|
| 1 | +--- |
| 2 | +title: Slack |
| 3 | +--- |
| 4 | + |
| 5 | +<span class="badge badge--primary">Support level: authentik</span> |
| 6 | + |
| 7 | +## What is Slack |
| 8 | + |
| 9 | +> Slack is a platform for collaboration, with chat and real-time video capabilities. To learn more, visit https://slack.com. |
| 10 | +
|
| 11 | +## Preparation |
| 12 | + |
| 13 | +The following placeholder will be used: |
| 14 | + |
| 15 | +- You can use <kbd>slack.<em>company</em>></kbd> or <kbd><em>my-workspace</em>.slack.com</kbd> as the FQDN of your Slack instance. |
| 16 | +- You can use <kbd>authentik.company</kbd> as the FQDN of the authentik install. |
| 17 | + |
| 18 | +For additional information about integrating with Slack, refer to their [documentation](https://slack.com/help/articles/205168057-Custom-SAML-single-sign-on). |
| 19 | + |
| 20 | +## authentik configuration |
| 21 | + |
| 22 | +### Step 1. Create custom property mappings |
| 23 | + |
| 24 | +Your Slack integration requires two property mappings, one each for `User.Email` and `User.Username`, so that authentik can retrieve and map these values from Slack. |
| 25 | + |
| 26 | +1. Log in as admin to your authentik instance and then click **Admin interface**. |
| 27 | +2. Navigate to **Customization -> Property Mappings**. |
| 28 | +3. Create the property mapping for `User.Email`. |
| 29 | + 1. On the **Property Mappings** page, click **Create**. |
| 30 | + 2. On the **New property mapping** modal, select **SAML Property Mapping** and then click **Next**. |
| 31 | + 3. Define the required values. In the **Expression** field, define `User.Email` as `return request.user.email`. |
| 32 | +4. Click **Finish**. |
| 33 | +5. Create the property mapping for `User.Username`. |
| 34 | + 1. On the **Property Mappings** page, click **Create**. |
| 35 | + 2. On the **New property mapping** modal, select **SAML Property Mapping** and then click **Next**. |
| 36 | + 3. Define the required values. In the **Expression** field, define `User.Username` as `return request.user.username`. |
| 37 | +6. Click **Finish**. |
| 38 | + |
| 39 | +### Step 2. Create a new authentication provider |
| 40 | + |
| 41 | +1. Navigate to **Applications -> Providers** and then click **Create**. |
| 42 | +2. On the **New provider** modal, select **SAML Provider** and then click **Next**. |
| 43 | +3. Define the following values (values not listed below can be left as default or empty): |
| 44 | + - **Name**: provide a clear name, such as "slack". |
| 45 | + - **Authorization flow**: Authorize Application (`default-provider-authorization-implicit-consent`). |
| 46 | + - **Protocol settings** define the following values: |
| 47 | + - **ACS URL**: `https://_workspace-name_.slack.com/sso/saml` |
| 48 | + - **Issuer**: `https://slack.com`. |
| 49 | + - **Service Provider Binding**: select **Post** |
| 50 | + - **Advanced protocol settings** |
| 51 | + - **Signing Certificate**: select the appproriate certificate for Slack. |
| 52 | + - **Property mappings**: Select the property mappings that you created in Step 1. You can leave the default property mappings and other settings. |
| 53 | +4. Click **Finish** to create the provider. |
| 54 | + |
| 55 | +### Step 3. Create a new application |
| 56 | + |
| 57 | +1. Navigate to **Applications -> Applications** and then click **Create**. |
| 58 | +2. Provide a name for the new application. |
| 59 | +3. Set the provider to the one you just created. |
| 60 | +4. Click **Create**. |
| 61 | + |
| 62 | +:::info |
| 63 | +After you have created the provider and application, and the application is connected to the provider (Step 3 above) the **Overview** tab on the provider's detail page in the Admin UI will display additional information that you will need to configure Slack, using the following steps. |
| 64 | +::: |
| 65 | + |
| 66 | +## Slack configuration |
| 67 | + |
| 68 | +### Step 4. Configure Slack |
| 69 | + |
| 70 | +1. Log in to the Slack Admin Dashboard. |
| 71 | +2. Navigate to the **Configure SAML Authentication** page. |
| 72 | +3. Enter the following values: |
| 73 | + - **SAML 2.0 Endpoint (HTTP)**: copy/paste in the **SSO URL (Redirect)** URL from the provider that you created in authentik. **Example**: `https://_authentik.company_/applications/saml/slack/sso/binding/redirect/` |
| 74 | + - **Identity Provider Issuer**: set to `https://slack.com` |
| 75 | + - **Public Certificate**: add the certificate, which you can download from the authentik provider, under **Download signing certificate**. |
| 76 | +4. Optionally, configure the other settings and customize the Sign in button label. |
| 77 | +5. Click **Save**. |
0 commit comments