Integrating with Canvas

DRAFT: The following is an example using the configuration values that were filled in for CCSF's integration with Canvas. And this document currently illustrates configuring your Canvas site to go straight to your college/district IdP. We'll be updating this document to instead illustrate going to your college/district IdP throught the CCC IdP Proxy instead. That will change  the:

•  IdP entityID:  this will become the Proxy IdP entityID, not the college one
• Log On URL: this will become a URL that goes to the IdP Proxy SSO endpoint, and with a ?source= query argument identifying the college/district IdP to then go to
• Certificate fingerprint: this will become the certificate fingerprint of the IdP Proxy signing certificate (we will give you the specific value to fill in, it will be he same for everyone)
• Note: the Logout URL, if you want the user logged out of your IdP after logging out of Canvas, will be same as below. The IdP Proxy will not keep a session, so you just have Canvas send the user to your IdP's Logout endpoint.

Each college using Canvas has one or two people who have been established as "Canvas Administrators" for that college. The person(s) in that role have access to their Canvas site with "administrative privileges", including being able to configure how authentication is done for their Canvas site. That is the person who has access to "turn on" SAML authentication for the college site, and fill in the needed info for that to work.

Note that Canvas recommends you do this first on your Test/Beta site, get it working correctly there, and only then configure it on your Production site. But be aware thta every couple of weeks Instructure repalces your Test/Beta site config with your Production config, so you might have to repeat configuring the below multiple times if it takes you too long to complete your testing.

This document tells you how to navigate to the page that has the SAM config options on it:

      https://community.canvaslms.com/docs/DOC-4284

But the basic thing is to click on "Authentication" in the left-hand pane of this screen: 

And then click on SAML in the right-hand side of the subsequent screen: 

That will bring you to the main "SAML configuration form", and here is a guide to what to fill in for each of the form fields.

  * Identifier Format:  urn:oasis:names:tc:SAML:2.0:nameid-format:transient

(choose the above value from the drop-down and Save your changes. The drop-down should have the following set of choices:

* You can leave the rest of the fields empty/whatever is the default value, except maybe for Position. That applies if you are going to allow multiple ways of logging in, which you won't once you convert. If you only have one form of Authn configured, then Position doesn't matter. Otherwise, you probably want SAML listed first, so you'd set Position to '1' in the drop-down:

These are all the fields you'll see that the above applies to:

Testing