Account extension fields-Identity as a Service(IDaaS)-阿里云帮助中心

Field management in IDaaS EIAM lets administrators view basic fields and configure their permissions, and create, configure, and use extension fields to manage user information fields flexibly.

Basic fields

Feature description

Basic fields are predefined by the system and contain basic user information, such as a username, email address, and mobile phone number. This feature allows administrators to:

View system-predefined basic fields.
Configure whether fields are displayed in the user portal.
Manage user edit permissions for specific fields.

Procedure

Access the basic field management page
1. Log on to the IDaaS console. In the left-side navigation pane, select EIAM. Select the relevant IDaaS instance and click Manage in the Actions column.
2. In the Account menu, click Field Management > Basic Fields.
View editable fields
1. On the Basic Fields tab, select Editable Fields Only at the far left.
2. The list displays only the fields that users are allowed to edit.

Basic field columns

Field	Description
Field display name	The name displayed for the field in the user interface.
Field ID	The field identifier used internally by the system.
Data type	String
Required	Indicates whether the field is required.
Unique	Indicates whether the field is unique.
User permissions	Indicates whether the field is invisible, visible, or editable for end users.
Actions	You can edit user permissions only for the user display name, user email, and mobile phone number fields.

Configure field permissions
1. Find an editable field in the basic field list.
2. Click Edit. This button is available only for the user display name, user email, and mobile phone number fields.
3. In the Edit Field page that appears, configure user permissions.
  - Invisible to users: Select this option to hide the field from users.
  - Visible to users: Select this option to make the field visible to users.
  - Editable by users: Select this option to allow users to edit the field.
4. Click OK to save the configuration.

Note

Basic fields are predefined by the system. You cannot delete or add basic fields.

Extension fields

Feature overview

IDaaS supports custom extensions to account fields for storing additional attribute values, such as employee ID, birthday, and region. Administrators can define and use new fields in the Extended Fields menu.

Note

Currently, only extension fields for accounts are supported. Other entity types are not supported.

Create a field

Administrators can go to the Extended Fields page and click Create Field. The field creation form appears. The following table describes the information that you need to configure.

Field	Description	Editable
Field display name	The display name of the field.	Editable.
Field ID	The unique identifier of the field. Only lowercase letters and underscores are allowed, and it cannot start with an underscore.	Not editable.
Field type	How the field is presented on the page. Valid values: Input box Drop-down list Checkbox	Not editable.
Field type: Input box	After you select Input box, configure the following fields: Data type: Specify whether the data is a string or a number. Default value: The value that the system uses when no value is passed for the field. This is similar to the `DEFAULT` value of a field in a relational database.	Data type: Not editable. Default value: Editable.
Field type: Drop-down list	Data type: Specify whether the data is a string or a number. Data items: Define the key-value pairs for the options in the drop-down list. For data compatibility, a data item cannot be deleted after it is created. You can only disable or enable it when you edit the field. After a data item is disabled, it no longer appears in the options, but existing data is unaffected. Default value: Specify the default option of the field by entering the key of the data item.	Data type: Not editable. Data items Add: Editable. Disable or enable: Editable. Delete: Not editable. Modify key: Not editable. Modify name: Editable. Default value: Editable.
Field type: Checkbox	Configure the parameters as for a drop-down list.	Same as for a drop-down list.
Field description	Optional. Descriptive information displayed below the field.	Editable.
Required	If selected, this field is required for all subsequent account creation and editing operations. Note Note: If you add a required field while an identity provider (IdP) is in use for account import, you must add field mapping on the Identity Provider page. Otherwise, synchronization fails.	Not editable.
Unique	Specifies whether the field value is unique within the current instance. For example, select this option when you store employee IDs.	Not editable.
Encrypted storage	For sensitive information, IDaaS can encrypt the data before storing it in the database to enhance security.	Not editable.
User permissions	Administrators have full permissions for extension fields. In some cases, user permissions for a field must be restricted. Specify the user permissions for the extension field. Valid values: Invisible: Users cannot see the field. Visible: Users can see the field value but cannot edit it. Editable: Users can view and edit their own values for the field.	Editable.

Fill in extension fields

After you create a field, make sure that it is enabled before you use it.

Administrators can go to the Accounts And Orgs page and click Create Account. At the top of the form that appears, switch to the Extended Field tab to specify values for all extension fields of the account.

User self-service

If a field's user permissions are set to Visible, users can log on to their user portal, click My Account, and view the field and its value in Extended Information.

If a field's user permissions are set to Editable, users can click the edit option for the field to edit the value.

Retrieve extension fields

Applications can retrieve account extension field information in the following three ways:

Method	Description
Dev/OpenAPI	Applications can retrieve extension information for any specified account. This method is typically used for synchronization and is a management feature. Dev/OpenAPI returns all extension field information of an account without additional configuration. For more information, see API documentation.
OIDC SSO account id_token/userinfo	After OIDC SSO, an application can retrieve the extension field content of the account that is currently logged on. By default, extension fields are not returned in SSO results. In the extended `id_token` settings, administrators can configure extension field information to be returned. The OIDC `Userinfo` endpoint returns the same content as the `id_token`. Use the format `user.customFieldMap.$field key$.fieldValue`.
SAML SSO account attribute statements	After SAML SSO, an application can retrieve the extension field content of the account that is currently logged on. By default, extension fields are not returned in SSO results. Assertion Attribute Statements support custom return information, which allows extension information to be returned in the SAMLResponse.