<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">FYI, you’ll probably still want to download that metadata manually and consume it as a local file rather than a file backed http metadata provider. Consuming
unsigned metadata automatically intot he IdP is riskier than having to manually update the metadata if they change it. Best option, as you said, is still consuming from InCommon.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">And SHA1 is a bad idea, too. SHA-256 is much more secure.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Keith<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Jeremiah Brock<br>
<b>Sent:</b> Tuesday, May 21, 2019 11:04 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Canvas Integration Examples<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Just a quick follow up - I got it working!<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">My issue wasn't configs as much as it was a bad signing crt in my idp-metadata.xml.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">My working setup (for anyone else stumbling onto this via Google) is :<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Context </b>: We are using the student/staff SID as the Login Attribute which ties to our pre-generated Canvas Accounts. In our directory, we populate the
<b>employeenumber</b> with this SID.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Canvas SAML Settings :</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><b>Login Attribute</b> : sid (this is any attribute that you release to Canvas to tie into the accounts on their end)<o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><b>Identifier Format</b> : urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified<o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><b>Authentication Context</b> : urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><b>Message Signing</b> : RSA-SHA1<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Shibboleth IDP Settings :</b><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><b>metadata-providers.xml</b><o:p></o:p></p>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><!-- Might look at pointing this to incommon in the future --><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><MetadataProvider id="CanvasMetadata"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> xsi:type="FileBackedHTTPMetadataProvider"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> backingFile="/opt/shibboleth-idp/metadata/canvas-metadata.xml"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> metadataURL="<a href="https://everettcc.instructure.com/saml2">https://everettcc.instructure.com/saml2</a>"/><o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
</blockquote>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b>attribute-resolver.xml</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><AttributeDefinition xsi:type="Simple" id="sid" sourceAttributeID="employeenumber"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <Dependency ref="389DSLDAP" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:sid" encodeType="false" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="sid" encodeType="false" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></AttributeDefinition><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b>attribute-filter.xml</b><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<p class="MsoNormal"><o:p> </o:p></p>
</blockquote>
</div>
<div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><AttributeFilterPolicy id="InstructureCanvasPolicy"><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <PolicyRequirementRule xsi:type="Requester" value="<a href="http://everettcc.instructure.com/saml2">http://everettcc.instructure.com/saml2</a>"/><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="sid"><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY"/><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> </AttributeRule><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"></AttributeFilterPolicy><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Have a great day fellow Shibboleth users!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">~Jeremy<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, May 20, 2019 at 3:36 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">On 5/20/19, 6:27 PM, "Jeremiah Brock" <<a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a>> wrote:<br>
<br>
> Scott if you have an in with Canvas - might want to suggest they update their documentation for integrating with<br>
> Shibboleth.<br>
<br>
I don't encourage vendors to do anything but document their SAML requirements. Shibboleth configuration is up to our documentation, not theirs.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Jeremiah Brock<br>
<span style="font-size:9.5pt">IT Web, Data and Development Services / Information Security</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">425-259-8707<br>
<a href="mailto:jbrock@everettcc.edu" target="_blank">jbrock@everettcc.edu</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>