<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><blockquote type="cite" class="">On Jul 14, 2016, at 3:16 PM, Cantor, Scott <<a href="mailto:cantor.2@OSU.EDU" class="">cantor.2@OSU.EDU</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">We are sending the username in the unspecified nameid format in the<br class="">Subject, and an opaque identifier as eduPersonTargetedID, but not much<br class="">else. We send the assertion encrypted and the response signed.<br class=""></blockquote><br class="">They don't require an unspecified NameID, ergo you shouldn't be sending one since that's going to just create confusion and hassle with any SPs that really do require that.<br class=""><br class="">We are using the NameID, in a format specific to the attribute we supply as the value (it's the URN for employeeNumber in fact) and I believe our Canvas admin set that up in the application by entering it there. I have no other non-defaulted settings in place. Since they are in InCommon, I could not rely on the metadata to get the IdP to use that NameID Format, I had to use a relying-party override to set that rule.<br class=""><br class=""><blockquote type="cite" class="">If anyone has been able to get Instructure to work in their Shibboleth<br class="">version 3 IdP environment, please tell me how you did it.<br class=""></blockquote><br class="">All the setup was on the Canvas side, really, I did the bare minimum and it worked fine.<br class=""><br class="">-- Scott<br class=""></blockquote><div class=""><br class=""></div>Canvas is happy to take eduPersonPrincipalName (any you can tell it to use if with or without the suffix, depending on what form of Id you send in your provisioning feed.) Or that identifier in any manner of NameID formats -- there is a dropdown list on their SAML integration page. (They must have done something for OSU, though, if the format of yours is the URN for employyeNumber, because that is not a choice on the dropdown.)<div class=""><br class=""></div><div class="">(I tried to include some partial screen shots, but makes message too big to be accepted by list.)</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div apple-content-edited="true" class="">--</div><div apple-content-edited="true" class=""><br class=""></div><div apple-content-edited="true" class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><br class=""></div></body></html>