Integrate Slack with Identity as a Service
Slack provides a business communication platform. Slack offers many IRC-style features, including persistent chat rooms organized by topic, private groups, and direct messaging (see https://slack.com/). You can protect access to Slack by integrating Slack with Identity as a Service. Once integrated, users can use single sign-on to log in to their Slack account through Identity as a Service.
Note: This guide was tested using previous versions of Identity as a Service and Slack. Other versions of Slack may require integration and configuration steps that differ from those documented in this procedure. For newer versions of Slack, this integration guide may be used as an initial approach for integrating Slack. In the event of other issues, contact support@entrust.com for assistance.
To integrate Slack with Identity as a Service, you must do the following:
Step 1: Add Slack to Identity as a ServiceStep 1: Add Slack to Identity as a Service
Add Slack as an application to Identity as a Service
Log into your Identity as a Service administrator account.
Click 
> Security > Applications. The Applications Lists page appears.
Click Add. The Select an Application Template page appears.
Do one of the following:
Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.
- or -
In the Search bar, enter a search option to filter for the application you want to add to IDaaS.
Click Slack. The Add Slack page appears.
Enter an Application Name.
Enter an Application Description.
Optional. Add a custom application logo.
Click 
next to Application Logo. The Upload Logo dialog box appears.
Click 
to select an image file to upload.
Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
If required, resize your image.
Click OK.
Select the Authentication Flow that appears to users during login.
Click Next. The General page appears.
If available, use the Upload Metadata XML file option to auto-populate the following fields, if available in the file:
Default Assertion Consumer Service URL
Alternative Assertion Consumer URLs
Service Provider Entity ID (Issuer)
Single Logout Service URL
SAML Signing Certificate
SAML NameID Encoding Format
SAML Signature Algorithm
Click 
to the Upload Metadata XML and browse to the location of the metadata file you downloaded. The Metadata Configuration dialog box appears.
If required, click Merge with existing values to merge new values with existing values for Alternative Assertion Consumer Services URLs and SAML attribute names.
Click Save.
If you do not have a metadata file, use the information provided in the next steps to populate the fields.
Enter the Default Assertion Consumer Service URL for the application.
Example: https://mycompany-workspace.slack.com/sso/saml
Enter the Service Provider Entity ID (Issuer) that is used by Identity as a Service to identify the application.
Example: https://mycompany-workspace.slack.com
Leave the Single Logout Service URL field blank.
Optional. Enter the SAML Username Parameter Name used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID.
Enter the SAML Session Timeout to the time when the SAML Assertion times out. The maximum is 720 minutes.
Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.
From the SAML Name ID Attribute drop-down list, select the user attribute that will be used to uniquely identity a user to both Identity as a Service and the application. The attribute should be one that will never change.
Select the SAML Signing Certificate from the drop-down list.
Optional: Select Sign complete SAML response to ensure the message integrity of the SAML response sent to the application during authentication.
Deselect Enable Go Back Button if you do not want users to be able to go back to the Slack login page to log in.
Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.
Optional: Select Encrypt SAML Assertion. When selected the SAML Assertion is also encrypted. If you select this option, do the following:
From the Encryption Method for Key drop-down list, select either RSA Version 1.5 or RSA-OAEP. RSA Version 1.5 is the default.
From the Encryption Method for Data drop-down list, select the encryption method used to encrypt data. The options are:
AES-256 (default)
AES-128
AES-192
Triple DES
In the Encryption Certificate field, upload the encryption certificate file.
Note: The Subject Domain Name and Certificate Expiry Date values are populated with values from the certificate once the Encryption Certificate is uploaded.
Optional. Add Alternative Assertion Consumer Service URLs, as follows:
Click Add.
Enter a Name.
Enter a URL Value.
Select Show in My Profile to display the Alternative Consumer Service URL in a user's My profile page.
Optional. Add an Application Logo.
Click Add.
Repeat these steps to add more Alternative Assertion Consumer Service URLs.
Optional. Add a Relay State as follows:
Under Relay State, click Add. The Add Relay State dialog box appears.
Enter a Name for the relay state.
Enter the Value for the relay state. This setting specifies the application or URL that is a user is redirected to after successful authentication.
Select Show in My Profile to display the relay state on the user's My Profile page.
Note: After you add relay states, you can also enable or disable them on the Add/Edit application page. Click 
next to the relay state to disable it or click 
to re-enable it.
Relay states apply to the Default Assertion Consumer Service URLs and not the Alternative Assertion Consumers URLs.
Optional. Add a Relay State as follows:
Under Relay State, click Add. The Add Relay State dialog box appears.
Enter a Name for the relay state.
Enter the Value for the relay state. This setting specifies the application or URL that is a user is redirected to after successful authentication.
Select Show in My Profile to display the relay state on the user's My Profile page.
Notes: After you add relay states, you can also enable or disable them on the Add/Edit application page. Click next to the relay state to disable it or click to re-enable it.
Relay states apply to the Default Assertion Consumer Service URLs and not the Alternative Assertion Consumers URLs.
Optional. Add a Relay State custom logo.
- Click next to Relay State Logo. The Upload Logo dialog box appears.
- Click to select an image file to upload.
- Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
- If required, resize your image.
- Click OK.
Click Add.
Repeat these steps to add more Relay States.
Leave the attribute settings at the default values.
Click Submit.
Step 2: Add a resource ruleStep 2: Add a resource rule
Step 3: Export the signing certificateStep 3: Export the signing certificate
Export a SAML signing certificate
Log in to your Identity as a Service administrator account.
Click > Security > Applications. The Applications List page appears.
Under SAML Cloud Integrations, click SAML Signing Certificates. The SAML Signing Certificates page appears.
Click 
next to the certificate to export the certificate you want to import into your SAML service provider application. The Export Certificate dialog box appears.
If the certificate has been issued by a CA, do one of the following:
Click Certificate to export the self-signed certificate.
Click Root CA Certificate to export a certificate issued from a CA.
Click Certificate Chain to export the SAML signing certificate and its CA certificates.
Click Export.
Step 4: Add Identity as a Service as an Identity Provider to SlackStep 4: Add Identity as a Service as an Identity Provider to Slack
Add Identity as a Service as an Identity Provider in Slack
Log in to your Slack Workspace.
Click your workspace name at the top of the navigation pane.
Select Administration > Workspace Settings. The Settings and Permissions page appears.
Click the Authentication tab. The SAML Authentication Settings appear.
Click Change Settings. The Configure SAML Authentication page appears.
Ensure that Configure is selected at the top of the page. If it is not, toggle to it to Configure.
In the SAML 2.0 Endpoint HTTP field, enter the login URL.
Example: https://mycompany.us.trustedauth.com/api/saml/SAML2/SSO
In the Identity Provider Issuer field, enter the Entity ID for the for Identity as a Service, for example, https://mycompany.us.trustedauth.com/api/saml.
In the Public Certificate field, click Edit.
Paste the contents of the Signing Certificate that you copied in Step 3: Download the Signing Certificate into the certificate field.
Under Advanced Options, click Expand.
In the Service Provider Issuer field, enter the SP Entity ID.
Example: https://mycompany-workspace.com.
The default is https://slack.com.
Under Choose how the SAML response from your IDP is signed, select either Responses Signed or Assertions Signed. The default is Responses Signed.
Optional. Under Settings, select the following, as required:
Click the following, as required to allow users to edit their profile information (like their email or display name) after SSO is enabled.
Update profile each time a user logs in
Allow users to change their email address
Allow users to choose their own display name
Under Authentication for your workspace must be used by, set whether SSO is required, partially required, or optional, as follows:
Click All workspace members to require Identity as a Service authentication for all members.
Click All workspace members except guest accounts to require Identity as a Service authentication for members only and not guests.
Click It's optional to allow members to choose to use either Identity as a Service authentication or the default authentication.
Optional. Under Customize, enter a Sign In Button Label.
Click Save Configuration.