DingTalk integration

DingTalk integration supports synchronizing DingTalk contacts to enterprise user management, and also supports DingTalk single sign-on (SSO) and message notifications. This topic describes how to modify related features of Qoder CN through DingTalk sign-in.

​

Prerequisites

Server egress IP: You must provide the outbound IP address of the enterprise instance (Enterprise Dedicated Edition users can contact technical support to obtain it).

​

DingTalk integration configuration

​

Step 1: Create a DingTalk integration

Enterprise administrators can create a DingTalk integration under Enterprise Management > Third-Party Integrations. To create users outside the DingTalk synchronization scope, select Support built-in users. On the right side of the DingTalk integration entry, click Add Configuration.

​

Step 2: Create a DingTalk app

1. You need to create an internal enterprise application on the DingTalk Open Platform. For details, see How to create an internal application. You can also follow the prompts below to fill in the form to create an internal enterprise application, and then click OK to create it. Note the following:

• Application type: Select Mini Program.
• Development method: Select Enterprise Self-development.
• Application icon: Select the icon you want to use.

2. In the left-side navigation pane, select Development Management and fill in the server egress IP.
3. In the left-side navigation pane, select Application Information and record the following key credentials:

• Corpid (enterprise ID)
• AppKey/AppSecret
• AgentId

4. Enter the information from the previous step into the following form, and then click Next. The form includes the following required fields: AgentId, AppKey, AppSecret, and CorpId, which correspond to the credentials you recorded.

​

Step 3: Configure app permissions

1. Qoder CN needs to obtain the corresponding DingTalk permissions to synchronize DingTalk contacts, enable DingTalk sign-in, and push DingTalk message notifications. The required permissions are listed below. Go to the DingTalk Open Platform, and on the Application Details > Permission Management page of the internal application created in Step 1, configure the permissions. To limit the scope of DingTalk contact synchronization, configure the permission scope. The required permissions include: Personal phone number information, Personal avatar information, Contacts management (permissions related to contacts departments and enterprises), and Bot (send messages within the organization). On the Permission Management page of the DingTalk Open Platform, select the corresponding permission category and enable the required permissions.
2. After the configuration on the DingTalk Open Platform is complete, return to the DingTalk integration configuration page in Qoder CN and click Next.

​

Step 4: Account binding and attribute mapping

1. Account binding method: Automatically bind users with the same email address. According to the synchronization policy, Qoder CN automatically binds users in Qoder CN and users in the DingTalk organization who share the same email address.
2. Qoder CN automatically maps and synchronizes DingTalk user information with Qoder CN user information according to the following attribute mapping. Modifying the attribute mapping is currently not supported. After confirming, click Next. The attribute mappings are: Username maps to name, Email maps to email, Mobile maps to mobile, Department maps to Dept_name, Job number maps to job_number, and Nickname maps to nick.

​

Step 5: Enable features

Four features are available and are disabled by default during configuration. If you save the DingTalk integration configuration without enabling any features, you can enable them later on the DingTalk integration details page.

• User and organization synchronization: When enabled, Qoder CN user management stays in sync with DingTalk contacts. Confirm the visibility scope of the DingTalk application.
• Single sign-on: When enabled, users can quickly jump to DingTalk sign-in from the Qoder CN login page and access Qoder CN through DingTalk.
• Message notifications: When enabled, DingTalk message notifications are supported. The message subscription feature in Qoder CN can notify users.
• DingTalk Workbench access to Qoder CN: When enabled, users can open the Qoder CN webpage directly from the DingTalk Workbench.

After all configurations are complete, click Save Configuration to finish the DingTalk integration configuration. This service configuration can be modified later.

​

Feature usage

​

User and organization synchronization policy

​

Enable DingTalk user and organization synchronization

When no other third-party user and organization synchronization is enabled in Qoder CN, you can configure DingTalk user and organization synchronization. You can configure rules for the synchronization schedule, user discrepancy handling, and organization discrepancy handling.

Scenario option	Impact
Data sync schedule	Manual synchronization (Default): After data changes, the enterprise administrator needs to go to the DingTalk integration details page and click Run Manual Sync to complete user and organization synchronization. Scheduled synchronization: You can set it to run daily, weekly, or monthly at a specific time, or at a fixed interval. If you choose scheduled synchronization, we recommend performing a manual synchronization once after saving the configuration to ensure data is updated to Qoder CN in a timely manner. We recommend leaving at least 1 hour between manual synchronizations.
User discrepancy handling: By default, extra accounts in Qoder CN are ignored, and Qoder CN accounts are created and bound for DingTalk accounts within the synchronization scope.	Existing Qoder CN accounts that do not match any DingTalk account: Ignore: When a Qoder CN account does not match a DingTalk account, the extra Qoder CN account is retained. Delete account: When a Qoder CN account does not match a DingTalk account, the Qoder CN account is deleted.
	Existing DingTalk accounts that do not match any Qoder CN account: Ignore: When a DingTalk account does not match a Qoder CN account, no new account is created in Qoder CN. Create a new Qoder CN account and bind it: When a DingTalk account does not match a Qoder CN account, a new account is created in Qoder CN based on the account binding and attribute mapping rules, and is bound to the DingTalk account.
Organization discrepancy handling: By default, extra department nodes in Qoder CN are ignored, and Qoder CN departments are created and bound for DingTalk department nodes within the synchronization scope.	Existing Qoder CN departments that do not match any DingTalk department: Ignore: When a Qoder CN department does not match a DingTalk department, the department node in Qoder CN is retained. Delete department: When an existing Qoder CN department does not match a DingTalk department, the department node in Qoder CN is deleted.
	Existing DingTalk departments that do not match any Qoder CN department: Ignore: When an existing DingTalk department does not match a Qoder CN department, no department node is created in Qoder CN. Create department and bind: When a DingTalk department does not match a Qoder CN department, a corresponding department node is created in Qoder CN and the department nodes on both sides are bound.

​

View user and organization synchronization results

When User and organization synchronization is enabled, open the DingTalk integration details page to view the latest synchronization result: Not Synchronized, Sync Successful, Sync Failed, or Partially Successful.

​

Single sign-on configuration

​

Enable single sign-on

After you turn on the Single sign-on switch, you need to configure the callback URL for Qoder CN in the Redirect URL input field under Application Details > Security Settings of the DingTalk application created in Step 1 to complete the DingTalk single sign-on configuration. After enabling it, the Callback URL is displayed in the System Configuration Information area of the page. Copy this URL and paste it into the corresponding input field in the DingTalk application.

​

Sign in to Qoder CN via DingTalk

After single sign-on is enabled, the Qoder CN login page displays a DingTalk sign-in entry. Click it to go to the DingTalk sign-in page. Users with a bound DingTalk account can sign in to Qoder CN via DingTalk.

​

Enable message notifications

When user and organization synchronization or single sign-on is enabled, you can enable the DingTalk message notification feature. You also need to complete the bot configuration in the DingTalk application. On the Message Push page of the DingTalk application, enable the Bot feature and click Configure. In the dialog box that appears, enter the bot Name, Icon, and Message Receiving URL, and then click Save.

​

DingTalk Workbench access configuration

If you need to access Qoder CN from the workbench on the DingTalk PC client, turn on the switch for DingTalk Workbench access to Qoder CN, and paste the Qoder CN web address into the Application Details > Development Management > PC Homepage URL input field of the DingTalk application created in Step 1. After enabling it, the corresponding web address is displayed on the page. Copy this address and paste it into the corresponding input field in the DingTalk application.

​

Modifying and removing features

​

Modifying or disabling features

On the DingTalk integration details page, if a feature service has been enabled, you can see the Modify Service Configuration button. Click it to modify the feature's settings or disable the feature.

• Modify a service: Adjust settings as needed. On the DingTalk integration details page, the Modify Service Configuration button appears to the right of each enabled service. Click it to make changes.
• Disable a service: Disabling a feature has an impact. See the table below for details.

​

Remove the DingTalk integration

On the DingTalk integration details page, you can click the Remove Integration button. After confirming a second time, the DingTalk integration is removed. After removal:

• The binding between Qoder CN accounts and DingTalk accounts is removed. This does not affect user and organization information that has already been synchronized.
• DingTalk message notifications are no longer supported.
• Signing in to Qoder CN with DingTalk is no longer supported. To sign in to Qoder CN, users can use their Qoder CN username and password.