# SailPoint Slack SaaS Connector Documentation > Slack SaaS Connector Documentation # Documentation # Connecting SailPoint and Slack SaaS To connect SailPoint with Slack, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings The following information is required for SailPoint to connect and interact with Slack SaaS. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Select **Connection Settings** from the menu. 2. In **SCIM API URL**, enter the host URL for SCIM API. For example, you can use [https://api.slack.com/scim/v1](). 3. **Authentication Type** is API Token. 4. In **API Token**, enter the access token that is used for Slack authentication. 5. Select **Save**. > [!NOTE] > > Connection Settings does not include the Bot User OAuth Token. To aggregate Slack Bots as machine accounts, configure the token on [Machine Identity Governance Settings](<#machine-identity-governance-settings>). The SCIM API URL and API Token remain required. ## Machine Identity Governance Settings Use these settings to aggregate Slack Bots as machine accounts. Human Slack users, groups, channels, and workspaces continue to use the SCIM connection. For more information, refer to [Connection Settings](<#connection-settings>). > [!NOTE] > > SailPoint displays these settings only when your organization is entitled to Agentic Identity Governance. Slack Bots dataset aggregation also requires the Machine Identity Security license (`idn:machine-identity-security`). You can configure the same toggle and token during Express Setup. These settings are not available on Connection Settings. Before you configure these settings, add the required bot scopes to your Slack app and obtain its Bot User OAuth Token. Refer to [Prerequisites]() and [Required Permissions](). ### Express Setup Express Setup remains a four-step process and does not include an additional step for machine accounts. For the complete procedure, refer to [Adding the Source in SailPoint](). - The authentication card requires **API URL** and **API Token** for the SCIM connection. The default API URL is `https://api.slack.com/scim/v1`. In API Token, enter the User OAuth Token that starts with `xoxp-`. SailPoint encrypts this value. - If your organization is entitled to Agentic Identity Governance, the card also displays the **Enable Slack Machine Accounts** toggle. Selecting the toggle displays the required **Bot User OAuth Token** field. - If your organization is not entitled to Agentic Identity Governance, the card does not display the toggle or token field. - After you finish Express Setup, Machine Identity Governance Settings displays the same toggle and token state. **To aggregate Slack Bots as machine accounts:** 1. Select **Machine Identity Governance Settings** from the menu. 2. Select the **Enable Slack Machine Accounts** toggle. 3. In **Bot User OAuth Token**, enter the bot token issued for your Slack app. The value starts with `xoxb-`. This field is required when you enable the toggle. 4. Select **Save**. | Field | Configuration key | Required | Description | | --- | --- | --- | --- | | Enable Slack Machine Accounts | `enableSlackMachineAccounts` | No | When you enable this toggle, the connector aggregates Slack Bots as machine accounts. The default value is off. | | Bot User OAuth Token | `botToken` | Yes, when the toggle is on | Bot token (`xoxb-`) the connector uses to discover Slack bots. SailPoint encrypts this value. | ### Review and Test - Test Connection validates the SCIM API URL and API Token. - An empty Bot User OAuth Token does not block Test Connection or SCIM account aggregation when the **Enable Slack Machine Accounts** toggle is off. - Slack Bots dataset aggregation requires a valid bot token. If the bot token is missing, Slack Bots aggregation fails with a configuration error that prompts you to enter the Bot User OAuth Token. ## Activity Insights Settings SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). Activity Insights Settings allows you to gather account information and activity data from Slack. To enable Activity Insights for the Slack application, refer to [Prerequisites]() for more information. To configure Activity Insights, complete the following: > [!NOTE] > > **Screenshot** > > [![Activity Insights Settings]()]() 1. Go to **Activity Insights Settings**. 2. Select **Enable Activity Insights** to view access to data insights on source and application activity such as logins and other app-specific events. 3. Select **Save**. ## Aggregation Settings For more information about aggregation, refer to [Loading Account Data](). > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() 1. Select **Aggregation Settings** from the menu. 2. In **Account Filter**, set up optional conditions to filter accounts during aggregation. For example, `userName Eq "John"` retrieves only those records whose userName is identical to John. `userName co "DM"` retrieves only those records whose userName contains DM. 3. In **Group Filter**, set up optional conditions to filter groups during aggregation. For example, `displayName sw "S"` retrieves only those groups whose display name starts with "S". 4. In **Page Size** enter the number of records to fetch in one request. The minimum value is 1 and the maximum value is 1000. By default, the page size is 200. 5. Select the option to **Manage Channels** to enable the channel management feature for new Slack sources. Only the public and active channels present in the workspace will be aggregated. > **Caution** > > Configuration of channels will increase the aggregation execution time. 6. Select **Save**. ## Filter Conditions for Accounts and Groups For Slack SaaS, filtering of records for accounts and groups is optional. The user can request a subset of resources by specifying the `filter` URL query parameter containing a filter expression. The following rules must apply: - The `filter` parameter must contain a valid Boolean operator. - Each expression must contain an attribute name followed by an attribute operator. An optional value is also supported. - Multiple expressions can be combined using two logical operators. - Expressions can be grouped using "( )". - Expressions must be evaluated using a standard order of operations. - Strings must be valid JSON strings. The attribute name and attribute operator are case insensitive. For example, the following expressions equal the same logical value: ```text userName Eq "Carly" username eq "carly" ``` The parameters in the **Aggregation Filter Settings** can use the following filter operators: | Operator | Description | | --- | --- | | co | contains | | sw | starts with | | pr | present (has value) | | gt | greater than | | ge | greater than or equal | | lt | less than | | le | less than or equal | | and | logical and | | or | logical or | ## Advanced Settings > [!NOTE] > > **Screenshot** > > [![Advanced Settings]()]() 1. Select **Advance Settings** from the menu. 2. In **Maximum Retry Limit**, enter a number to set up a limit to support the retry mechanism. The aggregation and provisioning operations continue after reaching the rate limit of the Slack API. The minimum value is 1 and maximum value is 10. 3. Select the option to **Support Complex Attributes** for the attributes from the Slack managed system. 4. Select the option to **Use Default Connector Provider** to handle chunked data on an open JDK version 11. 5. Cache creation is enabled for the Slack source by default. Select the option to **Disable Channel Caching** to reduce the aggregation execution time and use a sequential approach. 6. Update source operations are supported using the PATCH method. Select the option to enable **Use HTTP Patch** if you want to use this method. 7. Select the option to **Enable HTTP Proxy** for an error-free test connection when the proxy is configured as HTTPS proxy. 8. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Dataset Management Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history. > [!NOTE] > > Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric]() for more information. For more information, refer to [Managing Datasets and Resources]() for datasets, resources, owner correlation, and aggregation. ## Datasets A *dataset* is a named group of one or more related resources that the source aggregates together. When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources. > [!NOTE] > > Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them. ### Dataset Aggregation Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](). ## Resources A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model. In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation. For more information, refer to [Managing Resources](). ### Owner Correlation Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](). ## Supported Datasets Go to **Dataset Management \> Datasets** on your Slack SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation. > [!NOTE] > > Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](). The connector collects Slack Bots in a separate dataset for machine identity governance. Human Slack users remain in the existing SCIM account aggregation. - **License** - `idn:machine-identity-security` - **Schedule** - Every 12 hours (`0 */12 * * *`) - **Command** - `std:resource:list` | Dataset name | Dataset ID | Associated resources | Required license | Default schedule | | --- | --- | --- | --- | --- | | **Slack Bots** | `slack:bots` | Slack Bot | Machine Identity Security | Every 12 hours | For information about the Slack Bot resource and its schema, refer to [Supported Resources](<#supported-resources>) and [Slack Bot Attributes](<#slack-bot-attributes>). To aggregate the dataset manually, go to **Dataset Management** \> **Datasets** \> **Slack Bots**, and then select **Start Aggregation**. ## Supported Resources A resource represents a type of object the connector collects from Slack. Each resource defines the attributes collected for that object type and how each object appears in SailPoint. For more information, refer to [Managing Resources](). > [!NOTE] > > When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources. Go to **Dataset Management** \> **Resources** on your Slack SaaS source to view each object type the connector aggregates. Select a resource to review its schema on the **Schema** tab. | Resource name | Resource type | Resource ID | Identity attribute | Display attribute | Classification | | --- | --- | --- | --- | --- | --- | | **Slack Bot** | `std:account` | `slack:bot` | `id` | `name` | `machine` | For the complete Slack Bot resource schema, refer to [Slack Bot Attributes](<#slack-bot-attributes>). ### Account Subtype After you create or refresh the source, the Non-Human Identity processor provisions a system-managed source subtype with the technical name `slack:bot` and the display name **Slack Bot**. The connector does not emit the subtype. - Machine accounts appear under **Non-Human Identities** \> **Accounts**. - Machine accounts do not appear in the source **Account Management** \> **Accounts** list. That list shows SCIM human accounts. > [!IMPORTANT] > > Do not add Slack Bot attributes to the source **Account Schema**. The Account Schema remains the SCIM user schema. ### Default Owner Correlation The Slack Bot resource includes the following default primary correlation. You can change it on the **Owner Correlation** tab of the resource. For more information, refer to [Owner Correlation](). | Setting | Value | | --- | --- | | Attribute type | Human Identity | | Schema attribute | `slackAdministratorEmail` | | Transform | None | | Human Identity attribute | `email` | | Sync to Machine Accounts | Cleared | **Additional Owners** is empty by default. ## Slack Bot Attributes Use the following schema attributes for the **Slack Bot** resource in the **Slack Bots** dataset. - **Account ID** - `id`, the Slack bot ID that starts with `B`. - **Display attribute** - `name`, taken from `profile.real_name`. | Attribute | Type | Description | | --- | --- | --- | | `id` | string | Slack bot ID that starts with `B`. This attribute is the native identity of the machine account. | | `name` | string | Slack bot display name from `profile.real_name`. | | `alwaysActive` | boolean | Whether Slack reports the bot as always active. | | `enterpriseName` | string | Slack enterprise organization name from `enterprise_user.enterprise_name`, when present. | | `workspace` | string | Workspace name from `team.info`. The connector falls back to the `auth.test` team name. | | `updated` | string | Last profile update as an ISO-8601 timestamp. Slack does not return the bot creation date on `users.list`. | | `spStatus` | string | Normalized lifecycle status, either `Active` or `Inactive`, derived from the Slack member `deleted` value. | | `spEnvironment` | string | Workspace name used as the environment label. | | `slackAdministratorName` | string | Display name of the workspace administrator. The connector uses the primary owner, then the owner, then the admin. | | `slackAdministratorEmail` | string | Email of that workspace administrator. The connector uses this attribute as the default owner correlation key. | | `managementUrl` | string | URL used to manage the bot in Slack: `https://{team.domain}.slack.com/services/{userId}?settings=1`. | # Integrating SailPoint with Slack SaaS Slack is a proprietary business communication platform developed by Slack Technologies. Slack allows communities, groups, or teams to join a workspace through a specific URL or invitation sent by a workspace administrator or owner. Connecting SailPoint to your Slack system allows you to manage the Slack user accounts. This guide is designed to provide information about the necessary requirements and definitions needed to get a working instance of a Slack SaaS source. The connector also aggregates Slack Bots as machine accounts on this source when your organization is entitled to Machine Identity Security and you configure a Bot User OAuth Token. The connector discovers the bots from the Slack Web API. Human Slack users, groups, channels, and workspaces continue to use the existing SCIM connection. The connector does not aggregate Slackbot (`USLACKBOT`), and it does not support create, update, or delete operations for Slack bots. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Slack source supports the following features: > [!IMPORTANT] > > Before you can use any of the following items marked with an asterisk (\*), SailPoint must activate the feature for your site. - Aggregate Slack users, groups, and channels - \*Provision Slack users - \*Access Certifications (certification of entitlements connected to accounts) - \*Password Management - API Rate Limit: Imposed rate limits with a retry mechanism are supported. The aggregation and provisioning operations continue after reaching the rate limit of the Slack API. For more information on features, refer to [Source Features](). The Slack source supports multiple group objects. The group objects are groups and channels. ### Accounts | Feature | Users | | --- | --- | | Create, Update, Delete | ✔ | | Aggregate | ✔ | | Password Management | ✔ | | Enable, Disable | ✔ | | Group Entitlements (Read, Request, Revoke) | Groups, Channels | ### Group Entitlements Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details (of the entitlement types) from the managed system. These objects have a separate schema defining list of attributes that the aggregation task fetches (as additional details) when aggregation is run for the Group Entitlement type. | Feature | Groups | Channels | | --- | --- | --- | | Aggregation | ✔ | ✔ | **Slack 'Group' group object**: a group of users. **User Group**: a group of members in a single workspace that need to be notified. **Channel**: consists of details such as the number of members, ID, and name of the channel along with the timestamp of when the channel is created. **Channel management**: involves actions such as viewing a list of channels in a workspace and taking action, if required. ### Non-Human Identity Discovery **Slack Bots (machine accounts)** The connector uses native Dataset 2.0 aggregation to collect Slack app bot users as machine accounts in the **Slack Bots** dataset. This aggregation is read-only, so the connector does not create, update, or delete Slack bots. To aggregate Slack Bots, your organization requires Machine Identity Security. Select the **Enable Slack Machine Accounts** toggle and enter a **Bot User OAuth Token**. For more information, refer to [Machine Identity Governance Settings]() and [Supported Datasets](). Refer to Dataset Management for more information. Refer to [Discovering Potential Non-Human Accounts]() for more information. ### Exposed Credentials The Slack SaaS connector supports scanning for exposed credentials on Slack Business Plus. Configure the Slack SaaS source with the **User OAuth Token** and **Bot User OAuth Token** from a private Slack app that has the required user and bot scopes. For the required scopes, refer to [Required Permissions](<#required-permissions>). ### Supported Slack Platforms - Slack Business Plus Plan - Slack Enterprise Grid Plan ### Activity Insights Activity Insights supports activity from Slack and its associated accounts. This allows you to gather account information and activity data from Slack. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings. ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Required Permissions The Slack Connector requires the following permissions and considerations: - The service account that accesses the Slack APIs must be an administrator user in the Slack managed system. - On Slack-Plus, only the Slack owners can generate a token to use the SCIM API. The account that generates a token must remain an owner to make SCIM updates. - Org-wide apps must be installed by an administrator or owner of an Enterprise Grid organization. Additionally, the app must be installed on the entire org, not just an individual workspace. ### Slack Business Plus Requires the Following Permissions User token scopes: - admin - Administrator of a workspace. - channels:read - View basic information about public channels in a workspace. - channels:write - Manage a user's public channels and create new ones on a user's behalf. - groups:read - View basic information about a user's private channels. - groups:write - Manage a user's private channels and create new ones on a user's behalf. - im:read - View basic information about a user's direct messages. - mpim:read - View basic information about a user's direct messages. - users:read - View the people in a workspace. - users:write - Set a user's presence. Bot token scopes: - users:read - View the people in a workspace. - users:read.email - View email addresses of the people in a workspace. ### Slack Bots Aggregation Permissions The existing SCIM and administrator scopes remain unchanged. To aggregate Slack Bots as machine accounts, grant the Slack app the following bot token scopes: | Scope | Purpose | | --- | --- | | `users:read` | List workspace members and identify bots through `is_bot` and `profile.bot_id`. | | `users:read.email` | Read the workspace administrator email for `slackAdministratorEmail`. | | `team:read` | Read the workspace name and domain through `team.info`. | > [!IMPORTANT] > > Reinstall the Slack app after you add these scopes. Slack reissues the tokens, so update the source with the new Bot User OAuth Token. ### Slack Enterprise Grid Requires the Following Permissions Channel management requires the following permissions: - An account must be a Workspace owner or administrator. - OAuth requires the following for an account to manage channels: - admin - admin.users:write - channels:read - channels:write - admin.conversations:read - admin.conversations:write - users:read.email > **Note** > > The `channels:write` and `admin.conversations:write` permissions are required only for provisioning operations. Workspace management requires the following permissions: - An account must be a Workspace owner or administrator. - Bot and OAuth requires the following for an account to manage Workspaces: - admin.teams:read - admin.teams:write - Required to make changes on a Workspace. - admin.users:read - Required to access a Workspace's profile information. ## Prerequisites - You have the Slack-Plus plan (single workspace). > **Note** > > SCIM APIs for Slack are available only with the Slack-Plus plan. - Generating an OAuth Token Required to Access the Slack API: For the Slack source, users are the members of a workspace and must have a valid OAuth token with required permissions. All the operations by users are performed through SCIM based APIs. An OAuth token with admin level privileges must be used to access the APIs. For more information, refer to [API Token Generation](<#generating-an-oauth-api-token>). - Make sure you select **org-wide** while installing the Slack app to have permissions on the org level. - The App should have `admin` permissions on the User token. - Perform the following steps to provide access for all workspaces to the issued user token: 1. Go to **Enterprise Grid \> Manage Organization \> Installed Apps \> Add to more workspaces**. 2. Select all the workspaces and then select **Save**. ### Generating an OAuth API Token An OAuth API token with the admin scope is required to access the Slack SCIM API. To acquire the OAuth API token an organization owner must: - create a new Slack application - add the admin OAuth scope - install the application - use the generated token Perform the following steps to generate an OAuth API token: 1. Create a new Slack application as an admin on a Workspace. For more information, refer to [Creating, managing, and building apps](). 2. Configure the permissions to allow your application to interact with the Slack API by adding the admin OAuth scope in the User Token Scopes. 3. Install the Slack application. For more information, refer to [Installing and distributing apps](). 4. Use the generated OAuth Access token. > [!NOTE] > > If you intend to build a Slack application for other teams to install, your application will be required to properly handle the OAuth flow to generate the correct token. #### Additional Information The API token must be included through an `Authorization` header with a type of `Bearer` when calling any of the SCIM methods. Provide a JSON request body for POST, PUT, and PATCH write operations, and then set HTTP Content-type header to `application/json`. For example, the SCIM call can be as follows: ```text GET /scim/v1/Users?count=1000 HTTP/1.1 Host: api.slack.com Accept: application/json Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx ``` ## Slack Bots Aggregation Keep the existing SCIM API Token (`xoxp-`) steps, and then complete the following prerequisites to aggregate Slack Bots as machine accounts. - Use a Slack app that includes a bot user. - Grant the bot the scopes listed in [Required Permissions](<#required-permissions>). - If the app already exists with only the SCIM user token, reinstall the app after you change the scopes, and then consent again. Slack reissues the tokens, so update the source with the new Bot User OAuth Token. ### Copying the Bot User OAuth Token **To copy the Bot User OAuth Token:** 1. Go to [https://api.slack.com/apps](), and then open your Slack app. 2. Go to **Features \> OAuth & Permissions**. 3. Install the Slack app to the workspace. 4. Copy the **Bot User OAuth Token**. The value starts with `xoxb-`. 5. Keep the existing **User OAuth Token** (`xoxp-`) in the **API Token** field of the source. SCIM still requires this token. > [!CAUTION] > > Treat the Bot User OAuth Token as a secret. Do not paste the token into tickets or screenshots. If your organization is entitled to Agentic Identity Governance, you can enter the token during Express Setup or on [Machine Identity Governance Settings](). Both locations use the same configuration keys. ### Enterprise Grid: Workspace Approval On Enterprise Grid, approve the Slack app in every workspace whose bots you want to aggregate. The connector does not aggregate bots in workspaces where the app is not approved. ## Onboard Slack SaaS with SailPoint Agentic Fabric (SAF) SailPoint Agentic Fabric (SAF) provides an automated, guided onboarding experience to connect your Slack environment to SailPoint. SAF automatically creates, deploys, and configures the Slack SaaS source in SailPoint, reducing the manual setup steps. After onboarding, the source is ready for aggregation and governance. For detailed onboarding instructions, prerequisites, and supported deployment models, refer to [Connecting Sources](). > [!IMPORTANT] > > To enable advanced governance capabilities for Slack resources and AI agents, an active SailPoint Agentic Fabric Advanced Governance license is required. Contact your SailPoint Customer Success Manager to request access and for more information. # Provisioning The Slack SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in Slack directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes When your system provisions new accounts to the Slack source, it uses the attributes on the Create Profile page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy. > [!IMPORTANT] > > The following section outlines the default **Create Profile** configuration and the information required for new Slack accounts and users. You may need to edit the contents as per your requirements. SailPoint recommends that you [work with Services]() if you need assistance with the configuration. The following are the create account provisioning policy attributes of the Slack Source. | Attribute Name | Description | | --- | --- | | userName | Specify the user name of the user. | | givenName | Specify the first name of the user. | | familyName | Specify the last name of the user. | | displayName | Specify the display name of the user. | | password | Specify the login password for the user. | | emails.work.primary.value | Specify the primary work email address for the user. | | userType | Specify the user type of the user. | | employeeNumber | Specify the employee number of the user. | | department | Specify the department for the user. | | locale | Specify the locale of the user. | | timezone | Specify the timezone of the user. | | is\_ultra\_restricted | Specify True for single channel guest user. | | is\_restricted | Specify True for multi channel guest user. | | team\_id | Specify the team ID of the workspace. | | startDate | Specify the date the user started. This attribute is optional. Enter the value in ISO 8601 format. For example, `2000-05-06T00:00:00+0000`. | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Slack SaaS connector uses the following default correlation and object configurations. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the Slack SaaS source, the default correlation mapping is: | Account Attribute | Operation | Identity Attribute | | --- | --- | --- | | username | Equals | SailPoint User Name (uid) | | emails.work.primary.value | Equals | Work Email (email) | ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | id | Account | | id | Group | | id | channel | | id | workspace | ### Default Account Attributes The Slack SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | id | A unique identifier for a Slack resource. | | userName | Name of the user. | | externalId | A String that is an identifier for the resource. | | displayName | The name of the user. | | nickName | The casual way to address the user in real life. | | profileUrl | A fully qualified URL to a page representing the users online profile. | | title | The users title. | | userType | Used to identify the organization to user relationship. | | preferredLanguage | Indicates the users preferred written or spoken language. | | locale | Used to indicate the users default location for purposes of localizing items. | | timezone | The users time zone in the Olson timezone database format. | | familyName | The last name of the user. | | givenName | The first name of the user. | | honorificPrefix | The honorific prefix(es) of the user. | | employeeNumber | Numeric or alphanumeric identifier assigned to a person. | | costCenter | Identifies the name of a cost center. | | organization | Identifies the name of an organization. | | division | Identifies the name of a division. | | department | Identifies the name of a department. | | managerID | The id of the Slack resource representing the users manager. | | emails | Email addresses for the user. | | emails.work.primary.value | Primary work email address for the user. | | emails.work.secondary.value | Secondary work email addresses for the user. | | phoneNumbers | Phone numbers for the user. | | phoneNumbers.work.primary.value | Primary work phone number for the user. | | phoneNumbers.mobile.value | Mobile number for the user. | | photos | URL of a photo of the user. | | photo.photo.value | URL of a photo of the user. | | addresses | A physical mailing address for the user. | | addresses.home.streetAddress | Home Street address for the user. | | addresses.home.locality | Home address locality for the user. | | addresses.home.region | Home address region for the user. | | addresses.home.postalCode | Home address postal code for the user. | | addresses.home.country | Home address country for the user. | | groups | A list of groups that the user belongs to. | | roles | A list of roles for the user that collectively represent who the user is. | | created | The date and time details of the account when it was added to Slack. | | startDate | The date the user started. This attribute is optional. The value uses ISO 8601 format. For example, `2000-05-06T00:00:00+0000`. | | location | The URL of the user being returned. | | channels | Channels assigned to the user. | | workspaces | Workspaces assigned to the user. | | is\_ultra\_restricted | The value of this attribute should be true if the user is a single channel guest user. The default value is "false" (Boolean). | | is\_restricted | The value of this attribute should be true if the user is multi-channel guest user. The default value is "false" (Boolean). | > [!NOTE] > > The `channels` attribute increases the aggregation execution time. ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Slack SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. #### Entitlement Type: group Object Type: group | Attribute Name | Description | | --- | --- | | id | A unique identifier for the group. | | displayName | The name of the group. | | created | The date and time details of the group when it was added to Slack. | | location | The URL of the group being returned. | #### Entitlement Type: channel Object Type: channel | Attribute Name | Description | | --- | --- | | id | ID of the Slack channel. | | name | The name of the Slack channel. | | created | The timestamp when the channel is created. | | creator | The User ID of the member who created the channel. | | num\_Members | The number of members in the channel. | | channel\_type | The type of the Slack channel. | | teamId | The team ID associated with the Slack channel. | #### Entitlement Type: workspace Object Type: workspace | Attribute Name | Description | | --- | --- | | id | A unique identifier for the Workspace. | | name | The Workspaces name. | | primary\_owner | The user ID for the Workspaces owner. | | team\_url | The Workspaces URL. | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ### Aggregation Errors - `Exception during aggregation. Reason: javax.ws.rs.ProcessingException: Error closing message content input stream.` **Resolution**: Verify that that you correctly set up the **Enable Default Connector Provider** source field in the [Advanced Settings]() section. - `openconnector.ConnectorException: Invalid response or no resource received. Bad Request` **Resolution**: Verify that the values of the configuration parameters such as filter conditions, API URL, and others are valid. - `java.lang.RuntimeException: openconnector.ConnectorException` **Resolution**: Ensure that you correctly set up the **Maximum Retry Count Limit** and entered the value for the maximum retry count in the Slack source. The default value is 5. - Account aggregation fails to retrieve the associated channels with an account. **Resolution**: Ensure that you correctly set up the **Manage Channels** source field and the service account token has the following administrator permissions: `admin`, `channels:read`. - An error message is displayed while performing group aggregation: `connector exception :openconnector.ConnectorException{"ok":false,"error":"team_access_not_granted"}` **Resolution**: Verify the auth token application is installed on Workspace. ### Slack Bots Aggregation Errors - Slack Bots aggregation fails immediately with a message that the Bot User OAuth Token is required. **Resolution**: Select the **Enable Slack Machine Accounts** toggle and enter a valid `xoxb-` token during Express Setup or on [Machine Identity Governance Settings](). - No bots appear after aggregation. **Resolution**: Verify that the bot token has the `users:read` scope and that the app is installed on the workspace. The connector excludes Slackbot by design. For the complete list of bot scopes, refer to [Required Permissions](). - Account Subtype shows `--` on a machine account. **Resolution**: Verify that the Non-Human Identity processor has the `slack:bot` system-managed subtype, and then run dataset aggregation again after you create or refresh the source. - Owner shows `--` on a machine account. **Resolution**: Verify that `slackAdministratorEmail` has a value and that an identity exists with a matching `email` value. The default correlation matches `slackAdministratorEmail` to the identity `email` attribute. - Machine accounts are missing from the source account list. **Resolution**: Go to **Non-Human Identities \> Accounts** to view machine accounts. The source account count and list show SCIM human accounts and might not list bots. - On Enterprise Grid, aggregation reports the following errors for a workspace: `team_access_not_granted`, `team_not_found` **Resolution**: The connector skips workspaces that the app cannot access and continues to aggregate the remaining workspaces. To include a skipped workspace, install the app on that workspace. ### Provisioning Error - `openconnector.ConnectorException: Bad Request` **Resolution**: Ensure that the mandatory attributes required to create a resource on Slack are provided, and that the input data is valid and not duplicate. ### Increase in Account Preview Execution Time When **Manage Channels** is configured, the account preview execution time increases. **Resolution**: Cache creation is enabled in the Slack source by default. To reduce the aggregation execution time, run sequential approach by setting the **Disable Channel Caching** option in [Advanced Settings](). ### Test Connection Errors While proxy is configured as HTTPS proxy, the test connection fails with the following error message: `Test connection failed. Unrecognized SSL message, plaintext connection?` **Resolution**: Ensure that you correctly set up the **Enable HTTP Proxy** option in [Advanced Settings](). ### managerID Is Not Updated for the User If the user is disabled in the managed system, the managerID of the user cannot be updated. **Resolution**: Ensure the user is active on the managed system, and then, perform the update operation.