Feishu as Identity Source

IDaaS supports enterprises importing user and organizational data from multiple identity sources into the IDaaS platform. This guide explains how to configure Feishu as an identity source in IDaaS, synchronizing Feishu-managed organizational and user data into the IDaaS platform to ensure data consistency across enterprise application systems.

Prerequisites

• Administrator permissions for the Feishu developer console. If you do not have an account, register a developer account on the Feishu Open Platform first.
• Administrator permissions for the IDaaS Enterprise Center.

Configuration Flow

Create an Application in Feishu Open Platform

1. Log in to the Feishu Open Platform, enter the Developer Console, and select Create App.

   

2. After creation, enter the new app's detail page, choose Credentials & Basic Info on the left, and obtain the AppID and AppSecret.

   

3. Choose Permission Management on the left, configure app permissions, and add the following user and address book permissions. The address book permission scope must be set to all members.

   

   

4. Choose Event Subscriptions on the left, and set the Encrypt Key, Verification Token, and request URL. Parameter descriptions are as follows.

   TIP

   Perform this step only after adding the Feishu identity source in IDaaS and completing the import configuration.

   Parameter	Description
   Encrypt Key	Data encryption key. Must match the parameter in the IDaaS Feishu identity source.
   Verification Token	Verification token. Must match the parameter in the IDaaS Feishu identity source.
   Request URL Configuration	Data change notification address. Automatically generated after adding the Feishu identity source in the IDaaS Enterprise Center.

   

5. After configuration, you can add events on this page to subscribe to Feishu department creation, modification, deletion, and employee onboarding, offboarding, and information changes.

   

6. Choose App Release > Version Management & Release on the left, fill in the app version number and update notes, set availability to All Employees, and release the app.

   

7. Save the settings, apply for release, and log in to your Feishu Admin Console. Under Workspace > App Review, approve the app.

   

Configure the Feishu Identity Source in IDaaS

1. Log in to the IDaaS Enterprise Center, choose Users > Identity Source Management from the top navigation bar, click Add Identity Source, and select Feishu.

   

2. Customize the identity source name, fill in the APP ID, APP Secret, root department name, and other parameters as prompted, then click OK to save.

3. Enter the detail page of the newly created identity source to view or update the Basic Configuration, including connection parameters, synchronization mechanism, and real-time callback.

   

4. Switch to the Advanced Configuration tab. It is recommended to keep the default values or adjust them according to actual requirements.

   

   Parameter	Description
   Select Root Organization	The organization node into which identity source data is imported. The default is fine.
   Organization Matching Policy	Mapping relationship for importing Feishu organizations into IDaaS. The default is fine.
   Create Organization	Create and update organizations are checked Yes by default.
   Delete Organization	By default, organizations are retained (i.e., when an organization is deleted in Feishu, it is retained in IDaaS). You can also disable or delete organizations.
   User Matching Policy	Mapping relationship for importing Feishu users into IDaaS. The default is fine.
   Create User	Create and update users are checked Yes by default.
   Delete User	By default, users are disabled (i.e., when a user is deleted in Feishu, the user is disabled in IDaaS). You can also retain or delete users.
   Safety Threshold Adjustment	Sets the maximum threshold ratio for changes such as deleting users, deleting organizations, or changing organization hierarchy in the upstream identity source. Threshold = (Difference between platform-recovered data and this recovery / Recovered data) × 100%. If the upstream identity source disables or deletes data exceeding the threshold, the platform will not perform the disable or delete operation.

5. After configuration, switch to the Object Model tab, select Mapping Definition, set the transformation mode of username account name to Auto Transform, and the execution mode to Create. The corresponding system user attribute is Username.

   The object model supports mapping attributes of users and organizations from the Feishu identity source to IDaaS user and organization attributes. After configuration, user and organization attributes are recovered from Feishu into IDaaS.

   

   • Execution Mode: Sets when the attribute needs to be mapped.
     • Do Not Map: The attribute will not be synchronized to IDaaS.
     • Create: The attribute is synchronized only during creation.
     • Update: The attribute is synchronized only during update.
     • Create and Update: The attribute is synchronized during both creation and update.
   • Transformation Mode: Sets how the attribute is mapped.
     • Auto Transform: Synchronize the value as-is from the identity source.
     • Script Transform: Use this when the value from the identity source does not meet the required format. Refer to Script Mapping Methods.

6. After configuration, click Execute Synchronization to run the synchronization immediately.

   TIP

   If the synchronization mechanism in the basic configuration is set to scheduled synchronization, there is no need to manually execute the synchronization task here.

7. After execution, switch to the Synchronization Events page to view all synchronization tasks for this identity source. Click Details under the Operation column to view the import results, or go to the Users > Users and Organizations page to view the imported data.

8. (Optional) After import synchronization is complete, switch to the Callback Events tab. If callback registration is enabled in Basic Configuration, you can view records of Feishu address book changes pushed to IDaaS in real time.