<div dir="ltr"><div dir="ltr"><div dir="ltr">Thanks Keith,<div><br></div><div> I have made both your suggestions.</div><div><br></div><div> For anyone following the thread :</div><div><br></div></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><div>The <b>canvas-metadata.xml</b> is populated from https://<yourschool>.<a href="http://instructure.com/saml2">instructure.com/saml2</a> and on Unix systems can be performed as : </div><div><br></div></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><div>wget https://<yourschool>.<a href="http://instructure.com/saml2">instructure.com/saml2</a> -O canvas-metadata.xml</div></div></div></blockquote></blockquote><div dir="ltr"><div dir="ltr"><div><br></div></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><div><b>metadata-providers.xml</b></div><div><b><br></b></div></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div dir="ltr"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div><MetadataProvider id="CanvasMetadata" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/canvas-metadata.xml"/></div></div></blockquote></div></blockquote><div dir="ltr"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div><br></div></div></blockquote> <br><div dir="ltr"><div>~Jeremy</div><div> </div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 21, 2019 at 9:13 AM Wessel, Keith <<a href="mailto:kwessel@illinois.edu">kwessel@illinois.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-6584987957579519752WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">FYI, you’ll probably still want to download that metadata manually and consume it as a local file rather than a file backed http metadata provider. Consuming
unsigned metadata automatically intot he IdP is riskier than having to manually update the metadata if they change it. Best option, as you said, is still consuming from InCommon.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">And SHA1 is a bad idea, too. SHA-256 is much more secure.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Keith<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><a name="m_-6584987957579519752__MailEndCompose"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></a></p>
<span></span>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>>
<b>On Behalf Of </b>Jeremiah Brock<br>
<b>Sent:</b> Tuesday, May 21, 2019 11:04 AM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Canvas Integration Examples<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Just a quick follow up - I got it working!<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">My issue wasn't configs as much as it was a bad signing crt in my idp-metadata.xml.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">My working setup (for anyone else stumbling onto this via Google) is :<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Context </b>: We are using the student/staff SID as the Login Attribute which ties to our pre-generated Canvas Accounts. In our directory, we populate the
<b>employeenumber</b> with this SID.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Canvas SAML Settings :</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><b>Login Attribute</b> : sid (this is any attribute that you release to Canvas to tie into the accounts on their end)<u></u><u></u></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><b>Identifier Format</b> : urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<u></u><u></u></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><b>Authentication Context</b> : urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<u></u><u></u></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><b>Message Signing</b> : RSA-SHA1<u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Shibboleth IDP Settings :</b><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><b>metadata-providers.xml</b><u></u><u></u></p>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30pt;margin-right:0in">
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><!-- Might look at pointing this to incommon in the future --><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><MetadataProvider id="CanvasMetadata"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xsi:type="FileBackedHTTPMetadataProvider"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> backingFile="/opt/shibboleth-idp/metadata/canvas-metadata.xml"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> metadataURL="<a href="https://everettcc.instructure.com/saml2" target="_blank">https://everettcc.instructure.com/saml2</a>"/><u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
</blockquote>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b>attribute-resolver.xml</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30pt;margin-right:0in">
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><AttributeDefinition xsi:type="Simple" id="sid" sourceAttributeID="employeenumber"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <Dependency ref="389DSLDAP" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:sid" encodeType="false" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="sid" encodeType="false" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"></AttributeDefinition><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</blockquote>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b>attribute-filter.xml</b><u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<p class="MsoNormal"><u></u> <u></u></p>
</blockquote>
</div>
<div>
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><AttributeFilterPolicy id="InstructureCanvasPolicy"><u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <PolicyRequirementRule xsi:type="Requester" value="<a href="http://everettcc.instructure.com/saml2" target="_blank">http://everettcc.instructure.com/saml2</a>"/><u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="sid"><u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY"/><u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> </AttributeRule><u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"></AttributeFilterPolicy><u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Have a great day fellow Shibboleth users!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">~Jeremy<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, May 20, 2019 at 3:36 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">On 5/20/19, 6:27 PM, "Jeremiah Brock" <<a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a>> wrote:<br>
<br>
> Scott if you have an in with Canvas - might want to suggest they update their documentation for integrating with<br>
> Shibboleth.<br>
<br>
I don't encourage vendors to do anything but document their SAML requirements. Shibboleth configuration is up to our documentation, not theirs.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Jeremiah Brock<br>
<span style="font-size:9.5pt">IT Web, Data and Development Services / Information Security</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">425-259-8707<br>
<a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Jeremiah Brock<br><span style="font-size:12.8px">IT Web, Data and Development Services / Information Security</span><br></div><div dir="ltr">425-259-8707<br><a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a></div></div></div></div>