Info |
---|
These instructions apply to colleges who are NOT already using Canvas in production with students. These steps are for setting up your Canvas > SSO Proxy integration for the first time in your Test/Pilot environment. For colleges already using Canvas with students, contact Matt Schroeder, mschroeder@ccctechcenter.org to get started with proxy integration. |
Setting Up Your College or District IdP to Route Through the Proxy
This document illustrates configuring your Canvas to route your college/district IdP through the SSO proxy. To do that, the following values will need to be updated in order to implement this change:
- IdP entityID: this will change to the proxy entityID
- Log On URL: this will change to a URL that goes to the proxy SSO endpoint, and with a ?source= query argument identifying the college/district IdP to route to
- Certificate fingerprint: this will become the certificate fingerprint of the proxy signing certificate
- Note: the Logout URL, if you want the user logged out of your IdP after logging out of Canvas, will be same as below. The proxy will not keep a session, so you will need to configure Canvas to send the user to your IdP's Logout endpoint.
Set Up Requires Canvas Administrative Privileges
Each college using Canvas has one or two people who have been established as the "Canvas Administrators" for that college. The person(s) in that this role has access to their Canvas site with "administrative privileges", including being able to configure how authentication is done for their Canvas site. This individual will need to make the changes outlined in this document.
Canvas recommends that you first implement the these changes on in your Test/Beta site and ensure it is working correctly there prior to configuring it on in your Production site. Please be aware that every few weeks, Instructure replaces your Test/Beta site config with your Production config, so you might have to repeat configuring the steps below multiple times if it takes longer to complete your verification testing.
Info |
---|
This document tells you how to navigate to the page that has the SAML config options on it: |
Canvas Configuration Steps
Step 1- Click on "Authentication" in the left-hand pane of this screen:
Then click on SAML in the right-hand side of the subsequent screen:
That will bring you to the main "SAML configuration form". The following information should be placed in the fields:
* Log On URL:
* Log Out URL: https://idp.ccsf.edu/idp/profile/Logout (Example- please use your colleges version)
<!-- Not actually a SAMLv2 Logout endpoint, but it is where we want SPs to send the user -->
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.ccsf.edu/idp/profile/Logout"/>
* Prod Certificate fingerprint: 02:B1:F7:19:22:4E:FE:1E:FF:46:E1:B5:BA:55:E8:14:10:5C:4D:59
* Login attribute: eduPersonPrincipalName
Or eduPersonPrincipalName (domain stripped) if you don't include the @campus.edu on the identifier you send to Canvas in the provisioning feed.
There is a drop down with multiple choices, You want to choose one of the two 'eduPersonPrincipalName' choices. That has to match what you fill into the LOGIN_ID in the Canvas provisioning feed. Do NOT choose "NameID".
Testing in the Canvas Test Environment (Pilot)
Testing should occur on the Test/Beta site that has been established for your college. An example of a test url is: https://ccsf.test.instructure.com/login/saml You will need to replace the correct values associated to your college test site in order to successfully test the changes.
Start at your equivalent of: https://ccsf.test.instructure.com/login/saml
Test Site: To configure your testing URL, https://[your domain].test.instructure.com/login/saml
Beta Site: To configure your beta test URL: https://[your domain].beta.instructure.com/login/saml
Note: You can test in either your "beta" or "test" environments.
Confirm Success and Move to Production Testing
Contacts
SSO Proxy Project Team
Who | What | How |
---|---|---|
Rodney Hing Chris Franz | SSO & Proxy Technical Integration Shibboleth Technical Implementations Shibboleth Service & Upgrade | |
Matt Schroeder | SSO Support | mschroeder@ccctechcenter.org |
Patty Donohue Product Manager SSO Proxy Product Manager | CCC SSO Initiative SSO Proxy Implementation InCommon Federation Implementation OpenCCC Account Integration | |
John Sills CE Product Manager OEI Product Manager | CCC Canvas Implementation CCC Course Exchange (CE) Technical Integration |