Integrate DingTalk with NineData SSO

This guide explains how to connect DingTalk to NineData Single Sign-On (SSO) by using OAuth 2.0. Members of a DingTalk organization can then sign in to NineData with their DingTalk accounts.

Before you begin

• You have already created or joined an organization, and the organization has subscribed to DevOps Enterprise. Please ensure that your annual or monthly subscription is still active. For more information, please refer to Manage Organizations.
• Your current account has been switched to the target organization. For more information, please refer to Switching to an Organization.

• The NineData deployment is a Dedicated Cluster.
• Your NineData role is Administrator. For more information, see Roles.
• You have developer permissions in the DingTalk organization.

Step 1: Enable SSO organization login in NineData

1. Sign in to the NineData console. In the left navigation bar, click Account > Organization.
2. Turn on the switch next to Login With SSO. In the configuration window, turn on Open Login With SSO, select OAuth2.0 below Protocol Type, and enter the organization name below Organization domain.
3. Copy the Reply URL (Assertion URL) value shown below OAuth Service Provider Metadata. Keep this page open.

Step 2: Create and configure an application in DingTalk

1. Sign in to the DingTalk Open Platform.
2. Create an internal enterprise application. For more information, see the DingTalk documentation on creating an application.
3. Open the application details page. Click Basic Information > Credentials and Basic Information, and record the Client ID and Client Secret.
4. Click Development Configuration > Permission Management, and enable Personal Mobile Phone Information and Personal Address Book Information Read Permission.
5. Click Development Configuration > Security Settings. Enter the NineData reply URL recorded in Step 1 in Redirect URL (Callback Domain), and click Save.
6. Click Application Publishing > Version Management and Release, and publish the application.

Step 3: Connect the DingTalk application to NineData

1. Return to the Login With SSO page from Step 1. Configure all fields in Parameter as follows:

   Parameter	Value or description
   client_id	The Client ID recorded in Step 2.
   client_secret	The Client Secret recorded in Step 2.
   scope	openid. This returns the user ID after authorization.
   Authorization endpoint uri	https://login.dingtalk.com/oauth2/auth
   Get access_token uri	https://api.dingtalk.com/v1.0/oauth2/userAccessToken
   Get user information uri	https://api.dingtalk.com/v1.0/contact/users/me

2. Click the settings icon next to Authorization endpoint uri. Set Request Method to GET, select Params for Request Parameters, and configure client_id, redirect_uri, scope, prompt (default consent), and response_type (default code).

3. Click the settings icon next to Get access_token uri. Set Request Method to POST, select Body with JSON, and map client_id to clientId, client_secret to clientSecret, code to code, and grant_type to grantType (default authorization_code). Map access_token to accessToken in the response.

4. Click the settings icon next to Get user information uri. Set Request Method to GET, select Header, and map access_token to x-acs-dingtalk-access-token. Map name to nick, mobile to mobile, and email to email in the response.

5. Turn on Allow SSO Account Auto-join if you want NineData to create users automatically when they first sign in through SSO. Select the default role or roles for automatically joined users.

6. Turn on User information mapping, keep the default mapping, and click OK.

After the configuration is complete, members of the DingTalk organization can use the URL below Org Login URL to sign in to NineData with their DingTalk accounts.