These attributes are described in more detail in the accompanying wiki page entitled "Attributes for CCC SSO Federated Access". In particular, the critically important  eduPersonPrincipalName (EPPN) attribute is described more fully in that wiki page. A few sample definitions of creating, or "resolving", these attributes in a Shibboleth IdP v3 server can be found on the wiki page "Shibboleth IdP v3 Attribute Resolver Configuration".

The new IdP v3 config that has been put in place includes consuming a CCC system-wide, centrally managed digitally-signed metadata file from a URL (with verification of the signature for security.) The IdP automatically checks for updates for that file, and reloads it if such have been made.

The "CCC-wide central metadata file"  contains the metadata for a number of CCC system-wide services, including the Proxy. You can tell if your IdP has that file by checking for the file in the IdP's metadata/ directory, the file 'metadata/ccc-central-metadata.xml'. Otherwise, you need to download the metadata for the SSO Proxy from the following URLs (one for Pilot, one for Production). But do not try to download that metadata until completing Step 3 above.  

Each college/district IdP will have its own Proxy endpoint for metadata, and to which to send its response to, and those endpoints get created and added to the Proxy metadata distribution only once your IdP has itself been "added to" the Proxy's own configuration.

Just as with the CCCApply service, you will start with Pilot, and once that is working and you are given the "go-ahead", then download the metadata for Production. Note: you need to replace the 'nnn' at the end of each URL with the MIS code that applies to your district (if a district-wide IdP) or to the college (if a single college IdP). The SSO Integration Team will confirm with you what that code will be for your IdP.

Otherwise, if you are running Shibboleth IdP v3 without assistance from Unicon, follow the below instructions:

Metadata for the Proxy is contained within the the CCC Central Metadata feed that contains metadata for many CCC system-wide services. You should add the following configuration to your college/district IdP's conf/metadata-providers.xml file, which will automatically keep checking (every few hours) whether there is an updated file to download, and if so, download it and keep a local "backing file" on your IdP.

A.  Add metadata to SSO Proxy (Pilot and Production)

Just as you are adding the CCC SSO Proxy metadata to your IdP, the metadata for your college's IdP will need to be added to the Proxy. Unicon will add your college's metadata to the Proxy in the Pilot environment and will confirm with you once this process has been completed. You will not be able to successfully move forward with testing until this step has been completed. 

NOTE: In addition to the SSO Proxy, we also need to coordinate the replacement of your existing CCCApply metadata used to authenticate your college staff to your CCCApply Administrator and Report Center in the Pilot and Production environments. This step can happen concurrently with the SSO Proxy metadata upload, but testing the CCCApply URLs is a separate process that needs to be communicated with the Team. See "CCCApply Proxy Integration" section below for details.

Once all the above steps have been completed in Pilot, you can test by using the following URLs.  Once the college/district and the SSO Integration Team agree that everything is working as it should with the Pilot integration, then the process is repeated in the Production environment (proxy). 

Step A - Navigate to the Proxy Testing Web Application

To start the test, click on the following link:

https://sso.pilot.cccmypath.org/simplesaml/module.php/core/authenticate.php?as=MISnnn
 

If you receive an error page, either there is an issue with the IDP configuration, the MISnnn value is incorrect, or the district/college code for your Identity Provider has not yet been configured in the SSO Proxy.  

Step B - IDP Login

The SSO Proxy will redirect you to your IDP.  Log in with a known userid/password.

Step C - Proxy Verification Page

If an error page is displayed, check your IDP configuration to ensure you are configured correctly.

If your IDP is configured correctly, you will see the following page displaying the SAML attributes that were release by your Identity Provider
 

Step D - Report Testing Feedback to SSO Integration Team

After testing the Pilot Proxy URL, please forward feedback to the SSO Integration team

If testing the Pilot Proxy is successful, testing the Production Proxy URL is the final step in the initial integration.

Once all the above steps have been completed in Pilot and testing is successful, you will need to make any metadata or configuration changes to the Production IdP environment in order to enable the changes. You will need to download the metadata for the CCC SSO Proxy, similar to the steps taken in Step 4 for Pilot, from the following URL:

The Team will confirm with you what the code will be for your IdP.  Additional confirmation testing should occur once the changes have been made in Production to verify that the integration is still working as expected. Once this has been done, the initial integration with the SSO Proxy is complete.
 

STEP 9:  Coordinate with Unicon to update your metadata for CCCApply Administrator in Pilot & Production

In addition to the proxy, we will coordinate the replacement of your existing CCCApply metadata used to authenticate your college staff to your CCCApply Administrator and Report Center applications in the Pilot and Production environments.  This step will happen concurrently with the proxy metadata upload and testing.

Please be aware: If you are doing a straight up Shibboleth V2 to V3 upgrade - whether you do it yourself or Unicon does it for you - we will simply replace your existing CCCApply metadata (in both environments) and there will be no change to the URLs you are using to access the CCCApply staff tools. However, if you change the name of your IdP, or if you switch to an alternative SAML-compliant IdP solution, such as Portal Guard, Ellucian, or ADFS, your current staff tools URLs will no longer work and you will be provided with new Administrator and Report Center URLs. This information will be reviewed with you during the SSO Kick-Off meeting at the onset of this process, but it's important to note this here as a reminder.

Once your metadata is replaced for CCCApply in the Pilot environment, please test by having an authorized user login to either the CCCApply Administrator or Report Center. If successful, please let the SSO Integration team know that you are ready to test in Production.

STEP 10:  Configure your IdP to Integrate with Canvas

After you've completed and tested the SSO Proxy integration, you must configure your Canvas instance to work with the SSO Proxy.  

Integrate Canvas InCommon Metadata with the SSO Proxy

STEP 11:  Configure your IdP to Integrate with Hobson's Starfish

If your college is implementing Hobson's Starfish application, we will work with your college to integrate with the SSO Proxy. Contact the SSO Integration team for information. 

STEP 12:  Pilot Colleges & Early Adopters Test Proxy Integration (Assess, Course Exchange, and MyPath)