Cannot get Instructure SP working with IdP version 3

[Michael A Grady]

> On Jul 14, 2016, at 3:16 PM, Cantor, Scott <cantor.2 at OSU.EDU <mailto:cantor.2 at OSU.EDU>> wrote:
> 
>> We are sending the username in the unspecified nameid format in the
>> Subject, and an opaque identifier as eduPersonTargetedID, but not much
>> else. We send the assertion encrypted and the response signed.
> 
> They don't require an unspecified NameID, ergo you shouldn't be sending one since that's going to just create confusion and hassle with any SPs that really do require that.
> 
> We are using the NameID, in a format specific to the attribute we supply as the value (it's the URN for employeeNumber in fact) and I believe our Canvas admin set that up in the application by entering it there. I have no other non-defaulted settings in place. Since they are in InCommon, I could not rely on the metadata to get the IdP to use that NameID Format,  I had to use a relying-party override to set that rule.
> 
>> If anyone has been able to get Instructure to work in their Shibboleth
>> version 3 IdP environment, please tell me how you did it.
> 
> All the setup was on the Canvas side, really, I did the bare minimum and it worked fine.
> 
> -- Scott

Canvas is happy to take eduPersonPrincipalName (any you can tell it to use if with or without the suffix, depending on what form of Id you send in your provisioning feed.) Or that identifier in any manner of NameID formats -- there is a dropdown list on their SAML integration page. (They must have done something for OSU, though, if the format of yours is the URN for employyeNumber, because that is not a choice on the dropdown.)

(I tried to include some partial screen shots, but makes message too big to be accepted by list.)


--

Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160714/514b321b/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160714/514b321b/attachment.sig>