Slack: Imprivata Web SSO Setup

Configuring Imprivata Web SSO establishes trust between Imprivata as the Identity Provider (IdP) and Slack as the Service Provider (SP).

Slack: Create SP Metadata File

To create a SP metadata file for your instance of Slack, edit four fields in the following template:

• entityID — specify your unique value.

• Location — provide your domain logout link. To view this value, it's displayed in your workspace name drop-down.

• Service Provider X.509 certificate for signing

• Service Provider X.509 certificate for encryption

  The service provider X.509 certificate can be the same for signing and encryption.

1. In the Slack Administration menu, go to Advanced Options and select Sign AuthnRequest check box.

2. The Service Provider certificate you will import to Imprivata OneSign is displayed.

3. Paste the certificate into both fields in the template below.

<?xml version="1.0"?>

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://slack.com">

<md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

<md:KeyDescriptor use="signing">

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:X509Data>

<ds:X509Certificate>YOURSERVICEPROVIDERX509CERTIFICATE</ds:X509Certificate>

</ds:X509Data>

</ds:KeyInfo>

</md:KeyDescriptor>

<md:KeyDescriptor use="encryption">

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:X509Data>

<ds:X509Certificate>YOURSERVICEPROVIDERX509CERTIFICATE</ds:X509Certificate>

</ds:X509Data>

</ds:KeyInfo>

</md:KeyDescriptor>

<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://yourdomainlogoutlink.slack.com/sso/saml/logout"/>

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://yourdomainlogoutlink.slack.com/sso/saml/logout" index="1"/>

</md:SPSSODescriptor>

</md:EntityDescriptor>

Add Slack as SAML Application

Only the superadmin role is able to configure Web SSO application profiles:

1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles.

   All Single sign-on application profiles, including conventional Imprivata APG profiles, Mobile app profiles, and SAML application profiles, are all managed from this page.

2. Click Add App Profile > Web application using SAML. The Add web application using SAML page opens.

3. Give the application profile a name. This name is visible only to administrators.

   Give the application a user-friendly name. This is the name your users will see when they log in.

4. Click Get SAML metadata.

5. Select From XML and upload the SP metadata file you created previously.

6. Click OK.

7. Click Save SAML application.

Imprivata: View and Copy Metadata

1. In the Imprivata Admin Console, go to the gear icon > Web app login configuration

2. Click View and copy Imprivata (IdP) SAML metadata.

   • Copy and save the SSO redirect URL
   • Copy and save the Entity ID
   • Copy and save the Metadata URL.
   • Download the Imprivata Idp certificate.

Slack: Configure IdP Integration

1. In the Slack administrator menu, go to Administration > Workspace settings

2. In the Settings & Permissions page, go to the Authentication tab > SAML Authentication and click Configure.

3. Complete the following fields:

   • SAML 2.0 Endpoint (HTTP) — enter the Imprivata SSO redirect URL.

     Be sure to select the redirect binding that includes this attribute (Slack requires it):

     urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

   • Identity Provider Issuer — enter the Imprivata entity ID.
     

   • Public Certificate — enter the Imprivata Idp certificate.
     

4. In Slack's Settings section, select the appropriate options for SAML authentication for your users and workspace.

5. Before clicking Save Configuration, confirm:

   • Your SP profile is saved in the Imprivata Admin Console.
   • Your users have been deployed to your Slack profile.

6. Click Save Configuration. This triggers a test IdP authentication. After a successful authentication, configuration is complete.

User Management

Consider how your SP manages its users: To successfully authenticate, the user information managed by your SP (SAML NameID, username, password, and so on) and the user data synchronized by Imprivata (the IdP) from your Active Directory (AD) must match. In the Imprivata Needs section, set the NameID format preference and User Attributes as needed:

• AD Sync — If your SP syncs its user data with the same AD users and groups as your Imprivata IdP, then no special configuration should be needed.
• Create Users Manually in SP — If your SP admin creates user accounts manually, they must use the same NameID format (for example User Principal Name (UPN), email address, and sAMAccountName), so the Imprivata IdP can successfully match them.
• Automatic Account Provisioning — When the SP automatically creates an account as the user logs in for the first time. This functionality is supported in Imprivata Web SSO.

Available Attributes

• Email address (mail)

• First name (givenName)

• Last name (surname)

• Static value:

• User domain

• User logon name (userPrincipalName)

• User logon name - Pre W2K (sAMAccountName)

• User security identifier (objectSID)

• User unique ID (objectGUID)

• User unique ID (UUID)

IT Pilot — Deploy to Select Users

Imprivata Web SSO application profiles offer flexible deployment options.

Deploy your profile to select users for testing:

1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles, find your App Profile, and click Not Deployed.

2. Click Deploy This Application?

3. Un-check Deploy to All Users and Groups.

4. Check the domain your test users are located in.

5. Check These OUs, groups and users

6. Specify your test users.

7. Click Save.

8. On the list of application profiles, check the box next to the profile and click Deploy.

Deploy To Users and Groups

Imprivata Web SSO application profiles offer flexible deployment options.

Deploy your profile to specific OUs, users, and groups as needed:

1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles, find your App Profile, and click Not Deployed or Not Deployed.
2. Check Deploy This Application.
3. You can Deploy to All Users and Groups, or uncheck this option and deploy to select OUs, users, and groups.
4. Check the domain your users are located in.
5. Select For All Users (in this domain) or check These OUs, groups and users
6. Select specific OUs, groups, and users as needed.
7. Click Save.
8. On the list of application profiles, check the box next to the profile and click Deploy.

For complete details, see Deploying Application Profiles.

Expected Endpoint Workflows

The expected Imprivata Web SSO workflow has the following variations:

Imprivata Agent Online

1. The user logs into desktop with Imprivata Enterprise Access Management.

2. The user provides the URL for an app enabled for Imprivata Web SSO.

3. The app opens. The user does not need to log into it manually.

   Subsequent apps are automatically authenticated within the same browser and the same session.

   If the user closes an app without logging out of the app, he can return to the app during the same session without logging in again.

Imprivata Agent Not Present or Unavailable

1. The user provides the URL for an app enabled for Imprivata Web SSO.

2. The user is prompted to log in:

   • If the enterprise does not have an Imprivata Enterprise Access Management Remote Access license, he will be prompted to authenticate with username and password.
   • If the user is included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to complete the Log In workflow.
   • If the user is not included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to authenticate with username and password.

3. The app opens.

   Subsequent apps are automatically authenticated within the same browser and the same session.

   If the user closes an app without logging out of the app, he can return to the app during the same session without logging in again.

Imprivata Web SSO on an Unsupported Browser

The expected Imprivata Web SSO workflow on an unsupported browser is the same as when the Imprivata agent is not present or unavailable:

1. The user provides the URL for an app enabled for Imprivata Web SSO.

2. The user is prompted to log in:

   • If the enterprise does not have an Imprivata Enterprise Access Management Remote Access license, he will be prompted to authenticate with username and password.
   • If the user is included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to complete the Log In workflow.
   • If the user is not included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to authenticate with username and password.

3. The app opens.

   Subsequent apps are automatically authenticated within the same browser and the same session.

   If the user closes an app without logging out of the app, he can return to the app during the same session without logging in again.

For complete details on supported browsers, see Imprivata Enterprise Access Management Supported Components

When Another User Logs In

When a subsequent user logs into a workstation, the Imprivata agent terminates the IdP session of the previous user.

Imprivata Web SSO cannot terminate user sessions:

• In browsers other than Microsoft Edge or Google Chrome;
• On workstations where the Imprivata agent is not present or unavailable;
• For applications not enabled for Imprivata Web SSO;
• For SAML applications that track the SP session with a persistent cookie.

Optional — Number Matching

Multi-factor authentication fatigue attacks, also known as "MFA bombing", are a common cyberattack strategy. In an MFA fatigue attack, the attacker sends MFA push notifications to a registered user. The user may accidentally or absent-mindedly accept one of these push notifications, giving the attacker access to protected resources. This type of attack is generally preceded by phishing of the registered user’s login credentials.

With Imprivata’s Number Matching authentication enabled, users must enter their username and password on their endpoint computer, then a 2-digit code into Imprivata ID that matches the randomly generated number displayed on the application being accessed.

This reduces the risk of the user accepting a push notification they did not initiate, and keeps your digital assets out of the hands of bad actors.

Setup

1. In the Imprivata Admin Console, go to Users > Workflow Policy.

2. On the MFA workflow policy page > Authentication Options, select Require Web SSO and remote access users to enter a code when using Imprivata ID for MFA (number matching)

Expected Workflow

In this example, the user is at an endpoint computer where the Imprivata agent is not present, and/or they are completing WebSSO or Remote Access workflows that require the user to accept an Imprivata ID push notification:

1. The user is logging in remotely, or provides the URL for an app enabled for Imprivata Web SSO.

2. The user is prompted to enter their username and password.

3. After the user successfully enters their username and password, they are prompted to approve a push notification sent to their enrolled Imprivata ID. A two-digit code will be shown on the application or resource being accessed.

4. Imprivata ID will display the username and the application the user is accessing.

   The code expires in 30 seconds.

5. After the user enters the two-digit code on Imprivata ID, they are given access to the application/resource.

For WebSSO, subsequent apps are automatically authenticated within the same browser and the same session.

If the user closes an app without logging out of the app, he can return to the app during the same session without logging in again.

If the user fails to enter the code correctly, or the code expires, the user must begin authentication again.

Optional — Web Login Customization

Configure the appearance of the web login application screens with the logo and color of your enterprise, and set a custom session log out value:

1. In the Imprivata Admin Console, go to the gear icon > Web app login configuration

   • Select a background color for the login screen (hexidecimal value);
   • Upload a PNG, GIF, or JPG logo (200 x 150 pixels, 250 KB max)
2. User sessions are logged out after 2 hours by default. Turn off this automatic logout, or select a value between 30 minutes and 4 days.
3. Click Save.

Optional — Specify The Returned Attribute

When required by the SP, you can specify the returned attribute the IdP sends to the SP when the SP NameID format preference is unspecified.

In the Service Provider (SP) metadata section, when the NameID format preference field is set to Unspecified,

you can set the Returned Attribute field to:

• Email address (mail)
• User logon name (userPrincipalName)
• User logon name - Pre W2K (sAMAccountName)
• User security identifier (objectSID)
• User unique ID (UUID)

Troubleshooting

Verify proper integration of Imprivata Web SSO (IdP) with the Relying Party (RP).

• Imprivata IdP configuration (accessed through Imprivata Admin Console);

• Relying Party SSO configuration (Relying Party administration)

• Endpoint (device from which the user accesses the Relying Party application).

Replacing Expiring Certificates