<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Courier;
panose-1:2 7 4 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Times New Roman",serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
code
{mso-style-priority:99;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri Light",sans-serif;
color:#1F4D78;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">FYI, I’m never a fan of having my IdP dynamically download unsigned metadata or metadata for which there isn’t a published certificate against which I can validate
it. So, we download Canvas’s metadata and store it locally. Once it’s in your control, it’s easier to just add the NameID format to the metadata, IMHO. Even with that, the activation condition in your saml-nameid.xml is unnecessary. The saml source attribute
NameID generator will use the first attribute in its list that was made available via the attribute filter. With that done, you’ve got the choice of setting the nameID format via either metadata or the relying party config.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">We set the name ID format in metadata to emailAddress and released eppn through the source attribute nameID generator.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Keith<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Keith<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Aterea Brown<br>
<b>Sent:</b> Monday, May 20, 2019 4:25 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Canvas Integration Examples<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black">Are you using SSO tracer or some other saml capture plugin in your browser? You can check the nameid that has been generated. I think you can also increase the logging for <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"> <variable name="idp.loglevel.messages" value="DEBUG" /><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"> <variable name="idp.loglevel.encryption" value="DEBUG" /><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"> to see the SAML messages in your log file.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black">Also bear in mind from <a href="https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<h3 style="mso-margin-top-alt:22.5pt;margin-right:0in;margin-bottom:0in;margin-left:0in;margin-bottom:.0001pt;background:white">
<span style="font-family:"Segoe UI",sans-serif;color:black;letter-spacing:-.05pt">Format Selection<o:p></o:p></span></h3>
<p style="margin-top:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">For any given request, the ordered list of Formats to try to generate is based on combining the SP's request (SAML 2 requests can include
a </span><code><span style="font-size:10.0pt;font-family:Courier;color:#172B4D"><NameIDPolicy></span></code><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"> element that requires a particular Format), the </span><code><span style="font-size:10.0pt;font-family:Courier;color:#172B4D"><NameIDFormat></span></code><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"> element(s)
in the SP's metadata, and the </span><code><span style="font-size:10.0pt;font-family:Courier;color:#172B4D">nameIDFormatPrecedence</span></code><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration"><span style="color:#3260BA">profile
configuration</span></a> property, if set for the chosen relying party configuration. If the metadata contains nothing, or contains the "</span><code><span style="font-size:10.0pt;font-family:Courier;color:#172B4D">urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</span></code><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">"
value, then the metadata is ignored.<o:p></o:p></span></p>
<p style="margin-top:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">If a </span><code><span style="font-size:10.0pt;font-family:Courier;color:#172B4D"><NameIDPolicy></span></code><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"> element
with Format is supplied, a suitable identifier MUST be generated or an error will be returned.<o:p></o:p></span></p>
<p style="margin-top:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">Otherwise the formats specified in an SP's metadata are filtered against a </span><code><span style="font-size:10.0pt;font-family:Courier;color:#172B4D">nameIDFormatPrecedence</span></code><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration"><span style="color:#3260BA">profile
configuration</span></a> property, if set, and the resulting set of Formats is tried in order. That is, the first Format in the profile configuration that is also in the metadata and that results in a valid result will be used.<o:p></o:p></span></p>
<p style="margin-top:7.5pt;background:white"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">Default Formats for each SAML version are set via <em><span style="font-family:"Segoe UI",sans-serif">saml-nameid.properties</span></em> and
are used in the event that nothing else is called for. You should <strong><span style="font-family:"Segoe UI",sans-serif">not</span></strong> alter that setting in most cases.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black">So you should check whats being returned for nameid. It might not be what you expect.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div id="divtagdefaultwrapper">
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">-art</span><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black"><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>>
on behalf of Jeremiah Brock <<a href="mailto:jbrock@everettcc.edu">jbrock@everettcc.edu</a>><br>
<b>Sent:</b> Tuesday, 21 May 2019 8:18 AM<br>
<b>To:</b> <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Subject:</b> Canvas Integration Examples</span> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Good afternoon, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> I am trying to setup the Canvas SAML authentication using our Shibboleth v3 IDP instance and am having a heck of a time finding any recent documentation.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> I believe that Canvas ONLY supports the NameID or eduPersonPrincipalName for the Login Attribute. So I am attempting to use the NameID that I source on the fly from our sid attribute in the saml-nameid.xml .<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> With the current configs (which I will have available below) I am directed to our IDP from Canvas to authenticate and after successful authentication, I am redirected to canvas and receive an error message "There was a problem logging
into Everett Community College".<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b> metadata-providers.xml</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><MetadataProvider id="CanvasMetadata"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> xsi:type="FileBackedHTTPMetadataProvider"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> backingFile="/opt/shibboleth-idp/metadata/canvas-metadata.xml"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> metadataURL="<a href="https://everettcc.instructure.com/saml2">https://everettcc.instructure.com/saml2</a>"/><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b> attribute-resolver.xml</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><AttributeDefinition xsi:type="Simple" id="sid" sourceAttributeID="employeenumber"><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <Dependency ref="389DSLDAP" /><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" /><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="sid" encodeType="false" /><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"></AttributeDefinition><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b> attribute-filter.xml</b><o:p></o:p></p>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><!-- For Canvas Testing --><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <AttributeFilterPolicy id="InstructureCanvasPolicy"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <PolicyRequirementRule xsi:type="Requester" value="<a href="http://everettcc.instructure.com/saml2">http://everettcc.instructure.com/saml2</a>"/><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="NameID"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY"/><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="sid"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY"/><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> </AttributeFilterPolicy><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b> saml-nameid.xml</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><!-- NEW WAY PER SP!!!! JB 20190520 --><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><bean parent="shibboleth.SAML2AttributeSourcedGenerator"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> p:attributeSourceIds="#{ {'sid'} }"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <property name="activationCondition"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <bean parent="shibboleth.Conditions.RelyingPartyId"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> c:candidate="<a href="http://everettcc.instructure.com/saml2">http://everettcc.instructure.com/saml2</a>" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </property><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></bean><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><o:p> </o:p></b></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <b>relying-party.xml</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><!-- Canvas--><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="http://everettcc.instructure.com/saml2">http://everettcc.instructure.com/saml2</a>"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <property name="profileConfigurations"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <list><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <bean parent="Shibboleth.SSO" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <bean parent="SAML2.SSO" <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">p:encryptAssertions="false"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">p:signAssertions="false"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">p:encryptNameIDs="false"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'}}" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><ref bean="SAML2.Logout" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></list><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </property><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></bean><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<p class="MsoNormal"> Here is what I see in the <b>idp-process.log</b> after a successful authentication, the population of NameID with the sid attribute and the release of the sid (but not the NameID?).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,018 - DEBUG [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:154] - Beginning to encode attribute sid<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,018 - DEBUG [net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] - Encoding value 123456789 of attribute sid<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,019 - DEBUG [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191] - Completed encoding 1 values for attribute sid<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,019 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:116] - Profile Action AddAttributeStatementToAssertion: Adding constructed AttributeStatement to Assertion _2aa1a4c562370d0af02cbf0adce804ac <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,023 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:124] - Configuration specifies the following formats: [urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,023 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:141] - Metadata did not specify any formats, relying on configuration alone<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,024 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:197] -
<b>Checking for source attribute sid</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,024 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:216] -
<b>Generating NameID from String-valued attribute sid</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,041 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAssertion:592] - Found Assertion with AuthnStatement to decorate in outbound Response<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,041 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAssertion:290] - Issuance of delegated was not indicated, skipping assertion decoration<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,062 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:179] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain'
on OUTBOUND message context<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,062 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,068 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,072 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action RecordResponseComplete: Record response complete<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2019-05-20 12:57:07,073 - INFO [Shibboleth-Audit.SSO:275] - 20190520T195707Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_bd08fcee-9195-4093-b01d-428224c54864|<a href="http://everettcc.instructure.com/saml2|http:/shibboleth.net/ns/profiles/saml2/sso/browser|https:/idp-389ds-test.everettcc.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2dfbb1143bb975720f03d1582c5960c7|jbrock|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|sid|123456789|_2aa1a4c562370d0af02cbf0adce804ac|">http://everettcc.instructure.com/saml2|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp-389ds-test.everettcc.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2dfbb1143bb975720f03d1582c5960c7|jbrock|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|sid|123456789|_2aa1a4c562370d0af02cbf0adce804ac|</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> In the Canvas SAML options I have the following :<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Login Attribute : NameID<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Identifier Format : urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Authentication Context : No value<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Message Signing : Not Signed<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> Thanks for any advise or working examples.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">~Jeremy<o:p></o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Jeremiah Brock<br>
<span style="font-size:9.5pt">IT Web, Data and Development Services / Information Security</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">425-259-8707<br>
<a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>