Verifying Slack Requests with Mutual TLS
Recently there was a question about how to authenticate requests from Slack via mutual TLS. The following walks through how to configure the BIG-IP to verify the identity of Slack requests and share this information with a backend Slack application.
Slack App
Slack apps are nifty ways that you can create custom interactions. One example would allow you to create a custom command “/mtls” that would send a command to your own application server and send the response back into your Slack channel.
Verifying Slack Requests
When a request is sent from Slack to your backend server there are two ways that you can verify the identity of Slack.
- Verify Signed Requests
- Use Mutual TLS
Signed Requests
When Slack sends a request to your application it includes a X-SLACK-SIGNATURE header. Using a 4-step process that is documented, your application can validate each request.
Mutual TLS
The second option is to use Mutual TLS that is documented , this involves having a trusted proxy that is capable of validating Slack's client certificate.
Configuring a BIG-IP to Validate Slack Requests via Mutual TLS
To configure the BIG-IP you will need to
- Install your CA signed certificate that is trusted by Slack
- Install a CA certificate that was used by Slack to verify their client certificate
- Configure the BIG-IP to request a client certificate that is trusted by Slack’s preferred CA
The outcome of these three steps looks something like the following from the BIG-IP GUI.
To share this information with a backend application we use an iRule to follow the guidance from Slack’s documentation as well as add the content of the certificate that is presented by Slack.
In Action
Once you get the BIG-IP configured you can test out your Slack app (link to Code Snippet of my demo app). I modified the following tutorial .
In this example I created the command “/mtls”.
When you run the command w/out using the BIG-IP validating the certificate you can see the request, but no information about the X-Client-Certificate-SAN that is used by Slack.
Using the BIG-IP to validate the certificate we can see that we can now share this information with the application via the X-Client-Certificate-SAN header that is added by the iRule.
More Mutual TLS
TLS provides a standard scheme for verifying the identity of Slack in this example. Mutual TLS is commonly used by customers in these types of B2B type of transactions and be a useful scheme for establishing a chain of custody between two parties. Let me know if you can think of other examples where Mutual TLS can be used similar to this example. Thanks for reading!
/eric out