> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Slack Slack provides a business communication platform. Slack offers many IRC-style features, including persistent chat rooms organized by topic, private groups, and direct messaging (see ). You can protect access to Slack by integrating Slack with Identity as a Service. Once integrated, users can use single sign-on to log in to their Slack account through Identity as a Service. note This procedure was tested using previous versions of Identity as a Service and Slack. Other versions of Slack may require integration and configuration steps that differ from those documented in this procedure. For newer versions of Slack, use this procedure as a starting point for integrating Slack. In the event of other issues, contact for assistance. To integrate Slack with Identity as a Service, you must do the following ## Step 1: Add Slack to Identity as a Service 1. Log into your Identity as a Service administrator account. 2. Click Menu icon **>** **Security > Applications**. The **Applications** **Lists** page appears. 3. Click **Add**. The **Select an Application Template** page appears. 4. Do one of the following: - Select **SAML Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS. - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS. 5. Click **Slack**. The **Add Slack** page appears. 6. Enter an **Application Name**. 7. Enter an **Application Description.** 8. Optional. Add a custom application logo. 1. Click Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears. 2. Click Upload icon to select an image file to upload. 3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image. 4. If required, resize your image. 5. Click **OK**. 9. Select the **Authentication Flow** that appears to users during login. 10. Click **Next**. The **General** page appears. 11. If available, use the **Upload Metadata XML** file option to auto-populate the following fields, if available in the file: - Default Assertion Consumer Service URL - Alternative Assertion Consumer URLs - Service Provider Entity ID (Issuer) - Single Logout Service URL - SAML Signing Certificate - SAML NameID Encoding Format - SAML Signature Algorithm 12. Click Upload icon to the **Upload Metadata XML** and browse to the location of the metadata file you downloaded. The **Metadata Configuration** dialog box appears. 13. If required, click **Merge with existing values** to merge new values with existing values for Alternative Assertion Consumer Services URLs and SAML attribute names. 14. Click **Save**. 15. If you do not have a metadata file, use the information provided in the next steps to populate the fields. 16. Enter the **Default** **Assertion Consumer Service URL** for the application. Example: 17. Enter the **Service Provider Entity ID (Issuer)** that is used by Identity as a Service to identify the application. Example: 18. Leave the **Single Logout Service URL** field blank. 19. Optional. Enter the **SAML Username Parameter Name** used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID. 20. Enter the **SAML Session Timeout** to the time when the SAML Assertion times out. The maximum is 720 minutes. 21. Enter the **Max Authentication Age (seconds)** to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature. 22. From the **SAML Name ID Attribute** drop-down list, select the user attribute that will be used to uniquely identity a user to both Identity as a Service and the application. The attribute should be one that will never change. 23. Select the **SAML Signing Certificate** from the drop-down list. 24. Optional: Select **Sign complete SAML response** to ensure the message integrity of the SAML response sent to the application during authentication. 25. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the Slack login page to log in. 26. Select **Show Default Assertion Consumer URL Service in the My Profile**. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs. 27. Optional: Select **Encrypt SAML Assertion**. When selected the SAML Assertion is also encrypted. If you select this option, do the following: 1. From the **Encryption Method for Key** drop-down list, select either **RSA Version 1.5** or **RSA-OAEP**. RSA Version 1.5 is the default. 2. From the **Encryption Method for Data** drop-down list, select the encryption method used to encrypt data. The options are: - AES-256 (default) - AES-128 - AES-192 - Triple DES 3. In the **Encryption Certificate** field, upload the encryption certificate file. note The **Subject Domain Name** and **Certificate Expiry Date** values are populated with values from the certificate once the **Encryption Certificate** is uploaded. 28. Optional. Add **Alternative Assertion Consumer Service URLs**, as follows: 1. Click **Add**. 2. Enter a **Name**. 3. Enter a URL **Value**. 4. Select **Show in My Profile** to display the Alternative Consumer Service URL in a user's My profile page. 5. Optional. **Add an Application Logo**. 6. Click **Add**. 7. Repeat these steps to add more Alternative Assertion Consumer Service URLs. 29. Optional. Add a **Relay State** as follows: 1. Under **Relay State**, click **Add**. The **Add Relay State** dialog box appears. 2. Enter a **Name** for the relay state. 3. Enter the **Value** for the relay state. This setting specifies the application or URL that is a user is redirected to after successful authentication. 4. Select **Show in My Profile** to display the relay state on the user's My Profile page. note After you add relay states, you can also enable or disable them on the Add/Edit application page. Relay states apply to the Default Assertion Consumer Service URLs and not the Alternative Assertion Consumers URLs. 5. Optional. Add a Relay State custom logo. 1. Click Plus icon next to **Relay State Logo**. The **Upload Logo** dialog box appears. 2. Click Upload icon to select an image file to upload. 3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image. 4. If required, resize your image. 5. Click **OK**. 6. Click **Add**. 7. Repeat these steps to add more Relay States. 30. Leave the attribute settings at the default values. 31. Click **Submit**. ## Step 2: Add a resource rule See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md). ## Step 3: Export the signing certificate 1. Log in to your Identity as a Service administrator account. 2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears. 3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML** **Signing Certificates** page appears. 4. Click next to the certificate to export the certificate you want to import into your SAML service provider application. The **Export Certificate** dialog box appears. 5. If the certificate has been issued by a CA, do one of the following: - Click **Certificate** to export the self-signed certificate. - Click **Root CA Certificate** to export a certificate issued from a CA. - Click **Certificate Chain** to export the SAML signing certificate and its CA certificates. 6. Click **Export**. ## Step 4: Add Identity as a Service as an Identity Provider to Slack 1. Log in to your Slack Workspace. 2. Click your workspace name at the top of the navigation pane. 3. Select **Administration > Workspace Settings**. The **Settings and Permissions** page appears. 4. Click the **Authentication** tab. The **SAML Authentication Settings** appear. 5. Click **Change Settings**. The **Configure SAML Authentication** page appears. 6. Ensure that **Configure** is selected at the top of the page. If it is not, toggle to it to Configure. 7. In the **SAML 2.0 Endpoint HTTP** field, enter the login URL. Example: 8. In the **Identity Provider Issuer** field, enter the Entity ID for the for Identity as a Service, for example, . 9. In the **Public Certificate** field, click **Edit**. 10. Paste the contents of the Signing Certificate that you copied in _Step 3: Download the Signing Certificate_ into the certificate field. 11. Under **Advanced Options**, click **Expand**. 12. In the **Service Provider Issuer** field, enter the SP Entity ID. Example: . The default is . 13. Under **Choose how the SAML response from your IDP is signed**, select either **Responses Signed** or **Assertions Signed**. The default is Responses Signed. 14. Optional. Under **Settings**, select the following, as required: 1. Click the following, as required to allow users to edit their profile information (like their email or display name) after SSO is enabled. - **Update profile each time a user logs in** - **Allow users to change their email address** - **Allow users to choose their own display name** 2. Under Authentication for your workspace must be used by, set whether SSO is required, partially required, or optional, as follows: - **Click** **All workspace members** to require Identity as a Service authentication for all members. - Click **All workspace members except guest accounts** to require Identity as a Service authentication for members only and not guests. - Click **It's optional** to allow members to choose to use either Identity as a Service authentication or the default authentication. 15. Optional. Under **Customize**, enter a **Sign In Button Label**. 16. Click **Save Configuration**.