SSOGEN / SSO Applications / Slack SSO: Sign In to Slack Through SSOGEN
Integration
Slack SSO: Sign In to Slack Through SSOGEN
Slack SSO with SSOGEN means people open Slack from My Apps and arrive signed in, with access decided by who is assigned in SSOGEN. This page covers the values to exchange and the assignments that grant access.
Slack SSO with SSOGEN gives your workforce one sign-in, with access granted by group. Slack is the service provider (SAML) or the client (OpenID Connect), and SSOGEN is the identity provider. SSOGEN connects any application that speaks SAML 2.0 or OpenID Connect this way, with no catalog entry needed.
This guide lists the values to copy between the two screens, then the steps to register, test and activate. The Slack administration screen uses its own labels, so match fields by meaning with the table below.
Values to copy for Slack
| SSOGEN field or value | Vendor-neutral name in the application | Direction |
|---|---|---|
| Service provider entity ID | Entity ID, identifier, audience | From Slack into SSOGEN |
| Assertion consumer service URL | ACS URL, reply URL | From Slack into SSOGEN |
| Single logout URL (optional) | Logout URL | From Slack into SSOGEN, if it has one |
| IdP entity ID | Identity provider entity ID, issuer | From SSOGEN into Slack |
| Single sign-on URL | Sign-in URL, login URL | From SSOGEN into Slack |
| Signing certificate | Identity provider certificate | From SSOGEN into Slack |
| Name ID | User matching attribute | Choose in SSOGEN, set the same format in Slack |
If Slack publishes a metadata file, upload it in the Connection step, and SSOGEN fills in the first three rows. In the other direction, importing SSOGEN’s metadata address configures the last four rows at once, including the certificate.
Grant access with groups, not one person at a time
A messaging tool reaches almost everyone, so assign by group rather than by person.
- One assignment covers everyone. Assign a group on the application’s Assignments tab, and every current and future member can open the application.
- Group access persists. A person who is also in an assigned group keeps access through the group when you remove the direct assignment.
- Groups carry over. If the application supports SCIM 2.0, outbound provisioning sends the assigned groups as groups in the application, with the same names.
Register, assign, test and activate
- In the Admin Console, open Applications, then SAML (or OpenID Connect) and start the registration wizard.
- Fill in General and Connection with the values above, choose a Sign-in policy, and set Identify the person by.
- Enter the Launch URL, the address that starts the application’s own SSO sign-in. Selecting Next saves the application, but it stays unavailable.
- Assign a person or group, run Test for a named person, and review the result.
- Select Activate application. The application then appears in My Apps for the people assigned to it.
The full screens and every message appear in Register a SAML application and Register an OpenID Connect application. The test and activation details appear in Assign people, set the sign-in policy, test and activate.
Questions people ask
How does a person open Slack through SSOGEN?
They sign in to SSOGEN, open My Apps and select the Slack tile. The tile sends them through the application’s SSO sign-in and back.
What if the tile shows Not set up yet?
The application has no launch URL, so My Apps has nowhere to send the person. Enter the Launch URL.
Can I remove access quickly?
Yes. Remove the person or group on the Assignments tab, and the tile disappears from My Apps.
Where to go next
- Return to the hub. The SSO applications hub has the protocol comparison and the other guides.
- Choose the protocol. If you are not sure whether Slack belongs under SAML or OpenID Connect, read Choose how to connect an application.
- See it working. To see Slack SSO with group assignment working, request a trial.