turn on Automatic Synchronization, the Synchronize User Information feature is not performed.
Automatic Synchronization Cycle	Set the Automatic Synchronization Cycle. You can set an automatic synchronization interval from every 1 hour to every 24 hours.

Click Connectivity Test. After the test is successful, click Next.
If Connection Failed is displayed, check the following causes:
- Credentials — Check whether the information that you entered is correct. The App ID and App Secret must match the values in the Credentials section of the custom application.
- Propagation delay — The Feishu Open Platform configuration takes about 10 minutes to take effect. Wait, and then run the test again.
- Review status — The application version must be released and approved, as described in Step 2.
- IP whitelist — If you configured an IP whitelist for the custom application, make sure that the whitelist does not reject calls to Open Platform API operations.

In the Synchronization Settings wizard, configure the synchronization scope and the field mappings for the organizational structure. Then, click Confirm. Select Synchronize All if all Lark users need access, or Partially Synchronize to keep unrelated organizational data out of SASE.

Parameter	Description
Organizational Structure Synchronization	Configure the scope of the organizational structure to synchronize. Valid values: Synchronize All, which synchronizes the entire organizational structure of Lark to the system; Partially Synchronize, which allows you to select the organizational structure to synchronize.
Field Synchronization Mapping	Configure the mappings between the organizational structure fields of Lark and the synchronization fields of . If the Local Field After Mapping values that are built into the system do not meet your business requirements, click View Extended Fields in the upper-right corner of the list. In the View Extended Fields panel, you can add, edit, or delete extended fields.

Step 4: Verify that the connection is established

After the connection is established, your enterprise users can log on to SASE with their Lark accounts.

Open the installed SASE app.

Open the installed SASE app.

Enter the enterprise verification ID and click OK.
You can log on to the Secure Access Service Edge console. In the navigation pane on the left, on the Settings page, obtain the Enterprise Authentication Identifier.

Enter the enterprise verification ID and click OK.

You can log on to the Secure Access Service Edge console. In the navigation pane on the left, on the Settings page, obtain the Enterprise Authentication Identifier.

Enter the account and password of the Lark user, and then click Log On or Scan QR Code To Log On.
- Successful logon — The connection is established.
- Logon failure — Handle the failure based on the returned message.
  - Error message — For more information, see Generic error codes. For example, the error code 40004 indicates that the application does not have department permissions. In this case, modify the availability scope of the application, as described in Step 2.
  - Prompt message — If a message indicates that you do not have permissions on the application after you log on, log on with a super administrator account and modify the availability scope of the application.