The Okta Integration Network (OIN) Slack application only offers preconfigured values for the User.Email attribute, which causes duplicate accounts through Just In Time (JIT) provisioning if the Okta username format does not match the attribute value. Resolve this issue by configuring a custom Security Assertion Markup Language (SAML) integration in Okta that uses an alternative attribute value for authentication.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Custom Security Assertion Markup Language (SAML)
• Single Sign-On (SSO)
• Slack

Slack requires the User.Email attribute for authentication. If the Username Format in Okta does not match the User.Email value, Okta creates duplicate accounts through Just In Time (JIT) provisioning. The Okta Integration Network (OIN) Slack integration has two preconfigured values (Email and Username) and does not offer a custom option for authenticating with an alternative value, such as a secondary email.

How does an administrator configure a custom SAML integration for Slack?

Configure a custom Security Assertion Markup Language (SAML) integration in Okta to authenticate with a value other than the email or username by following these steps.

1. In the Okta Admin Console, navigate to Applications > Applications > Create App Integration > SAML 2.0.
2. Follow the steps provided by Slack to integrate the custom SAML application in Okta. Reference the Slack documentation for Custom SAML single sign-on and add the necessary URLs in Okta.
3. Ensure the Username Format within the Okta custom Slack application matches the same value as the User.Email attribute (for example, user.secondEmail).
4. Add Attribute Statements in the Okta configuration. Enter User.Email in the Name field, and enter the attribute required for authenticating (for example, user.secondEmail) in the Value field.
5. Navigate to Sign On > View SAML setup instructions in the Okta custom Slack integration.
6. Copy the Identity Provider Single Sign-On URL from Okta and paste it into the SAML 2.0 Endpoint URL(HTTP) field in Slack.
7. Copy the Identity Provider Issuer from Okta and paste it into the Identity Provider Issuer field in Slack.
8. Copy the X.509 Certificate from Okta and paste it into the Public Certificate field in Slack.

How does an administrator configure SCIM provisioning for the custom integration?

Configure System for Cross-domain Identity Management (SCIM) provisioning for the custom Slack integration by following these steps.

1. Navigate to General > Provisioning in the custom SAML application in Okta and select SCIM.
2. Follow the steps outlined in the Slack documentation for Provisioning with SCIM to set up the configuration.
3. Enter https://api.slack.com/scim/v2/ for the SCIM connector base URL in Okta.
4. Select HTTP Header for the Authentication Mode.
5. Enter the token generated in Slack.
6. Select Test Connector Configuration and choose Save.

NOTE: If the Connector Configuration fails to test, save the configuration with dummy OAuth 2.0 values and then return to configuring the HTTP Header again.

Related References

• Custom SAML single sign-on
•  Provisioning with SCIM