<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Just a quick follow up - I got it working!<div><br></div><div>My issue wasn't configs as much as it was a bad signing crt in my idp-metadata.xml.</div><div><br></div><div>My working setup (for anyone else stumbling onto this via Google) is :</div><div><br></div><div><b>Context </b>: We are using the student/staff SID as the Login Attribute which ties to our pre-generated Canvas Accounts. In our directory, we populate the <b>employeenumber</b> with this SID.</div><div><br></div><div><b>Canvas SAML Settings :</b></div><div><br></div></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><b>Login Attribute</b> : sid (this is any attribute that you release to Canvas to tie into the accounts on their end)</div></div></div><div><div><div><b>Identifier Format</b> : urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</div></div></div><div><div><div><b>Authentication Context</b> : urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div></div></div><div><div><div><b>Message Signing</b> : RSA-SHA1</div></div></div></blockquote><div dir="ltr"><div dir="ltr"><div><br></div><div><b>Shibboleth IDP Settings :</b></div></div></div></div></div></div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><b><br></b></div></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><b>metadata-providers.xml</b></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div><div><br></div><div><!-- Might look at pointing this to incommon in the future --></div><div><MetadataProvider id="CanvasMetadata"</div><div><span style="white-space:pre"> </span> xsi:type="FileBackedHTTPMetadataProvider"</div><div><span style="white-space:pre"> </span> backingFile="/opt/shibboleth-idp/metadata/canvas-metadata.xml"</div><div><span style="white-space:pre"> </span> metadataURL="<a href="https://everettcc.instructure.com/saml2">https://everettcc.instructure.com/saml2</a>"/></div></div></div></blockquote></blockquote><div dir="ltr"><div dir="ltr"><div><br></div></div></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><b>attribute-resolver.xml</b></div><div><b><br></b></div></div></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div><AttributeDefinition xsi:type="Simple" id="sid" sourceAttributeID="employeenumber"></div><div> <Dependency ref="389DSLDAP" /></div><div> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:sid" encodeType="false" /></div><div> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="sid" encodeType="false" /></div><div></AttributeDefinition></div></div></div></div></div></blockquote></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><br></div><div><br></div></div></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><b>attribute-filter.xml</b></div></div></div></div></blockquote></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><br></blockquote></div><div><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><div><AttributeFilterPolicy id="InstructureCanvasPolicy"></div></div></div></div></blockquote></div></div><div><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><div> <PolicyRequirementRule xsi:type="Requester" value="<a href="http://everettcc.instructure.com/saml2">http://everettcc.instructure.com/saml2</a>"/></div></div></div></div></blockquote></div></div><div><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><div> <AttributeRule attributeID="sid"></div></div></div></div></blockquote></div></div><div><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><div> <PermitValueRule xsi:type="ANY"/></div></div></div></div></blockquote></div></div><div><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><div> </AttributeRule></div></div></div></div></blockquote></div></div><div><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><div></AttributeFilterPolicy></div></div></div></div></blockquote></div></div></blockquote><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><br></div><div><br></div><div>Have a great day fellow Shibboleth users!</div><div><br></div><div>~Jeremy</div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, May 20, 2019 at 3:36 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 5/20/19, 6:27 PM, "Jeremiah Brock" <<a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a>> wrote:<br>
<br>
> Scott if you have an in with Canvas - might want to suggest they update their documentation for integrating with<br>
> Shibboleth.<br>
<br>
I don't encourage vendors to do anything but document their SAML requirements. Shibboleth configuration is up to our documentation, not theirs.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Jeremiah Brock<br><span style="font-size:12.8px">IT Web, Data and Development Services / Information Security</span><br></div><div dir="ltr">425-259-8707<br><a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a></div></div></div></div>