Configuring Shibboleth for Zoom

Sat Aug 22 18:44:26 UTC 2020

We want a Shibboleth / Zoom configuration, where, if the user's email address changes (we have several scenarios where that happens) that the SSO assertion data to Zoom profile matching is not based on a user's email address but on something that is unique and never changing. And for us a user's email address, while unique, is not never changing. So using something like a user's eduPersonTargetedID value or their eduPersonUniqueId value to match on in lieu of their email address value works better for us.

Thanks,
Don

On Aug 21, 2020, at 10:50 PM, Mike Osterman <ostermmg at whitman.edu<mailto:ostermmg at whitman.edu>> wrote:

Hi Donald,

We didn't use Shib for it, but rather the SAML IdP in CAS, but we have been sending eduPersonTargetedID and it's working just fine.

I literally just set up LTI Pro for Canvas last night, and only in our test Canvas instance, but the SSO seemed to work just fine.

On the LTI Pro front: one piece of advice is to join the EDU-ZOOM listserv as there's a fair amount of discussion around LTI Pro and configuring it in an SSO environment.

Good luck!
Mike

On Fri, Aug 21, 2020 at 7:42 PM Lohr, Donald A - lohrda <lohrda at jmu.edu<mailto:lohrda at jmu.edu>> wrote:

Referring to this URL:

https://support.zoom.us/hc/en-us/articles/201363003-Getting-started-with-SSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__support.zoom.us_hc_en-2Dus_articles_201363003-2DGetting-2Dstarted-2Dwith-2DSSO&d=DwMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=GaeRgD-t3sx9pq6ZYQOIEWiWpYUYPfC1BO1pzgiVxuc&s=_V81VvDtXlg_ymfsyQaINE-3e5n3BB78G9am2aVjlII&e=>

...it states the following:

First, configure your IdP to send us the following

  *   Any unique identifier linked to nameID such as eduPersonTargetedID, persistentID, or mail
  *   (Optional) Accepted attributes are email (urn:oid:0.9.2342.19200300. 100.1.3), sn (urn:oid:2.5.4.4), and givenName (urn:oid:2.5.4.42).

Our plan would be to configure Shibboleth to set the nameID for Zoom to not be a user's email address. We want to use a better unique & never changing attribute, the user's eduPersonUniqueId attribute value. We will also send Zoom a user's mail, givenname and sn attribute values.

Is anyone's Shibboleth configuration for Zoom using something other than email as the nameID value?  If so have you encountered any issues with nameID not set as a users email value? Especially with SSO login, the emailing of or accepting invitations or using the Canvas LTI Pro component.

--
D o n a l d   L o h r
I n f o r m a t i o n   S y s t e m s
J a m e s   M a d i s o n   U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=GaeRgD-t3sx9pq6ZYQOIEWiWpYUYPfC1BO1pzgiVxuc&s=-JMQXbcwjiKVIJ9et9QsxSU__ddyjzhqUKVNt00HKP4&e=>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=GaeRgD-t3sx9pq6ZYQOIEWiWpYUYPfC1BO1pzgiVxuc&s=-JMQXbcwjiKVIJ9et9QsxSU__ddyjzhqUKVNt00HKP4&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200822/6791701f/attachment.htm>