Error When Launching Slack on an Android Work Profile With Okta

An error occurs when a user selects Sign In with Okta for the managed Slack application on an Android device with a Work Profile. Slack fails to open the authentication link because the Work Profile cannot launch the native Chrome application in the Personal Profile. Deploying Chrome to the Work Profile or allowing the Work Profile to open Chrome from the Personal Profile resolves the issue.

When this failure occurs, the device displays the following error message:

We're unable to open this link.

• Okta Classic Engine
• Slack with Security Assertion Markup Language (SAML)
• Android mobile devices
• Android For Work

Android For Work applications cannot access the device's native applications by default. In this scenario, Slack attempts to launch Chrome to handle Okta authentication, but the Work Profile cannot launch the native Chrome application in the Personal Profile, so the sign-in link fails to open.

How is Chrome deployed to the Android For Work profile?

Deploy Chrome Browser Android (Universal) and set the required Mobile options to make Chrome available in the Work Profile.

1. In the Okta Admin Console, navigate to Applications > Applications.
2. Select Add Application.
3. In the search bar, enter Chrome Browser and select Add.
4. On the General Settings screen, select Do not display application icon to users and Do not display application icon in the Okta Mobile app.
5. Assign the application to all users or groups that enroll devices into Android For Work, select Next, and then select Done.
6. On the application page for Chrome Browser, select the Mobile tab.
7. Select the pencil icon next to Chrome Browser Android (Universal).
8. Select Silently install this app and Make this app available to users in the Okta Mobile App Store.
9. From the Runtime permissions dropdown menu, select Approve All.
10. Select Save.

On Android For Work-enrolled devices, Slack accesses Chrome from the Work Profile during sign-in attempts after this deployment.

How is Android For Work allowed to open Chrome from the Personal Profile?

Allow Work profile can transfer data to personal profile in the assigned Device Policy to let the Work Profile open the existing Chrome application from the Personal Profile.

NOTE: This option allows applications in the device's Personal Profile to access Android For Work data. For example, attachments in work emails can be downloaded to the device's internal storage and then forwarded by using a personal email account.

1. In the Okta Admin Console, navigate to Devices > Mobile Policies.
2. Locate the Device Policy assigned to the affected users.
3. Select the pencil icon next to the Android platform.
4. Select Next.
5. Select Work profile can transfer data to personal profile, and then select Save.