Skip to main content

Feishu SSO

Feishu SSO lets enterprise users sign in to QwenWork Premium with their Feishu identity.

Feishu SSO lets enterprise users sign in to QwenWork Premium with their Feishu identity. Enter the app credentials in QwenWork, copy its callback, then configure the redirect, permissions, user availability, and publication in the same Feishu custom enterprise app.

Prepare the app

You need administrator access to both platforms.
ItemPurpose
App ID and App SecretIdentify the app and call Feishu; obtain them from Credentials and basic information
contact:user.employee_id:readonlyRead the default user_id identity
contact:user.email:readonlyRead email when required by the mapping
contact:user.phone:readonlyRead phone when required
Redirect URLCopy from the QwenWork provider to return sign-in

Authorize the Feishu app

  1. Open the Feishu developer console and confirm the enterprise.
  2. Create or open the dedicated custom enterprise app.
  3. Obtain the App ID and App Secret securely.
  4. Enable app sign-in permissions. For the default user_id, grant access to the user's user ID. Request the email and phone permissions needed by the mappings.
  5. Add the intended users to the app's availability scope.
  6. Create and publish a version in version management before testing. Recheck publication requirements after permission or availability changes.
If this app also synchronizes the directory, add the permissions described in Users / User sync / Feishu user sync.

Configure QwenWork

  1. Open Users → Authentication → SSO login and configure or edit Feishu.
  2. Enter the same app's App ID and App Secret. A blank secret on edit preserves the saved value.
  3. Leave the private deployment domain blank for ordinary Feishu. Enter the actual private-environment address where applicable.
  4. Copy the callback URL.
 Admin console: Feishu credentials, callback, and user mappings.

Register the redirect

  1. In the same Feishu app, open Development configuration → Security settings.
  2. Paste the complete copied callback into Redirect URL, add it, and save.
  3. Use the callback from the current environment, rather than a QwenWork home-page URL or screenshot example.
  4. Publish a new app version if permissions or user availability changed.

Check user mappings

QwenWork fieldNew-provider default
External user IDuser.user_id
User nameuser.name
Emailuser.enterprise_email
Keep external user ID and name. Map at least one of email, phone, employee number, or account, with at least one non-empty returned value for automatic creation. Sources can be selected from the supported fields; targets are fixed. Make SSO user.user_id and sync user_id identify the same user. user_id, open_id, and union_id are different identifiers.

Choose automatic creation

Keep it off for users already created by sync or import. To create users on first sign-in, enable it and select the default department. Automatic seat assignment requires automatic creation.

Save, enable, and verify

  1. Save the complete provider.
  2. Optionally test App ID and App Secret token retrieval. This does not verify redirects, permissions, user scope, profile fields, or complete sign-in.
  3. Enable Feishu; only one provider can be active.
  4. Enable SSO in Sign-in methods separately.
  5. Ask an ordinary user to sign in and check the enterprise, name, departments, and seat.

Troubleshooting

SymptomCheck
Invalid redirectCompare the complete copied callback with Feishu's saved security setting
App creator succeeds but ordinary users failCheck availability scope, effective permissions, published version, and enterprise membership
User not foundCompare user.user_id with the external ID and check automatic creation
Automatic creation failsCheck the default department and mapped, non-empty identity fields
Name exists but email is emptyCheck email permission, publication, and the user's email profile
Account creation fails after authenticationOpen Auto-created user records. Check missing identity fields and that the returned email domain matches a trusted domain. At least one of email, phone, or employee number must be present where that is the configured identity set.

Existing users and deleted records

SSO matches current users by external user ID only. A conflict-free match preserves the existing profile and sync source. Account, email, phone, or employee-number conflicts with another user reject sign-in. An unmatched ID follows the automatic-creation setting. Deleted history does not restore the old QID. With automatic creation off, sign-in fails; with it on and conflict-free returned data, a new user and QID use the current profile, default department, and seat policy. Previous roles, passwords, seats, and departments are not inherited. History remains. Return to: Users / Authentication / Authentication overview.
Feishu SSO - QwenWork