Field mapping

Key concepts

With the field mapping capability, you can keep IDaaS accounts and external accounts consistent at two levels:

• Account level: Account binding keeps account status consistent. For example, when you import the DingTalk address book, if a DingTalk user is bound to an IDaaS account, deleting that user in DingTalk also deletes the corresponding account in IDaaS.

• Field level: Building on account binding, field mapping keeps account information consistent. For example, when you import the DingTalk address book, you can map a DingTalk user's corporate email to the display name of an IDaaS account. The display name then changes whenever that email changes in DingTalk.

Field mapping entry points

You can configure field mapping from two entry points:

• During creation: When you create an identity provider, you can configure field mapping in the creation process, except for inbound DingTalk binding.

• During modification: On the Identity providers page, click Modify Settings, and then switch to the Field Mapping module in the dialog box.

That is, the entry is below the Sync to IDaaS section on the identity provider card: the Modify Configuration link.

Mapping identifier

You can specify a mapping identifier to establish an account binding. If the values on both sides of a field mapping are the same, the two accounts are bound. This is mainly used to bind existing accounts that are already in use. For example, when you import users from DingTalk to IDaaS, assume that the mapping identifier is configured as follows. If a DingTalk user's corporate email zh***@example.com matches the email of an IDaaS account, the two accounts are bound. After the accounts are bound, their status and information remain consistent. If the email does not match that of any IDaaS account, an IDaaS account is created and bound. On the Field Mapping tab of the DingTalk synchronization configuration, the Phone (user.phoneNumber) and Email (user.email) fields can be set as the mapping identifier.

Mapping rules

IDaaS supports two methods of field mapping:

• Select a field: Select a field from the synchronization source and use its value directly as the value of the corresponding field in the synchronization target. IDaaS provides different field ranges for different identity providers. If the field that you need is not in the range, use an expression to configure it.

• Expression: Use an expression to define a custom value and use it as the value of the corresponding field in the synchronization target. Expressions flexibly support a variety of use cases. For example, you can use a DingTalk email prefix as an IDaaS account name, or use fields that are outside the IDaaS Select Field range. The following are common uses of expressions:

  • Use fields outside the available range:

    • DingTalk user job title: idpUser.title

    • DingTalk user work location: idpUser.work_place

    • DingTalk department owner: idpOrganizationalUnit.org_dept_owner

    • For all DingTalk fields, see DingTalk User Fields and DingTalk Department Fields.

  • Extract the email prefix as the field value:

    • Use the DingTalk email prefix: SubstringBefore(idpUser.email,"@")

    • Use the AD UPN prefix: SubstringBefore(idpUser.userPrincipalName,"@")

  • Use a fixed value: Trim("myString")

For a field that you do not want to map, click Remove. The mapping rule is then set to not map the field, and its data is not synchronized.