[flyer5200]

Changelog category

• Bug Fix

Changelog entry (Details of this change)

• Bind DingTalk employees by trusted phone number when an OIDC user has no email,
  and select the shallowest assigned department as the primary department.

Affected version

• Latest development version

Background

DingTalk directory synchronization currently binds an OIDC account to an
employee by email. Users without an email can sign in successfully, but their
department memberships are not populated even when a matching DingTalk employee
exists.

The existing primary-department selection also does not consistently reflect
the employee's position in the synchronized organization hierarchy.

Changes

• Read employee phone numbers through the existing DingTalk SDK and include them
  in the synchronized directory snapshot.
• Carry the phone claim from the authenticated OIDC login through the login
  event, including the MFA flow.
• Keep email matching as the primary method. When the OIDC account has no valid
  email, allow a unique trusted phone number to establish the initial employee
  binding.
• Reject ambiguous phone matches and preserve the existing one-to-one binding
  to the DingTalk employee ID, so later phone changes do not automatically
  transfer an account to another employee.
• Normalize supported phone formats before matching and keep matching scoped
  to the configured data source.
• Select the shallowest department actually assigned to the employee as the
  primary department, with a stable tie-breaker for departments at the same
  level. Other local department memberships are retained.
• Add database migration, synchronization diagnostics, and localized
  configuration guidance for phone matching.

Phone-based matching relies on the OIDC provider supplying a trusted phone
claim that users cannot change to impersonate another employee. The DingTalk
application must also have access to employee phone numbers.

Validation

• Data source integration tests, including phone matching, duplicate numbers,
  login before synchronization, email priority, stable binding, and primary
  department selection.
• DingTalk SDK adapter and OIDC sign-in tests.
• Checkstyle, SpotBugs, PMD, database migration checks, frontend type checking,
  and localization key checks.
• Verified the Docker image in the target environment.