Your users can use SAML single sign-on (SSO) to sign in to C2 Identity-integrated apps without having to enter their credentials again.

This article will guide you through the setup of SAML SSO for Slack.¹

• Before you start
• Step 1: Get identity provider (IdP) information from C2 Identity
• Step 2: Configure Slack as the service provider (SP)
• Step 3: Configure C2 Identity as the IdP
• Step 4: Verify that SAML SSO is working

Before you start

• Make sure your version of Slack is the Business+ or Enterprise Grid plan. Free editions of Slack cannot be integrated with C2 Identity via SAML SSO.
• Get an administrator account (i.e., a workspace owner) for configurations in Slack.

Step 1: Get identity provider (IdP) information from C2 Identity

1. In the C2 Identity admin portal, go to the Application page.
2. Click Add (or Add Application) > Custom SAML App.
3. Under Identity provider (IdP) information, select Copy IdP Metadata.
4. Copy the following information. You will have to enter them in Slack later.
   • IdP single sign-on URL: The SAML 2.0 Endpoint (HTTP) in Slack.
   • IdP entity ID: The IdP Provider Issuer in Slack.
   • X.509 certificate: The Public Certificate in Slack.

Important: Do not close the wizard. You will continue the setup later.

Step 2: Configure Slack as the service provider (SP)

1. In a separate browser tab, sign in to Slack with an administrator account.
2. Click on your workspace name in the upper-left corner.
3. Go to Settings & administration > Workplace settings.
4. On the Authentication tab, click Configure next to SAML authentication.
5. Enter the following:
   • SAML 2.0 Endpoint (HTTP): The IdP single sign-on URL in C2 Identity.
   • IdP Provider Issuer: The IdP entity ID in C2 Identity.
   • Public Certificate: The X.509 certificate in C2 Identity. You might need to change the file extension to ".txt" so that you can open the file with a text editor.
6. Under Advanced Options, configure the following:
   • Service Provider Issuer: The SP entity ID in C2 Identity. You will need to enter this information in C2 Identity later.
   • Responses Signed: Choose whether or not SAML responses are signed by C2 Identity. A digital signature ensures that responses are not altered in transit.
   • Assertions Signed: Choose whether or not SAML assertions are signed by C2 Identity. A digital signature ensures that assertions are not altered in transit.
7. Click Save Configuration.

Step 3: Configure C2 Identity as the IdP

1. Return to the setup wizard of SAML SSO in the C2 Identity admin portal.
2. Enter an Application name.
3. Under Service provider (SP) information, configure the following options and click Next:

   Option	Action
   SP entity ID	Enter the Service Provider Issuer you copied from Slack. The default value is "https://slack.com".
   Single sign-on URL	Enter "https://your_slack_domain.slack.com/sso/saml".
   Name ID format	Select Persistent.
   Default name ID	Select Primary email.
   SAML response	This option must be configured in the same way as that in Slack. For instance, select Enable if you ticked Responses Signed in Slack.
   SAML assertion	This option must be configured in the same way as that in Slack. For instance, select Enable if you ticked Assertions Signed in Slack.

4. Under User Attribute, add an attribute to link C2 Identity users and Slack users.

   Option	Action
   SP Attribute	Enter "User.Email".
   Attribute Format	Select Unspecified.
   C2 Identity Attribute	Select Primary email.

5. Confirm and save your settings.

Step 4: Verify that SAML SSO is working

1. Grant a C2 Identity user access to Slack.
2. Open a private browser window.
3. Go to Slack and sign in via SAML SSO. You will be redirected to the C2 Identity login page.
4. Enter the user credentials of the C2 Identity user account.² If the configured SAML SSO works, you will be signed in to Slack.

• Integrate applications with C2 Identity
• Integrate an application via custom SAML SSO