Skip to main content
Besides SAML 2.0, Alforse can hand sign-in over to your company’s Feishu / Lark or DingTalk organization, or to any OpenID Connect (OIDC) . A company administrator sets this up once on the Single Sign-On page; from then on, people who enter a work email on a verified domain are sent to that provider to sign in.

​
Concepts

  • One connection per company. Your company has one single sign-on connection, with one protocol: OpenID Connect, Feishu / Lark, DingTalk, or SAML. Saving one of the first three on this page replaces a SAML connection (see Switching from SAML).
  • Verified domains route sign-ins. Only email domains you have proven with a DNS record send people to the provider.
  • Invite-first. Single sign-on never creates accounts on its own. A person gets in only as an existing member, or by accepting a pending invitation from your company.
  • Linked accounts. The first successful sign-in links the provider account to the Alforse person. Later sign-ins use that link directly.

​
Before you start

  • Permission. You need permission to change company settings (settings update). Without it the page shows “Administrators only”.
  • Availability. If single sign-on isn’t part of your subscription, the page shows “Single sign-on isn’t in your plan”.
  • Provider access. You need rights to create an application in your identity provider: a custom app in the Feishu / Lark open platform, an internal app in the DingTalk developer console, or an OIDC web application in your IdP.
  • DNS access. You will publish a TXT record for each email domain.

​
Open the Single Sign-On page

  1. Sign in to the ERP at https://app.alforse.com.
  2. In the same browser, open https://api.alforse.com/identity.
If the page shows “Sign in to continue”, select Sign in, sign in to the ERP, and open the address again. The EN / 中文 buttons at the top switch the page between English and Simplified Chinese. The status next to the title reads Active once a connection exists, otherwise Not configured. The page has five cards: Identity Provider, Require single sign-on, Email Domains, Sign-in Links and Linked Accounts. Only Identity Provider shows until you have saved a connection.

​
The Identity Provider card

Select Connect (or Save changes for an existing connection). Alforse checks the settings with the provider before saving and confirms with “Single sign-on saved”.

​
The Redirect URI

Every provider application must use this one redirect (callback) URI:
It is the same for every company and every provider. Copy it from the page rather than typing it.

​
Set up your provider

In the Feishu Open Platform (https://open.feishu.cn, or https://open.larksuite.com for Lark):
  1. Create a custom app (企业自建应用).
  2. Under Credentials & Basic Info, copy the App ID and App Secret.
  3. Under Security Settings → Redirect URLs, add the Redirect URI shown above.
  4. Under Permissions, allow:
    • reading the user’s basic info (required);
    • reading the user’s enterprise email, so people can be matched by email;
    • reading tenant info, if you will leave Tenant key empty in Alforse.
  5. Create a version and publish the app to the people who should sign in.
In Alforse: choose Feishu / Lark, pick the Region that matches the platform you used, paste App ID and App Secret, optionally paste the Tenant key, and select Connect.
  • Only the enterprise email your Feishu tenant issued counts as verified. An address a user typed into their own profile is never used for matching.
  • People without an enterprise email are connected once with a sign-in link.

​
Verify your email domains

Once the connection is saved, add each domain your people sign in with in the Email Domains card: type it under Add a domain (for example example.com) and select Add. A new domain is Pending and shows the TXT record to publish: Publish the record with your DNS provider, then select Verify. On success the domain shows Verified and the page says “Domain verified”. The rules are the same as for SAML: see Verifying a domain.

​
How a sign-in is matched to a person

People sign in from the ERP login page by entering their work email and selecting Continue. An email on a verified domain sends them to your provider. When they come back, Alforse looks only inside your company, in this order:
  1. Linked account. The provider account is already linked to a person: that person is signed in.
  2. Verified email. The provider reports a verified email on one of your verified domains. A matching active member is signed in; a matching pending invitation is accepted and its role applied. The account is then linked.
  3. Sign-in link. The person opened a one-time sign-in link you issued. The account is linked to the member or invitation the link was made for.
Anyone else is refused, and no account is created. For Feishu / Lark and DingTalk, Alforse also checks that the provider account belongs to the tenant key or CorpId saved on your connection. Use the Sign-in Links card to connect a person whose provider can’t prove their email: everyone on DingTalk, and Feishu users without an enterprise email.
  1. Choose a Pending invitation, or type Or an existing member’s email.
  2. Select Create link.
  3. Copy the link from the Sign-in link created dialog and send it to the person yourself.
The link looks like https://api.alforse.com/api/web/auth/v1/sso/oauth/invite?token=…. The person opens it, signs in with the provider, and their account is linked; from then on they sign in normally.
  • Shown once. The link is displayed only in that dialog. If it is lost, revoke it and create a new one.
  • Works once, for 7 days. The table shows each link’s For, Status (Open, Used, Revoked or Expired) and Expires. Select Revoke to cancel an open link.
  • Verified domain required. The email of the invitation or member must be on a verified domain of the connection.
  • Sign-in links are available for OpenID Connect, Feishu / Lark and DingTalk connections, not for SAML.

​
Linked accounts

The Linked Accounts card lists every link with Person, Provider account, Linked by (Verified email or Sign-in link) and Linked. Select Revoke to remove a link. The person’s Alforse account stays; on their next sign-in they are matched again by verified email, or need a new sign-in link.

​
Requiring single sign-on

Turn on Require single sign-on to make your provider the only way in for people on verified domains. Other sign-in methods, such as magic links, are then refused for them. The switch takes effect once at least one domain is verified, so you can test sign-in before you enforce it.

​
Switching from SAML

If your company already uses SAML, the card says “Your company currently signs in with SAML. Saving another provider here replaces it.”
  • Saving an OpenID Connect, Feishu / Lark or DingTalk connection removes the SAML settings (the IdP metadata) from your connection. SAML sign-in stops at that moment.
  • Your email domains and their verification stay, and so does Require single sign-on.
  • While a non-SAML connection is active, the SAML card on Settings → Security can’t be saved. Deactivate the connection on this page first.

​
Deactivating

Select Deactivate in the Identity Provider card and confirm in Deactivate single sign-on. People on your domains no longer sign in through your provider. Domain verifications are removed; linked accounts are kept, so if you reconnect the same provider later, only the domains need verifying again.

​
Troubleshooting