FastGPT External Member System Integration and Configuration
If you don't need SSO or member sync, or only need quick login via GitHub, Google, Microsoft, or WeChat Official Account, you can skip this section. This guide is for users who need to integrate their own member systems or mainstream office IMs.
To simplify integration with external member systems, FastGPT provides a set of standard interfaces for connecting to external systems, along with a FastGPT-SSO-Service image that serves as an adapter.
Through these standard interfaces, you can:
SSO login. After a callback from an external system, create a user in FastGPT.
Member and organizational structure sync (referred to as "member sync" below).
How It Works
FastGPT-pro includes a standard set of SSO and member sync interfaces. The system performs SSO and member sync operations based on these interfaces.
FastGPT-SSO-Service aggregates SSO and member sync interfaces from different sources and converts them into the format recognized by fastgpt-pro.
fastgpt-sso: image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.9.0 # This version must match the FastGPT image version container_name: fastgpt-sso restart: always networks: - fastgpt environment: - SSO_PROVIDER=example - AUTH_TOKEN=xxxxx # Auth token, used by fastgpt-pro # Provider-specific environment variables below
Depending on the provider, you'll need different environment variables. Below are the built-in protocols/IMs:
Set the fastgpt-pro environment variable to enable automatic member sync:
env: - "SYNC_MEMBER_CRON=0 0 * * *" # Cron expression, runs daily at 00:00. Note: uses UTC (timezone 0). For example, to sync at 12:00 Beijing time, set this to "0 4 * * *" (UTC 04:00)
Go to the developer console, click on your enterprise self-built app, and enable permissions on the Permission Management page under Development Configuration.
You can use the Batch Import/Export Permissions feature to import the following permission configuration:
Go to the developer console, click on your enterprise self-built app, and set the redirect URL in Security Settings under Development Configuration.
The redirect URL should follow the format https://www.fastgpt.cn/login/provider — replace the domain with your publicly accessible FastGPT domain.
Go to the DingTalk Open Platform, click App Development, select your app, and record the Client ID and Client Secret on the Credentials & Basic Info page.
Go to the DingTalk Open Platform, click App Development, select your app, and manage permissions on the Permission Management page under Development Configuration. Required permissions:
Personal phone number information
Contact personal information read permission
Basic permission to obtain DingTalk open interface user access credentials
Go to the DingTalk Open Platform, click App Development, select your app, and configure on the Security Settings page under Development Configuration.
Two items need to be filled in:
Server egress IP (list of server IPs calling DingTalk server-side APIs)
a. Log in to the WeCom admin console with an admin account: https://work.weixin.qq.com/wework_admin/loginpage_wx
b. Go to the "My Enterprise" page and find the Enterprise ID
Create an internal app for FastGPT:
a. Get the app's AgentID and Secret
b. Ensure the app's visibility scope is set to all (i.e., root department)
A domain name with the following requirements:
a. Resolves to a publicly accessible server
b. Can serve static files at the root path (for domain ownership verification — follow the prompts, you only need to host one static file, which can be removed after verification)
c. Configure web authorization, JS-SDK, and WeCom authorization login
d. You can set "Hide app in workbench" at the bottom of the WeCom Authorization Login page
Get the "Contact Sync Assistant" secret
Retrieving contacts and organization member IDs requires the "Contact Sync Assistant" secret
fastgpt-sso: image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.9.0 container_name: fastgpt-sso restart: always networks: - fastgpt environment: - AUTH_TOKEN=xxxxx - SSO_PROVIDER=wecom # OAuth endpoint, used in WeCom client - WECOM_TARGET_URL_OAUTH=https://open.weixin.qq.com/connect/oauth2/authorize # SSO endpoint, QR code scan - WECOM_TARGET_URL_SSO=https://login.work.weixin.qq.com/wwlogin/sso/login # Get user ID (returns ID only) - WECOM_GET_USER_ID_URL=https://qyapi.weixin.qq.com/cgi-bin/auth/getuserinfo # Get detailed user info (everything except name) - WECOM_GET_USER_INFO_URL=https://qyapi.weixin.qq.com/cgi-bin/auth/getuserdetail # Get user info (has name, no other info) - WECOM_GET_USER_NAME_URL=https://qyapi.weixin.qq.com/cgi-bin/user/get # Get department ID list - WECOM_GET_DEPARTMENT_LIST_URL=https://qyapi.weixin.qq.com/cgi-bin/department/list # Get user ID list - WECOM_GET_USER_LIST_URL=https://qyapi.weixin.qq.com/cgi-bin/user/list_id # WeCom CorpId - WECOM_CORPID= # WeCom App AgentId, usually 1000xxx - WECOM_AGENTID= # WeCom App Secret - WECOM_APP_SECRET= # Contact Sync Assistant Secret - WECOM_SYNC_SECRET=
After entering credentials, users are redirected to redirect_uri with a code parameter:
https://fastgpt.cn/login/provider?code=4/P7qD2qAz4&state=xyz
Access token endpoint. After obtaining the code, make a server-side request to this endpoint to get the access_token, e.g., http://example.com/oauth/access_token
Below is the standard interface documentation for SSO and member sync in FastGPT-pro. If you need to integrate with a non-standard system, refer to this section for development.
FastGPT provides the following standard interfaces:
Warning: Only one root department can exist. If your system has multiple root departments, you need to add a virtual root department first. Return type:
type OrgListResponseType = { message?: string; // Error message success: boolean; orgList: { id: string; // Unique department ID name: string; // Name parentId: string; // parentId — empty string for root department }[];}
type UserListResponseListType = { message?: string; // Error message success: boolean; userList: { username: string; // Unique ID. username must match the username returned by the SSO interface. Must include a prefix, e.g., sync-aaaaa, consistent with the SSO interface prefix memberName?: string; // Name, used as tmbname avatar?: string; contact?: string; // email or phone number orgs?: string[]; // IDs of organizations the member belongs to. Pass [] if no organization }[];}
Self-development: Build according to the standard interfaces provided by FastGPT, then enter the deployed service address into fastgpt-pro.
You can use this template repository as a starting point: fastgpt-sso-template
Custom development by the FastGPT team:
a. Provide the system's SSO documentation, member and organization retrieval documentation, and an external test address.
b. In fastgpt-sso-service, add the corresponding provider and environment variables, and write the integration code.
