The following is an example using the configuration values that were filled in for CCSF's integration with Canvas. This document illustrates configuring your Canvas site to go straight to your college/district IdP. The updates below will route your college/district IdP through the CCC IdP Proxy instead. The following values will need to be updated in order to implement this change:
...
* Pilot Certificate fingerprint: FB:97:39:4D:14:17:12:5A:F5:A3:DF:80:98:CB:74:F6:85:81:D5:A8
* Prod Certificate fingerprint: 02:B1:F7:19:22:4E:FE:1E:FF:46:E1:B5:BA:55:E8:14:10:5C:4D:59
* Prod Certificate fingerprint: 02:B1:F7:19:22:4E:FE:1E:FF:46:E1:B5:BA:55:E8:14:10:5C:4D:59
| Info |
|---|
Notes: Most services allow you to enter the entire "signing cert", but Canvas just wants what is called the "fingerprint" from that. First, you need to find your signing cert by looking at the value of the 'idp.signing.cert=' in your IdP's conf/idp.properties file. For CCSF that is: idp.signing.cert= %{idp.home}/credentials/idp.crt. If you are on a Linux system that has the 'openssl' command, you can get the fingerprint by using the following command: openssl x509 -noout -fingerprint -in idp.crt which will give you something like: SHA1 Fingerprint=A6:DD:7A:D5:8E:83:D8:51:6C:EC:72:F4:EF:B5:F0:0F:5C:6B:66:FC Likely an easier alternative that works no matter what is to visit the following website: |
...
* Login attribute: eduPersonPrincipalName
...
There is a drop down with multiple choices, You want to choose one of the two 'eduPersonPrincipalName' choices. That has to match what you fill into the LOGIN_ID in the Canvas provisioning feed. Do NOT choose "NameID".
* Identifier Format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
Choose the above value from the drop-down and Save your changes. The drop-down should have the following set of choices:
...