How to bind IDaaS to Feishu in the outbound direction-Identity as a Service(IDaaS)-阿里云帮助中心

A Feishu outbound identity provider pushes account and organization data from IDaaS to the Feishu enterprise contacts, and supports QR code logon (SSO) based on Feishu. This topic describes how to create a Feishu outbound identity provider in IDaaS.

Overview

After you complete the configuration described in this topic, the following capabilities are available:

Incremental synchronization: When account or organization data in IDaaS changes, the change is synchronized to the Feishu contacts in real time.
Scheduled verification: All account and organization data in IDaaS is synchronized to the Feishu contacts at the interval that you specify.
Feishu QR code logon: Feishu QR code logon is enabled on the logon page. Users can scan the QR code to complete authentication.

Prerequisites

A Feishu enterprise account is available, and you have the permissions of an enterprise administrator.
An Alibaba Cloud IDaaS EIAM instance is activated, and you have the permissions to manage identity providers.
The Feishu enterprise number is obtained.

Procedure

Step 1: Create a Feishu application

Log on to the Feishu admin console and obtain the enterprise number.
Log on to the Feishu Open Platform and create a custom enterprise application.
Go to the application details page, click Credentials & Basic Info, and record the App ID and App Secret.

Step 2: Configure application permissions

Go to Permissions & Scopes > Permission Management, select the application identity permissions (tenant_access_token), and enable the following permissions:

Permission name	Permission value
Obtain basic contact information	`contact:contact.base:readonly`
Obtain the user ID of a user	`contact:user.employee_id:readonly`
Obtain basic department information	`contact:department.base:readonly`
Obtain the department organizational structure of contacts	`contact:department.organize:readonly`
Obtain basic user information	`contact:user.base:readonly`
Obtain the organizational structure information of a user	`contact:user.department:readonly`
Obtain the email address of a user	`contact:user.email:readonly`
Obtain the mobile phone number of a user	`contact:user.phone:readonly`
Obtain the employment information of a user	`contact:user.employee:readonly`
Update contacts	`contact:contact`
Obtain a user ID by mobile phone number or email address	`contact:user.id:readonly`

Click Data Scope Configuration and configure the departments that you want to synchronize.

Step 3: Release an application version

After the permissions are configured, go to Version Management & Release > Create Version to create and release an application version.

Step 4: Create an IDaaS identity provider

Add a Feishu identity provider.

In the IDaaS console, choose Identity Providers > Outbound > Add Outbound, find Feishu in the list, and then click Add.
Enter the basic information.
1. Enter the enterprise number, App ID, and App Secret that you recorded.
2. Record the redirect domain name and the application homepage URL, and then click Next.
3. Click Check Permissions. After all permission checks pass, click Next.

Select scenarios and configure field mappings.

Select synchronization scenarios based on your business requirements. The following table describes the capabilities.

Capability	Description
Incremental synchronization	After this capability is enabled, changes to account or organization data in IDaaS are synchronized to the Feishu contacts in real time. IDaaS matches Feishu users based on the mapping identifier in the field mappings. You can customize the rule in the field mappings. If a match is found, the existing account is overwritten. Otherwise, a new account is created.
Scheduled verification	After this capability is enabled, account and organization data in IDaaS is synchronized to the Feishu contacts at the interval that you specify.
Feishu QR code logon	After this capability is enabled, a Feishu QR code logon entry is created in the logon menu and enabled by default. Users can scan the QR code to log on.

Click Field Mappings. Because duplicate mobile phone numbers are not allowed in Feishu, we recommend that you also use the mobile phone number in IDaaS as the mapping identifier.

To synchronize IDaaS user attributes to the custom fields of Feishu members, see Configure custom field mapping for Feishu/Lark outbound sync.

Complete the creation.

Click Save to create the Feishu outbound identity provider.

Step 5: Configure the redirect URL of the Feishu application

Return to the Feishu Open Platform, go to Security Settings > Redirect URL, and add the redirect domain name that you recorded.

Go to Add Application Capability > Web Application and add the application homepage URL that you recorded.

After the configuration is complete, go to Version Management & Release > Create Version to create and release an application version.