Slack Cloud App SSO. Configuration Guide. Product Release Document Revisions Published Date

Transcription

1 Slack Cloud App SSO Configuration Guide Product Release Document Revisions Published Date May 2016

2 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose CA by Pulse Secure, LLC. All rights reserved. Pulse Secure and the Pulse Secure logo are trademarks of Pulse Secure, LLC in the United States. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Pulse Secure, LLC assumes no responsibility for any inaccuracies in this document. Pulse Secure, LLC reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Slack Cloud App SSO Configuration Guide The information in this document is current as of the date on the title page. END USER LICENSE AGREEMENT The Pulse Secure product that is the subject of this technical documentation consists of (or is intended for use with) Pulse Secure software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA. Revision History The following table lists the revision history for this document. Revision Date Description 1.0 May 12, 2016 Initial publication 2016 Pulse Secure, LLC. 2

3 Table of Contents CHAPTER 1 SLACK CONFIGURATION... 5 STEPS TO CONFIGURE... 5 CHAPTER 2 CLOUD SECURE CONFIGURATION FOR SLACK... 8 STEPS TO CONFIGURE... 8 GENERATING X509 CERTIFICATES CHAPTER 3 WORKSPACE CONFIGURATION FOR SLACK STEPS TO CONFIGURE CONFIGURING IN IOS DEVICE Pulse Secure, LLC. 3

4 List of Figures Figure 1 Create New Slack Team... 5 Figure 2 Setting values... 6 Figure 3 Settings... 7 Figure 4 Virtual Port... 8 Figure 5 SAML IdP Settings... 9 Figure 6 Add Service Provider Figure 7 Allowed Server Figure 8 Add Policy Figure 9 Modify VPN Properties Figure 10 Add App Rule Figure 11 Create New User Pulse Secure, LLC. 4

5 Chapter 1 Slack Configuration Steps to Configure Note: Pulse Connect Secure (Identity Provider) to be configured first as Slack attempts to SSO at the end of configuration. Create an admin account in the Slack using the following link To create Slack domain follow the below steps: 1. Signup with your address. 2. Enter the Company or Team name to name Slack account. 3. Enter the Slack URL (for example : 4. Enter the Username (for example: pulse123) and Click on Finish to confirm the Slack details to create new Slack team. Figure 1 Create New Slack Team Note: Upgrade the account to Plus Plan for Single Single-On support Pulse Secure, LLC. 5

6 To setup the Domain: 1. Login to domain (for example: https ://< DOMAIN>.slack.com/admin). 2. Select Team Settings-> Authentication-> SAML Authentication Settings under Administration. 3. Select Change Settings. 4. Set the following values: a. SAML 2.0 Endpoint (HTTP): Enter the Alternate Host FQDN for SAML parameter set in PCS under System->Configuration->SAML->Settings (for example: Alternate FQDN>/dana-na/auth/saml-sso.cgi). b. Public Certificate : Copy a Certificate out of PCS Metadata to X509 Certificate, Save and upload it here (Generating X509 Certificates) c. Under Advanced Option, enter AuthnContextClassRef as Don t send this value. Figure 2 Setting values 5. Under Settings, uncheck a. Enable identity provider user profile syncing. b. Allow users to change their address c. Allow users to choose their own username. 6. Click on Save Configuration 2016 Pulse Secure, LLC. 6

7 Figure 3 Settings 2016 Pulse Secure, LLC. 7

8 Chapter 2 Cloud Secure Configuration for Slack Steps to Configure The steps to configure Cloud Secure Configuration for Salesforce: 1. Login to Pulse Connect Secure admin console. 2. Choose Network-> Internal Port-> Virtual Port to create a new port with a new IP to redirect URL given for SSO in Service Provider. Figure 4 Virtual Port 3. Navigate to System-> Configuration-> SAML->Settings a. Enter Host FQDN for SAML (for example : ppsqa.pulsesecuredev.net) b. Enter Alternate Host FQDN for SAML (for example : ppsqa-sso.pulsesecuredev.net ) Note: Alternate Host FQDN for SAML is DNS Host name for virtual port IP which is configured in Slack Configuration step Go to Authentication->Signing In->Sign-in SAML->Identity Provider. a. Enable both Post and Artifact b. Enable Reuse Existing NC and Accept Unsigned AuthnRequest. c. Under User Identity, select Subject Name format as Address and Subject Name as <USERNAME>@pulsesecure.net Pulse Secure, LLC. 8

9 Figure 5 SAML IdP Settings 5. Click on Add SP to add Slack Service Provider on the configuration page: a. Select Configuration mode as Metadata. b. Enter the Entity ID (the Entity ID will be the Slack domain). c. Enter Assertion Consumer Service URL (for example : d. Enable Override Default Configuration and Reuse Existing NC (Pulse) Session. e. Click on Save Changes Pulse Secure, LLC. 9

10 Figure 6 Add Service Provider 6. Go to Users-> User Roles-> Users-> SAM-Applications. 7. Click on Add Server and enter the following details: a. Enter the Name to identify the server. b. Enter the Allowed Server and Ports ( mention the virtual port IP and port created in Step2) Figure 7 Allowed Server 8. Go to Users-> Resource Policies -> SAM -> Access Control -> Access to create a new policy allowing all the resources applicable to all the roles Pulse Secure, LLC. 10

11 Generating X509 Certificates The steps to generate X509 certificate are as follows: 1. Login to Pulse Connect Secure as admin. 2. Go to Authentication->Signing In->Sign-in SAML->Metadata Provider. 3. Click on Download Metadata, an XML file will be downloaded. 4. Create a new file by copying the certificate content from the file. 5. Cert metadata should be copied between -----BEGIN CERTIFICATE----- xxxxxxxxxxxxx -----END CERTIFICATE Save the file in.der format. 6. Download OpenSSL and install on your device, OpenSSL can be availed from the location \\ \storage\personal\khemanth\openssl-0.9.8h-1-bin.zip. 7. Run the following command to generate a.cer extension cert out of.der file x509 -in <cert path> - ouform der -out newcert.cer 8. Upload this certificate to Slack. Note: X509 Certificate can generated only after completion of the Pulse Connect Secure Identity Provider configurations Pulse Secure, LLC. 11

12 Chapter 3 Workspace Configuration for Slack Steps to Configure To define a Workspace Configuration for Salesforce follow the below steps: 1. Login to the Pulse One admin console. 2. Select Policies -> Add to create a new policy. Figure 8 Add Policy 3. Modify the VPN properties to support per app VPN. Figure 9 Modify VPN Properties 4. Navigate to ios app rules-> Add, to add new application. Enter the application name on the search lists and select to add Pulse Secure, LLC. 12

13 Click on Next to continue. Select per app VPN for Network Access and Save the changes. Click on Publish. Figure 10 Add App Rule 5. Go to Mobile Workspace-> Action-> Add to create a new user and Click Confirm. Figure 11 Create New User 2016 Pulse Secure, LLC. 13

14 Configuring in ios Device The steps to follow configuring in ios device: 1. Install Pulse Client on the ios device. 2. The Welcome Mail to the Pulse Workspace will be sent to the user to register and install profiles on device. 3. Open the Slack app and select Sign in with your Identity Provider. 4. The application is installed with Secure Sign-On Pulse Secure, LLC. 14