Login settings

Background

Dataphin supports logins from multiple account systems. Users can link their login methods to an existing account. If a user has an initial account, they must bind their SSO account's UID to their initial account's UID after SSO integration.

Limitations

This feature is available only for Dataphin V6.0.0 and later in independent deployments on public and private clouds and in public cloud dedicated instances (semi-managed).

Add a sign-in method

1. On the Dataphin Manager homepage, click system configuration in the top menu bar and select login settings from the left navigation pane.

2. On the login settings page, click add login method.

3. The configuration wizard guides you through protocol configuration and account mapping.

   1. Protocol configuration

      Note

      Each login method can be selected only once.

      CAS protocol

      • Authentication service

        Parameter	Description
        Login method	Select CAS protocol.
        System name	The name of the login method that appears on the login page. The default is "CAS login".
        System icon	The icon for the login method that appears on the login page. Supports PNG and JPG images up to 200 KB. If you do not upload an icon, the system uses the default one.
        System description (Optional)	A brief description of this login method.
        CAS version	Select CAS2 or CAS3.
        Authentication server address	Enter the CAS authentication server address, and then click Test Network Connectivity. If the connection test fails, the system disables the Submit and Next button.
        Authentication server login address	Enter the CAS authentication server login address, and then click Test Network Connectivity. If the connection test fails, the system disables the Submit and Next button.
        Authentication server logout address	Enter the CAS authentication server logout address.
        Login expiration time	The length of a login session. Once the session expires, the system must revalidate the user's login status. The maximum is 1440 minutes (24 hours).

      • User information

        Parameter	Description
        Key for user ID in the source system	Enter the key for the user ID in the source system.
        Key for username in the source system	Enter the key for the username in the source system. If a username is not available, use the key for the user ID instead.
        Key for account in the source system	Enter the key for the account in the source system. If an account is not available, use the key for the user ID instead.
        Key for mobile number in the source system (Optional)	Enter the key for the mobile number in the source system.
        Key for email in the source system (Optional)	Enter the key for the email in the source system.

      OAuth2.0

      • Authentication service configuration

        Parameter	Description
        Select login method	Select OAuth2.0.
        System name	The name of this login method, displayed on the login page. The default is "OAuth2.0 Login".
        System icon	The icon for this login method displayed on the login page. Supports PNG and JPG image formats up to 200 KB. If you do not upload an icon, the system uses the default icon.
        System description (Optional)	A brief description of this login method.
        Authorization grant type	Only the Authorization Code grant type is supported.
        Authorization endpoint URL	Enter the URL used to obtain an authorization code. The system appends parameters, such as client_id, to the request. After entering the URL, click Test Network Connection. The Submit and Next button is disabled if the connection test fails.
        Logout endpoint URL (Optional)	Enter the authorization server's logout endpoint URL.
        Identity provider (IDP) type (Optional)	The type of the integrated IDP, such as keycloak. Note This parameter is required for the server-side logout feature.
        client_id, client_secret	Enter the ID and secret issued by the authorization server to your application. The authorization server uses these credentials to authenticate the client.
        Token endpoint URL	The authorization server's endpoint for exchanging an authorization code for an access token.
        Additional access token request parameters (Optional)	Additional static parameters to include in the access token request.
        Access token request parameter method	Specifies whether to send parameters in the URL or the request Body. The default is URL.
        Authorization header scheme	The scheme for the authorization header. Options are Token or Bearer. The default is Token.
        Login expiration time	The duration of a login session. After this period, the session expires and the user must log in again. The maximum duration is 1440 minutes (24 hours).

      • User information configuration

        Parameter	Description
        UserInfo endpoint URL	The endpoint that returns claims about the authenticated user.
        Additional user information request parameters (Optional)	Additional parameters to include in the user information request.
        User account ID parsing	The JSONPath expression that extracts the account ID from the user information response. For example, $.accountId. The default is $.id.
        User account name parsing	The JSONPath expression that extracts the account name from the user information response. For example, $.accountName. The default is $.id.
        User nickname parsing	The JSONPath expression that extracts the nickname from the user information response. For example, $.nickname. The default is $.id.

      SAML

      Parameter	Description
      Login method	Select SAML.
      System name	The name of the login method shown on the login page. The default value is SAML Login.
      Icon	The icon for the login method shown on the login page. You can upload a PNG or JPG image up to 200 KB in size. If you do not upload an icon, the system uses the default icon.
      System description (Optional)	A brief description of this login method.
      Identity provider type	Specifies the type of the integrated IdP, such as azure, ad-fs, or saml. The default value is dataphin. This value is reflected in the downloaded Dataphin service provider metadata file.
      Identity provider metadata file	Upload the identity provider metadata file. Only .xml files are supported.
      Identity provider SSO URL	The identity provider's SSO and SLO URLs. You do not need to enter these URLs. The system automatically parses them from the metadata file.
      Identity provider SLO URL
      Identity provider certificate	The identity provider's certificate. You do not need to enter the certificate. The system automatically parses it from the metadata file.
      Service provider metadata (Optional)	Click Download metadata file to download the .xml metadata file for Dataphin, which acts as the service provider (SP). This file contains the SP's unique identifier, callback URL, and other information to provide to your IdP.
      Identity provider name (Optional)	Enter the name or ID provided by your IdP. Some IdPs require this value for authentication. For more information, see your IdP's documentation.
      Binding method (Optional)	Enter the binding method, which must match the method specified in the sp.xml file. If you leave this blank, the default is urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST. You can also use: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect.
      Session timeout	The duration of a user's login session. After the session expires, the user must re-authenticate. The maximum value is 1440 minutes (24 hours).

      RAM

      • Authentication service configuration

        Parameter	Description
        Select a login method	Select RAM.
        System name	The name for the login method displayed on the login page. The default value is RAM login.
        System icon	The icon for the login method displayed on the login page. You can upload a PNG or JPG image up to 200 KB. If you do not upload an icon, the default one is used.
        System description (Optional)	A brief description of this system.
        Authorization server login URL	Enter the URL to obtain an authorization code (code). The system appends parameters such as client_id to the request. After entering the URL, click test network connection. The submit and next button remains disabled until the connection test is successful.
        Authorization server logout URL (Optional)	Enter the authorization server logout URL.
        client_id, client_secret	Enter the client ID and secret for the OAuth application in RAM access control.
        Access token URL	The URL of the token endpoint used to request an access token. The default value is https://oauth.aliyun.com/v1/token.
        Session timeout	The duration of a login session. After the session expires, the user must re-authenticate. The maximum value is 1440 minutes (24 hours).

      • User information configuration

        Parameter	Description
        Userinfo URL	The URL of the UserInfo endpoint on the authorization server. The default value is https://oauth.aliyun.com/v1/userinfo.
        Request region (Optional)	Enter the region for the user information request.
        AccessKey ID, AccessKey Secret	Enter the AccessKey ID and AccessKey Secret for the user information request.

      Feishu

      Parameter	Description
      Logon method	Select Feishu.
      System name	The name of this logon method on the login page. Defaults to "Feishu Login".
      System icon	The icon for this logon method on the login page. Supports PNG and JPG images up to 200 KB. If you do not upload an icon, a default one is used.
      System description (Optional)	A brief description of this logon method.
      Authorization server login URL	The URL to obtain the authorization code (code) uses the default value from the Feishu platform: https://open.feishu.cn/open-apis/authen/v1/index. After you complete the configuration, click Test Network Connection. If the connection test fails, you cannot click Submit and Next.
      App ID, App Secret	Enter your application's App ID and App Secret.
      Login expiration time	The amount of time a login state remains valid. After this period, users must log in again. The maximum is 1440 minutes (24 hours).

      Third-party SSO

      • Authentication service

        Parameter	Description
        Login method	Select Third-party SSO.
        System name	The name of this login method, as displayed on the login page. The default is "Third-party SSO login".
        System icon	The icon for this login method, as displayed on the login page. You can upload a PNG or JPG image of up to 200 KB. If you do not upload an icon, the system uses the default icon.
        System description (optional)	A brief description of this login method.
        Integration documentation	For details, see How to integrate Dataphin login based on third-party SSO.
        Authentication service address	Enter the authentication service address and click test network connection. You can click Submit and Next only after the connection test passes.
        Login state validation address	Provide an endpoint to validate the ticket. The default request path is /cookie/validCookie?ticket={ticket}.
        Logout address	Enter the logout address. The default request path is /user/logout?ticket={ticket}.
        Redirect to Dataphin after successful login	To automatically redirect a user to Dataphin after a successful login, append ?target-uri=xxxx to the return address. This parameter specifies the destination URL.

      • User information

        Parameter	Description
        User information acquisition address	Enter the address to request user information. The default request path is /user/getAllUser.
        Acquisition method	You can select full acquisition, paginated acquisition, or cursor-based acquisition. Full acquisition is selected by default. Note When you select paginated acquisition or cursor-based acquisition, you must also configure pagesize.
        pagesize	Enter the number of users to retrieve per page.

   2. Account mapping (optional)

      The account mapping page displays all current Dataphin members. To ensure data consistency after SSO integration, you can configure mappings between Dataphin accounts and SSO accounts. Members without a configured mapping who log in directly to Dataphin can link their accounts manually.

      The member list displays the username, initial account, Dataphin user ID, and source system user ID. It supports batch search, batch import mappings, and batch export.

      • Batch search: Enter Dataphin user IDs to perform an exact search. Separate multiple IDs by pressing Enter. You can enter up to 1,000 IDs.

      • Batch import mappings: Click Batch import mappings, download the account data file (dataphin_account_mapping_sso.xlsx), and then upload the configured file.

        Note

        • By default, the downloaded data includes the first 500 member records. To export specific members, return to the list and make your selection.

        • The uploaded account mapping file must be in .xlsx format, and you can upload up to 500 mappings at a time. If a record in the imported data has an empty source system user ID, the system skips that record.

        • To clear a member's source system user ID, edit it in the list.

        • After you click Start Import, the system validates the data. If the import fails for some records, you can view the import failure details in the Batch Import Partially Failed dialog box.

      • Batch export: Select one or more accounts in the list and click Batch export at the bottom of the page. This exports the data for the selected accounts to a file named dataphin_account_mapping_export_sso.xlsx. The file contains the username, initial account, Dataphin user ID, and source system user ID.

4. Click OK. The system automatically validates the account mapping information. If an error occurs, follow the instructions in the message.

Manage login methods

The login settings page displays a list of login methods, including the System name, System description, Login method, System code, and Status. You can drag the icon to reorder the login methods.

• Login method: The system currently supports CAS, OAuth 2.0, SAML, Alibaba Cloud RAM, Lark, Dataphin built-in account, and third-party SSO login methods. If a method is listed as Other, it indicates a legacy protocol integration that cannot be edited or deleted. To add a new login protocol, contact the Dataphin support team.

• System code: Some member-related OpenAPI calls require the system code to identify the source system of a user ID.

You can perform the following operations to manage login methods.