Integrating SailPoint with Slack

Slack is a proprietary business communication platform developed by Slack Technologies. Slack allows communities, groups, or teams to join a workspace through a specific URL or invitation sent by a workspace administrator or owner.

Connecting SailPoint to your Slack system allows you to manage the Slack user accounts. This guide is designed to provide information about the necessary requirements and definitions needed to get a working instance of a Slack source.

Supported Features

The Slack source supports the following features:

• Aggregate Slack users, groups, and channels
• *Provision Slack users
• *Access Certifications (certification of entitlements connected to accounts)
• *Password Management
• API Rate Limit: Imposed rate limits with a retry mechanism are supported. The aggregation and provisioning operations continue after reaching the rate limit of the Slack API.

For more information on features, refer to Source Features.

The Slack source supports multiple group objects. The group objects are groups and channels.

Accounts

Group Entitlements

Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details (of the entitlement types) from the managed system. These objects have a separate schema defining list of attributes that the aggregation task fetches (as additional details) when aggregation is run for the Group Entitlement type.

Slack 'Group' group object: a group of users.

User Group: a group of members in a single workspace that need to be notified.

Channel: consists of details such as the number of members, ID, and name of the channel along with the timestamp of when the channel is created.

Channel management: involves actions such as viewing a list of channels in a workspace and taking action, if required.

Supported Slack Platforms

• Slack Business Plus Plan

• Slack Enterprise Grid Plan

  Note

  Feature Enhancement: Single and multi-channel guest user creation via SailPoint. This feature allows a user to create another user to have restricted access to a single channel or multiple channels as specified by the user. These users are treated as guest users and do not have access to other channels in the workspace.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Required Permissions

The Slack Connector requires the following permissions and considerations:

• The service account that accesses the Slack APIs must be an administrator user in the Slack managed system.
• On Slack-Plus, only the Slack owners can generate a token to use the SCIM API. The account that generates a token must remain an owner to make SCIM updates.
• Org-wide apps must be installed by an administrator or owner of an Enterprise Grid organization. Additionally, the app must be installed on the entire org, not just an individual workspace.

Slack Business Plus Requires the Following Permissions

User token scopes:

• admin - Administrator of a workspace.
• channels:read - View basic information about public channels in a workspace.
• channels:write - Manage a user's public channels and create new ones on a user's behalf.
• groups:read - View basic information about a user's private channels.
• groups:write - Manage a user's private channels and create new ones on a user's behalf.
• im:read - View basic information about a user's direct messages.
• mpim:read - View basic information about a user's direct messages.
• users:read - View the people in a workspace.
• users:write - Set a user's presence.

Bot token scopes:

• users:read - View the people in a workspace.
• users:read.email - View email addresses of the people in a workspace.

Slack Enterprise Grid Requires the Following Permissions

Channel management requires the following permissions:

• An account must be a Workspace owner or administrator.

• OAuth requires the following for an account to manage channels:

  • admin
  • admin.users:write
  • channels:read
  • channels:write
  • admin.conversations:read
  • admin.conversations:write
  • users:read.email

  Note

  The channels:write and admin.conversations:write permissions are required only for provisioning operations.

Workspace management requires the following permissions:

• An account must be a Workspace owner or administrator.
• Bot and OAuth requires the following for an account to manage Workspaces:
  • admin.teams:read
  • admin.teams:write - Required to make changes on a Workspace.
  • admin.users:read - Required to access a Workspace's profile information.

Prerequisites

• You have the Slack-Plus plan (single workspace).

  Note

  SCIM APIs for Slack are available only with the Slack-Plus plan.

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

• Generating an OAuth Token Required to Access the Slack API: For the Slack source, users are the members of a workspace and must have a valid OAuth token with required permissions. All the operations by users are performed through SCIM based APIs. An OAuth token with admin level privileges must be used to access the APIs. For more information, refer to API Token Generation.

• Make sure you select org-wide while installing the Slack app to have permissions on the org level.
• The App should have admin permissions on the User token.
• Perform the following steps to provide access for all workspaces to the issued user token:
  1. Go to Enterprise Grid > Manage Organization > Installed Apps > Add to more workspaces.
  2. Select all the workspaces and then select Save.

Generating an OAuth API Token

An OAuth API token with the admin scope is required to access the Slack SCIM API.

To acquire the OAuth API token an organization owner must:

• create a new Slack application
• add the admin OAuth scope
• install the application
• use the generated token

Perform the following steps to generate an OAuth API token:

1. Create a new Slack application as an admin on a Workspace. For more information, refer to Creating, managing, and building apps.
2. Configure the permissions to allow your application to interact with the Slack API by adding the admin OAuth scope in the User Token Scopes.
3. Install the Slack application. For more information, refer to Installing and distributing apps.
4. Use the generated OAuth Access token.

Additional Information

The API token must be included through an Authorization header with a type of Bearer when calling any of the SCIM methods. Provide a JSON request body for POST, PUT, and PATCH write operations, and then set HTTP Content-type header to application/json.

For example, the SCIM call can be as follows:

GET /scim/v1/Users?count=1000 HTTP/1.1
Host: api.slack.com
Accept: application/json
Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.