Developer Guide- Due to the architecture upgrade of the domain gateway, DingTalk security domains will no longer support private SLB access from DingTalk Cloud or Jushita.
- Before creating the association, ensure that a private SLB has been purchased under the Alibaba Cloud account (Compute Nest deployment) associated in the developer console, that the private SLB has an HTTP listener port configured, and that HTTP-to-HTTPS redirection is not configured. Currently, only CLB is supported; ALB is not supported.
- Select a valid SLB and domain to bind. We recommend using “app” + appId as the domain to avoid duplication.
- After you bind a security domain, a PrivateLink endpoint service node is created by default under the cloud account to establish a private channel from the DingTalk security domain gateway to the associated SLB under the cloud account. The PrivateLink endpoint service node is free on the ISV side.
- If the push type is SyncHttp, you must use a DingTalk security domain in the push address of the callback URL.
- The app’s server-side API domain must use a DingTalk security domain.
-
The regions and zones supported by private SLB for the Compute Nest deployment method are as follows:
Procedure
- Sign in to the Developer Console.
- Find the app you created. On the app details page, click DingTalk Security Domain.
-
Select the private SLB to associate and the domain to use, select the authorization agreement, and then click Associate.
Note
After you submit the security domain binding request, wait for the DingTalk security review, which usually takes 1 to 2 business days. Once approved, the process automatically binds the private SLB to the security domain, which takes effect within 1 to 2 business days. Monitor the status updates. If the request is declined, modify and resubmit it.
- Private SLB: A private SLB has been purchased under the Alibaba Cloud account bound to Jushita, DingTalk Cloud, or Compute Nest. Note The SLB must have an HTTP listener port configured. Do not use common HTTPS ports such as 443 or 8443.
- Security domain: We recommend using “app” + appId as the domain to avoid duplication.
Verification Criteria for DingTalk Security Domain Activation
- If the push type of a third-party enterprise app is HTTP or syncHTTP, the push address domain must be a DingTalk security domain.
- If a third-party enterprise app is a mini program, the server-side API requested by the mini program must use a DingTalk security domain.
- If a third-party enterprise app is an H5 micro app with a decoupled front-end and back-end architecture, the server-side API must use a security domain. If it is an integrated front-end and back-end app, the app home page address must use a DingTalk security domain.
FAQ
1. The SLB Has Been Purchased, but the SLB Information Is Not Displayed at the “1 Associate SLB” Stage
Answer: First, perform the following self-checks:- Confirm that a cloud account has been associated in the developer console.
- Confirm that the purchased private SLB is within the supported region range. Compute Nest deployment supports China East 1 (Hangzhou), China North 3 (Zhangjiakou), China North 2 (Beijing), China East 2 (Shanghai), and China South (Shenzhen). Jushita deployment supports only China North 3 (Zhangjiakou), and DingTalk Cloud deployment supports only China East 1 (Hangzhou).
- Confirm that you purchased CLB rather than ALB.
- Confirm that the SLB listener port is configured with the HTTP protocol rather than the TCP protocol.
2. At the “2 Domain Configuration” Stage, the Current Status Shows “Domain Under Review, Please Wait”
Answer: In this case, the security domain is under review and configuration. Normally, the configuration takes 1 business day to complete. Wait 1 business day before checking again. Note Security domain requests for non-production apps will be rejected. For cost reasons on the DingTalk side, security domains are no longer provided for non-production apps such as test apps and staging apps. If you need to test a security domain, first request a security domain for a production app and bind it to the test or staging environment (switch the binding by replacing the ECS group to which the SLB forwards traffic). After verification, switch the binding to the production app.3. At the “3 Use in App” Stage, the Current Status of the Security Domain Is “Domain Binding Failed, DingTalk Admin Processing”
Answer: In this case, the security domain configuration failed. You can submit a ticket to contact DingTalk technical support for manual intervention. After manual intervention, the processing usually takes 1 business day to complete.4. At the “3 Use in App” Stage, the Current Status of the Security Domain Is “Domain Binding Succeeded”, but the Domain Activation Status Is “Security Domain Not Activated”
Answer: In this case, DingTalk has completed the review and configuration of the security domain. You need to complete the security domain configuration on the developer side according to the Verification Criteria for Activation. After the configuration is complete, it can be detected as effective within 1 business day.5. The Originally Bound SLB Is No Longer Used and a New SLB Needs to Be Bound
Answer: Click Modify and select a new SLB to bind:- If you cannot see the SLB information that needs to be rebound, handle it by referring to the first FAQ.
- If you can see the SLB information to be rebound, you can modify it. Normally, the SLB change operation supports lossless switching, but slight service jitter may occur during the rebinding process. The security domain address does not change after the change operation.