Step 1: Add
Slack to Identity as a ServiceSlack provides a business communication platform. Slack offers many IRC-style features, including persistent chat rooms organized by topic, private groups, and direct messaging (see https://slack.com/). You can protect access to Slack by integrating Slack with Identity as a Service. Once integrated, users can use single sign-on to log in to their Slack account through Identity as a Service.
Note: This guide was tested using previous versions of Identity as a Service and Slack. Other versions of Slack may require integration and configuration steps that differ from those documented in this procedure. For newer versions of Slack, this integration guide may be used as an initial approach for integrating Slack. In the event of other issues, contact support@entrust.com for assistance.
Step 1: Add
Slack to Identity as a ServiceAdd Slack as an application to Identity as a Service
1. Log into your Identity as a Service administrator account.
2. Click
> Security > Applications. The Applications
Lists page appears.
3. Click Add. The Select an Application Template page appears.
4. Do one of the following:
● Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.
- or -
● In the Search bar, enter a search option to filter for the application you want to add to IDaaS.
5. Click Slack. The Add Slack page appears.
6. Enter an Application Name.
7. Enter an Application Description.
8. Optional. Add a custom application logo.
a. Click 
next to Application Logo. The
Upload Logo dialog box appears.
b. Click 
to
select an image file to upload.
c. Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
d. If required, resize your image.
e. Click OK.
9. Select the Authentication Flow that appears to users during login.
10. Click Next. The General page appears.
11. If available, use the Upload Metadata XML file option to auto-populate the following fields, if available in the file:
● Default Assertion Consumer Service URL
● Alternative Assertion Consumer URLs
● Service Provider Entity ID (Issuer)
● Single Logout Service URL
● SAML Signing Certificate
● SAML NameID Encoding Format
● SAML Signature Algorithm
12. To import the Metadata file:
a. Click and browse
to select the file. The Metadata
Configuration dialog box appears.
b. If required, click Merge with existing values to merge new values with existing values for Alternative Assertion Consumer Services URLs and SAML attribute names.
c. Click Save.
13. If you do not have a metadata file, use the information provided in the next steps to populate the fields.
a. Enter the Default Assertion Consumer Service URL for the application.
Example: https://mycompany-workspace.slack.com/sso/saml
b. Enter the Service Provider Entity ID (Issuer) that is used by Identity as a Service to identify the application.
Example: https://mycompany-workspace.slack.com
c. Leave the Single Logout Service URL field blank.
14. Optional. Enter the SAML Username Parameter Name used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID.
15. Enter the SAML Session Timeout to the time when the SAML Assertion times out. The maximum is 720 minutes.
16. Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.
17. From the SAML Name ID Attribute drop-down list, select the user attribute that will be used to uniquely identity a user to both Identity as a Service and the application. The attribute should be one that will never change.
18. Select the SAML Signing Certificate from the drop-down list.
19. Optional: Select Sign complete SAML response to ensure the message integrity of the SAML response sent to the application during authentication.
20. Deselect Enable Go Back Button if you do not want users to be able to go back to the Slack login page to log in.
21. Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.
22. Optional: Select Encrypt SAML Assertion. When selected the SAML Assertion is also encrypted. If you select this option, do the following:
a. From the Encryption Method for Key drop-down list, select either RSA Version 1.5 or RSA-OAEP. RSA Version 1.5 is the default.
b. From the Encryption Method for Data drop-down list, select the encryption method used to encrypt data. The options are:
– AES-256 (default)
– AES-128
– AES-192
– Triple DES
c. In the Encryption Certificate field, upload the encryption certificate file.
Note: The Subject Domain Name and Certificate Expiry Date values are populated with values from the certificate once the Encryption Certificate is uploaded.
23. Optional. Add Alternative Assertion Consumer Service URLs, as follows:
a. Click Add.
b. Enter a Name.
c. Enter a URL Value.
d. Select Show in My Profile to display the Alternative Consumer Service URL in a user's My profile page.
e. Optional. Add an Application Logo.
f. Click Add.
g. Repeat these steps to add more Alternative Assertion Consumer Service URLs.
24. Optional. Add a Relay State as follows:
a. Under Relay State, click Add. The Add Relay State dialog box appears.
b. Enter a Name for the relay state.
c. Enter the Value for the relay state. This setting specifies the application or URL that is a user is redirected to after successful authentication.
d. Select Show in My Profile to display the relay state on the user's My Profile page.
Note: After
you add relay states, you can also enable or disable them on the Add/Edit
application page. Click 
next to the relay state to disable it or click 
to re-enable it.
Relay states apply to the Default Assertion Consumer Service URLs and
not the Alternative Assertion Consumers URLs.
e. Optional.
Add a Relay State custom logo.
Click next
to Relay State Logo. The Upload
Logo dialog box appears.
Click 
to select an image file to upload.
Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
If required, resize your image.
Click OK.
f. Click Add.
g. Repeat these steps to add more Relay States.
25. Leave the attribute settings at the default values.
26. Click Submit.
Step
3: Export the signing certificateExport a SAML signing certificate
1. Log in to your Identity as a Service administrator account.
1. Click
> Security > Applications.
The Applications List page appears.
2. Under SAML Cloud Integrations, click SAML Signing Certificates. The SAML Signing Certificates page appears.
3. Click
next to the certificate to export the certificate
you want to import into your SAML service provider application. The Export Certificate dialog box appears.
a. If the certificate has been issued by a CA, do one of the following:
– Click Certificate to export the self-signed certificate.
– Click Root CA Certificate to export a certificate issued from a CA.
– Click Certificate Chain to export the SAML signing certificate and its CA certificates.
b. Click Export.
Step 4: Add
Identity as a Service as an Identity Provider to Slack1. Add Identity as a Service as an Identity Provider in Slack
2. Log in to your Slack Workspace.
3. Click your workspace name at the top of the navigation pane.
4. Select Administration > Workspace Settings. The Settings and Permissions page appears.
5. Click the Authentication tab. The SAML Authentication Settings appear.
6. Click Change Settings. The Configure SAML Authentication page appears.
7. Ensure that Configure is selected at the top of the page. If it is not, toggle to it to Configure.
8. In the SAML 2.0 Endpoint HTTP field, enter the login URL.
Example: https://mycompany.us.trustedauth.com/api/saml/SAML2/SSO
9. In the Identity Provider Issuer field, enter the Entity ID for the for Identity as a Service, for example, https://mycompany.us.trustedauth.com/api/saml.
10. In the Public Certificate field, click Edit.
11. Paste the contents of the Signing Certificate that you copied in Step 3: Download the Signing Certificate into the certificate field.
12. Under Advanced Options, click Expand.
13. In the Service Provider Issuer field, enter the SP Entity ID.
Example: https://mycompany-workspace.com.
The default is https://slack.com.
14. Under Choose how the SAML response from your IDP is signed, select either Responses Signed or Assertions Signed. The default is Responses Signed.
15. Optional. Under Settings, select the following, as required:
a. Click the following, as required to allow users to edit their profile information (like their email or display name) after SSO is enabled.
– Update profile each time a user logs in
– Allow users to change their email address
– Allow users to choose their own display name
b. Under Authentication for your workspace must be used by, set whether SSO is required, partially required, or optional, as follows:
– Click All workspace members to require Identity as a Service authentication for all members.
– Click All workspace members except guest accounts to require Identity as a Service authentication for members only and not guests.
– Click It's optional to allow members to choose to use either Identity as a Service authentication or the default authentication.
16. Optional. Under Customize, enter a Sign In Button Label.
17. Click Save Configuration.