DocsICP FilingConsole
Documentation

CreateIdentityProvider

Updated at:
Copy as MD
Product
My Favorites

Create an identity provider.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter

Type

Required

Description

Example
InstanceId

string

Yes

Instance ID.

idaas_ue2jvisn35ea5lmthk267xxxxx
IdentityProviderName

string

Yes

Identity provider name.

test
IdentityProviderType

string

Yes

Identity provider synchronization type.

  • Inbound DingTalk: urn:alibaba:idaas:idp:alibaba:dingtalk:pull

  • Outbound DingTalk: urn:alibaba:idaas:idp:alibaba:dingtalk:push

  • Inbound WeCom: urn:alibaba:idaas:idp:tencent:wecom:pull

  • Inbound Lark: urn:alibaba:idaas:idp:bytedance:lark:pull

  • Inbound AD: urn:alibaba:idaas:idp:microsoft:ad:pull

  • Inbound LDAP: urn:alibaba:idaas:idp:unknown:ldap:pull

  • Standard OIDC: urn:alibaba:idaas:idp:standard:oidc

  • SASE Custom OIDC: urn:alibaba:idaas:idp:alibaba:sase

urn:alibaba:idaas:idp:alibaba:dingtalk:push
UdPushConfig

object

No

Outbound synchronization configuration.

IncrementalCallbackStatus

string

No

Incremental callback status. This field is not yet enabled. Please ignore it.

disabled
PeriodicSyncStatus

string

No

Periodic verification status. This field is not yet enabled. Please ignore it.

disabled
UdSyncScopeConfigs

array<object>

No

Outbound synchronization configuration.

object

No

SourceScopes

array

No

Source synchronization node list.

string

No

Source synchronization node. Enter the organization ID.

ou_lyhyy6p7yf7mdrdiq5xxxx
TargetScope

string

No

Target synchronization node.

ou_lyhyy6p7yf7mdrdiq5xxxx
PeriodicSyncConfig

object

No

Periodic verification configuration.

PeriodicSyncType

string

No

Type.

Valid values:

  • cron :

    cron

  • time :

    time

cron

PeriodicSyncCron

string

No

Cron expression.

0 45 1 * * ?

PeriodicSyncTimes

array

No

Set of execution time points.

integer

No

Execution time point.

3
UdPullConfig

object

No

Inbound synchronization configuration.

GroupSyncStatus

string

No

Whether group synchronization is supported. Default: disabled. Valid values:

  • Disabled: disabled

  • Enabled: enabled

disabled
IncrementalCallbackStatus

string

No

Incremental callback status. Specifies whether to process incremental callback data from the IdP. Valid values:

  • Disabled: disabled

  • Enabled: enabled

disabled
PeriodicSyncStatus

string

No

Periodic verification status. Specifies whether to periodically verify data differences between EIAM and the identity provider. Valid values:

  • Disabled: disabled

  • Enabled: enabled

disabled
UdSyncScopeConfig

object

No

Synchronization scope configuration.

SourceScopes

array

No

Source synchronization node list.

string

No

Source synchronization node.

ou_lyhyy6p7yf7mdrdiq5xxxx
TargetScope

string

No

Target synchronization node. Enter the IDaaS organization ID.

ou_lyhyy6p7yf7mdrdiq5xxxx
PeriodicSyncConfig

object

No

Periodic verification configuration.

PeriodicSyncType

string

No

Type.

cron
PeriodicSyncCron

string

No

Cron expression.

0 45 1 * * ?
PeriodicSyncTimes

array

No

Set of execution time points.

integer

No

Execution time point.

3
AuthnConfig

object

No

Authentication configuration.

AuthnStatus

string

No

Whether the corresponding IdP supports authentication. Valid values:

  • Disabled: disabled

  • Enabled: enabled

enabled
AutoUpdatePasswordStatus

string

No

Whether automatic password update is supported. Valid values:

  • Disabled: disabled

  • Enabled: enabled

enabled
BindingConfig

object

No

OIDC identity provider account binding rule configuration.

AutoMatchUserProfileExpressions

array<object>

No

List of rules for automatic account matching.

object

No

ExpressionMappingType

string

No

Expression type. Valid values:

  • Field: field

  • Expression: expression

field
SourceValueExpression

string

No

Mapping attribute value expression.

idpUser.phoneNumber
TargetField

string

No

Mapping target attribute name.

user.username
TargetFieldDescription

string

No

Mapping target attribute description.

username
AutoMatchUserStatus

string

No

Whether automatic account matching is enabled. Valid values:

  • Disabled: disabled

  • Enabled: enabled

disabled
MappingBindingStatus

string

No

Whether the manual account binding feature is enabled. Valid values:

  • Disabled: disabled

  • Enabled: enabled

enabled
DingtalkAppConfig

object

No

DingTalk configuration.

AppKey

string

No

AppKey of the DingTalk first-party application.

Xczngvfemo4e
AppSecret

string

No

AppSecret of the DingTalk first-party application.

5d405a12a6f84ad4ab05ee09axxxx
CorpId

string

No

CorpId of the DingTalk first-party application.

307568042478613xxxx
DingtalkVersion

string

No

DingTalk version. Valid values:

  • Standard DingTalk: public_dingtalk

  • Exclusive DingTalk: private_dingtalk

public_dingtalk
EncryptKey

string

No

DingTalk application EncryptKey.

VkdWw91mdkrjVFr3ObNwefap21dfxxxx
VerificationToken

string

No

DingTalk application VerificationToken.

myDingApp_VerifyTokenxxxxx
LdapConfig

object

No

AD/LDAP configuration.

AdministratorPassword

string

No

Administrator password.

xxxx
AdministratorUsername

string

No

Administrator account.

DC=example,DC=com
CertificateFingerprintStatus

string

No

Whether to verify certificate fingerprint. Valid values:

  • Disabled: disabled

  • Enabled: enabled

enabled
CertificateFingerprints

array

No

Certificate fingerprint list.

string

No

Certificate fingerprint in SHA256 public key format.

asdasd2221asdawqeda
GroupMemberAttributeName

string

No

Group member attribute.

member
GroupObjectClass

string

No

Group ObjectClass.

group
GroupObjectClassCustomFilter

string

No

Group custom filter.

(|(cn=test)(group=test@test.com))
LdapProtocol

string

No

Communication protocol.

ldap
LdapServerHost

string

No

AD/LDAP server address.

123.xx.xx.89
LdapServerPort

integer

No

AD/LDAP port number.

636
OrganizationUnitObjectClass

string

No

Organization ObjectClass.

organizationUnit,top
StartTlsStatus

string

No

Whether startTLS is enabled. Valid values:

  • Disabled: disabled

  • Enabled: enabled

enabled
UserLoginIdentifier

string

No

User login identifier.

userPrincipalName, mail
UserObjectClass

string

No

User ObjectClass.

person,user
UserObjectClassCustomFilter

string

No

User custom filter.

(|(cn=test)(mail=test@test.com))
PasswordSyncStatus

string

No

Password synchronization switch.

enabled
UserRdn

string

No

User RDN.

cn
OrganizationalUnitRdn

string

No

Organization RDN.

ou
WeComConfig

object

No

WeCom configuration.

AgentId

string

No

AgentId of the WeCom self-built application.

278231941749863339
AuthorizeCallbackDomain

string

No

Authorization callback domain.

https://xxx.aliyunidaas.com/xxxx
CorpId

string

No

CorpId of the WeCom self-built application.

3756043633237690761
CorpSecret

string

No

CorpSecret of the WeCom self-built application.

CSEHDddddddxxxxuxkJEHPveWRXBGqVqRsxxxx
TrustableDomain

string

No

Trusted domain.

https://xxx.aliyunidaas.com/
OidcConfig

object

No

OIDC IdP configuration.

AuthnParam

object

No

OIDC client authentication configuration.

AuthnMethod

string

No

OIDC authentication method. Valid values:

  • client_secret_basic

  • client_secret_post

client_secret_post
ClientId

string

No

OIDC client ID.

mkv7rgt4d7i4u7zqtzev2mxxxx
ClientSecret

string

No

OIDC client secret.

CSEHDddddddxxxxuxkJEHPveWRXBGqVqRsxxxx
EndpointConfig

object

No

OIDC endpoint configuration.

AuthorizationEndpoint

string

No

OIDC authorization endpoint.

https://example.com/auth/authorize
Issuer

string

No

OIDC issuer.

https://example.com/auth
JwksUri

string

No

OIDC JWKS URI.

https://example.com/auth/jwks
TokenEndpoint

string

No

OIDC token endpoint.

https://example.com/auth/token
UserinfoEndpoint

string

No

OIDC UserInfo endpoint.

https://example.com/auth/userinfo
GrantScopes

array

No

OIDC grant scopes.

openid

string

No

OIDC grant scope, organization ID or group ID.

ou_lyhyy6p7yf7mdrdiq5xxxx
GrantType

string

No

OIDC grant type.

authorization_code
PkceChallengeMethod

string

No

PKCE algorithm. Valid values:

  • SHA256: S256

  • Plain text: plain

S256
PkceRequired

boolean

No

Whether to use PKCE in Authorization Code grant mode.

true
NetworkAccessEndpointId

string

No

Network access endpoint ID.

nae_examplexxxx
AutoCreateUserConfig

object

No

Automatic account creation rule configuration.

AutoCreateUserStatus

string

No

Whether automatic account creation is enabled. Valid values:

  • Disabled: disabled

  • Enabled: enabled

disabled
TargetOrganizationalUnitIds

array

No

Set of target organizational unit IDs.

string

No

Target organizational unit ID.

ou_lyhyy6p7yf7mdrdiq5xxxx
AutoUpdateUserConfig

object

No

Automatic account update rule configuration.

AutoUpdateUserStatus

string

No

Whether automatic account update is enabled. Valid values:

  • Disabled: disabled

  • Enabled: enabled

disabled
LarkConfig

object

No

Lark configuration.

AppId

string

No

Lark application AppId.

cli_xxxx
AppSecret

string

No

Lark application Secret.

KiiLzh5Dueh4wbLxxxx
EnterpriseNumber

string

No

Lark enterprise code.

FSX123111xxx
EncryptKey

string

No

EncryptKey of the Lark self-built application.

VkdWw91mdkrjVFr3ObNwefap21dfxxxx
VerificationToken

string

No

VerificationToken of the Lark self-built application.

feishuVerifyTokenxxxxx
LogoUrl

string

No

Application logo URL.

xxxx-image://xxxx_23aqr2ye554csg33dqpch5eu3q/tmp/d17d9adc-a943-45e7-ba0c-2838dddea678

ClientToken

string

No

Client token used to ensure the idempotency of the request. Generate a parameter value from your client to ensure the value is unique across different requests. ClientToken only supports ASCII characters. If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.

clientToken_20250704_Axxxxx
SamlConfig

object

No

IdPEntityId

string

No

http://dc.test.com/adfs/services/trust
IdPSsoUrl

string

No

https://dc.test.com/adfs/ls/
Certificates

array<object>

No

object

No

Content

string

No

-----BEGIN CERTIFICATE----- MIIC0jCCAbqgAwIBAgIQXXXXX-----END CERTIFICATE-----
RequireRequestSigned

boolean

No

true
BindingMethod

string

No

HTTP-REDIRECT
MaxClockSkew

integer

No

180
WantResponseSigned

boolean

No

WantAssertionsSigned

boolean

No

Response elements

Element

Type

Description

Example

object

Response parameters.

RequestId

string

Request ID.

0441BD79-92F3-53AA-8657-F8CE4A2B912A
IdentityProviderId

string

Identity provider ID.

idp_mwpcwnhrimlr2horxXXXX

Examples

Success response

JSON format

{
  "RequestId": "0441BD79-92F3-53AA-8657-F8CE4A2B912A",
  "IdentityProviderId": "idp_mwpcwnhrimlr2horxXXXX"
}

Error codes

HTTP status code

Error code

Error message

Description
400 InvalidParameter.OidcIssuer OidcIssuer format check failed, it must be an address that starts with http or https. OidcIssuer format check failed, it must be an address that starts with http or https.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.