Integrate with Slack

Use JumpCloud SAML Single Sign On (SSO) to give your users convenient but secure access to all their web applications with a single set of credentials. Provision, update, and deprovision users in Slack in real-time from JumpCloud using the SCIM integration.

Read this article to learn how to setup the Slack integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO à la carte option
• A Slack Business+ or Enterprise Grid plan
• A Slack Administrator or Workspace Owner account
• Your Slack domain and team name

Important Considerations

• We recommend that you activate SSO for Slack prior to creating an SCIM integration with Slack to simplify the login process for your users and reduce the number of usernames and passwords they have to remember
  • If you choose to not activate SSO, deselect Show this application in the User Portal in the General Info tab of the Slack configuration window. This will hide the inactive Slack tile from your users
• SAML is the recommended method for managing secure user authentication into Slack
• Once you’ve set up SSO, members that are required to sign in with SSO will get an email. The email will prompt members to bind their Slack accounts with JumpCloud. Members will have 72 hours to bind their account before their link expires
• The email address of the JumpCloud accounts must correspond to the email address associated with the Slack Plus accounts
• JumpCloud Session Settings are not passed into Slack, session duration will need to be set in Slack as well 
• If you are setting up Slack SCIM Integration for an organization that is managed from the Multi-Tenant Portal (MTP), you need to use a local JumpCloud administrator from that particular organization to do so
• Users that are created in Slack remain in an ‘Inactive’ state until they log in to their JumpCloud User Portal and launch Slack using their JumpCloud credentials
• If you delete an integrated Slack application from your Applications list, the Slack application is removed from JumpCloud, but any previously bound users remain active in Slack. Additionally, these users can log in to Slack with the password they used prior to your deletion of the Slack application from your JumpCloud account
• Users can’t be permanently deleted from Slack, they can only be deactivated
• If you try to provision a user with a duplicate email address, it will fail. Even if the existing user has been previously deactivated in Slack, the existing user email address has to be manually updated in Slack to unbind the email and allow it to be reprovisioned
• When creating a new user, make sure that nothing is invalid in the custom profile, otherwise all profile fields will be dropped
• Creating or deactivating a Multi-Channel Guest is only available on the Enterprise Grid Plan
• When creating a Single-Channel Guest, or creating a guest on the Business+ plan, you can create a member and then change their role to a guest
• Group mention handles (@group) can’t be set via the SCIM provisioning API
• Subteams that are automatically generated by Slack, like “Team Admins,” can’t be updated via the SCIM API 
• The SCIM API is rate limited. If your requests are being limited, an “HTTP: 429” error will be returned 
• Don't add the same user group to multiple Slack connectors in JumpCloud. If you do, users who are members of that user group will be deactivated in the application if one of the connectors is removed from the user group
• Slack maps the value sent for the 'title' user attribute to both the ‘title’ and 'What I do’ field.  If users have been given the ability to change the "What I do value in Slack", their change will be overridden whenever a user update is sent via the SCIM integration.  The mapping to the 'What I do' field is completely controlled by Slack
• Groups are supported - see Group Considerations

Attribute Considerations

• A default set of attributes are managed for users. See the Attribute Mappings section for more details
• Slack does not store type for addresses. The type field will be used to determine which address is the "primary address" if the request does not specify one, however the type is not stored
• Username values and channel name values must be unique and share the same namespace. For example, you can't have a username for @general if you also have a #general channel in the Slack workspace
• There is a limit of 50 custom profile fields, which includes fields set via the SCIM API. If your request would cause more than 50 fields to exist, the call will fail with a unable_to_create_team_profile_fields error
• username:
  • You can't use special characters, such as john+doe@email.com
  • Must be less than 21 characters
  • Must be unique
• displayName:
  • Values aren't entirely unique; for example, two users can have the same display name
  • You can use non-English characters, spaces, and capitalization
  • You can include periods ( . ), underscores ( _ ), hyphens ( - ), apostrophes ( ' ), brackets ( { }, [ ] ) and separators ( , / ; )
• Slack only allows matching with the attributes userName and email

Group Considerations

• We recommend selecting Enable management of User Groups and Group Membership in this application to make channel membership management easier
• A Slack Enterprise Grid SCIM integration can only create and manage IdP Groups, not User Groups. User Groups can only be managed through the Slack interface directly or a completely different API. See Connect identity provider groups to your Enterprise Grid org
  • To automate the management of User Groups when using Slack Enterprise Grid, you will need to create and run your own script to utilize the https://slack.com/api/usergroups API endpoint to perform user group management operations
• If the Enable management of User Groups and Group Membership in this application is enabled, groups cannot be added back to the Slack application after being removed
• Removing a group after it has been added to the Slack application in JumpCloud typically results in the group being disabled in Slack
• Adding the group back to the Slack application in JumpCloud results in errors and fails, because there is no functionality in the SCIM protocol for enabling and disabled groups

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Click + Add New Application.
4. You can also enter the name of the application in the Search field and select it.
5. You can either select an application from the available list or select Custom Application, and click Next.
6. Select the required options from the Select Options page and click Next. The Enter General Info page is displayed.
7. On the Enter General Info page, you can customize the display label, description and how the application displays:
   • Description - add a description that users will see in their user portal
   • User Portal Image - choose Logo or Color Indicator
   • Show in User Portal - select to ensure the app is visible in the user portal
8. Optionally, expand the Advanced Settings section and customize the IdP URL:
   • Enter a custom value to replace the default application name in the SSO IdP URL endpoint ( https://sso.jumpcloud.com/saml2/{custom_value})

9. Click Save Application.
10. Next, click:
    • Configure Application and go to the next section
    • Close to configure your new application at a later time

Configuring the SSO Integration

To navigate to your JumpCloud SSO connector

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Create a new application or select it from the Configured Applications list.
4. Select the SSO tab.

To configure JumpCloud

1. Replace any instances of YOURDOMAIN and TEAMNAME with your Slack values.
2. Optionally, configure:

3. Click Save.

Download the certificate

1. If you closed the application, find it in the Configured Applications list and click anywhere in the row to reopen its configuration window.
2. Click Actions > Download Certificate.

To configure Slack

1. Login your Slack account as a Workspace Owner.
2. Go to Settings & administration > Workplace settings.
3. Select the Authentication tab, then click Configure for SAML Authentication.
4. Enter the following information:
   • SAML 2.0 Endpoint (HTTP) - enter the JumpCloud IdP URL
   • Identity Provider Issuer - enter the JumpCloud IDP Entity ID
   • Certificate - copy and paste the contents of the certificate downloaded in the previous section
5. Under Advanced Options:
   • Use the default value for the Service Provider Issuer (e.g., https://<teamname>.slack.com)
   • Uncheck Assertions Signed

6. Select any other of the desired options for SAML Authentication for users and workspace.
7. Click Save Configuration.

9. In the Customize section in the Sign In Button Label field, enter JumpCloud.
10. Click Save Configuration.
11. You will then be sent to the JumpCloud User Portal to perform an initial SSO login and confirm the configuration.
12. After you have completed SSO as the administrator account, your authentication settings will be verified and enabled.

Using JIT Provisioning

Additional attributes are required to use JIT provisioning. JIT required attributes are prepopulated and are on by default to enable JIT provisioning. You can’t edit the JIT required service provider attributes. You can customize the JumpCloud attribute name and the constant value for JIT required attributes. Toggle off the attributes to opt out of sending the attributes in the SAML assertion.

To complete the provisioning process

1. Authorize a user’s access to the application in JumpCloud.  
2. Have the user log in to the application using SSO. The SAML assertion passes from JumpCloud to the service provider, and gives the service provider the information it needs to create the user account.

Configuring the SCIM Integration

To navigate to your JumpCloud SCIM connector

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Create a new application or select it from the Configured Applications list.
4. Select the Identity Management tab.

To configure JumpCloud

1. Expand Configuration Settings and deselect Enable management of User Groups and Group Membership in this application if you do not want to provision, manage, and sync groups.
2. Review and edit any user attribute mappings.

3. Click Configure.
4. You're redirected to Slack to give JumpCloud permission to access your organization's Slack workspace. Click Allow.

5. You will receive a confirmation that the SCIM integration has been successfully verified.
6. Select Slack from the Configured Applications list and select the Identity Management tab.
7. Paste the token that was generated and then click Activate.

Attribute Mappings

The Export Attributes Mapping table lists the Required and Optional Mappings that JumpCloud sends to the Service Provider. See Attribute Considerations for more information regarding attribute mapping considerations. 

Learn about JumpCloud Properties and how they work with system users in our API. 

Modifying User Attributes

To add user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. Expand the Export Attribute Mapping section and click Edit. The Optional Mappings table will open.
3. Scroll to the bottom of the table and click +Add Attribute.
4. Select one of the mapping types:
   • Direct Mapping (JSON Path) - send the value from a user attribute in JumpCloud directly to an attribute in the service provider
     • From the JumpCloud Attribute dropdown, select the desired attribute
       • If you choose “Custom User Attribute” you must type the name of the attribute exactly as it on the user details page. To see the dropdown again, you must delete the attribute and add a new attribute
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Expression - transform or combine multiple user attributes into a single, custom value before sending it to the service provider
     • Enter the expression in the JumpCloud Attribute field
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Constant - send a fixed, predefined value—like a specific company name —for every user to the service provider
     • This is a free text field with no validation, e.g., the attribute must match exactly, including case, to the corresponding attribute in the user record. Once the custom attribute is added, you must delete it and readd a new custom attribute to see the dropdown again.
5. Repeat these steps for additional attributes.
6. Click Preview Mappings to review the User Schema.
   • If you do not select a specific user from the Preview Filter dropdown, the schema will default to the first user.

7. Click Update.

To modify existing user attributes

This enhancement gives you complete control over the user attributes sent from JumpCloud to this application. You can now:

• Fully control mappings - define which JumpCloud attribute or source data corresponds to an attribute in the SP's SCIM schema
• Use a variety of source values - map data from the user's standard attributes, Manager field, custom attributes, or other data sources
• Manipulate data with expressions - transform data, such as preferred first names and date format, using expressions before transmission to the SP. Learn more
• Preview changes - review your new mappings to ensure accuracy before you save

1. From your connector’s configuration page, select the Identity Management tab.
2. Expand the Export Attribute Mapping section and click Edit.
3. For the type of attribute you would like to modify:
   • Direct - select the new attribute from the dropdown(s)
   • Expression - click in the Expression field and make the desired edits. If necessary, select the new attribute from the SCIM Attribute dropdown
   • Custom - delete the existing values in either or both of the attribute fields and enter the new values
4. Click Preview Mappings to review the updated User Schema.
5. Click Update.

Deleting user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. In the Export Attribute Mapping section, click Edit. The Optional Mappings table will open.
3. Click Delete () to remove any optional attributes.

4. When finished, click Update.

Restoring default user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. In the Export Attribute Mapping section, click Edit. The Optional Mappings table will open.
3. Scroll to the bottom of the table and select Restore Defaults.
4. Click Update and then click Save.

---

SCIM Directory Insights Events

The following Directory Insights (DI) events provide visibility into failures and detailed information about the user and group data being added or updated from HR or other external solutions to JumpCloud.

SCIM DI Group Events

Removing the Integration

To deactivate the SCIM Integration

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open the configuration window. 
4. Click Actions > Deactivate IdM and then click confirm.

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO. 
7. Click Save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.