<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div>We want a Shibboleth / Zoom configuration, where, if the user's email address changes (we have several scenarios where that happens) that the SSO assertion data to Zoom profile matching is not based on a user's email address but on something that is unique
and never changing. And for us a user's email address, while unique, is not never changing. So using something like a user's <span style="background-color: rgba(255, 255, 255, 0);">eduPersonTargetedID value or their eduPersonUniqueId value to match on in lieu
of their email address value works better for us. </span></div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature">Thanks,</div>
<div id="AppleMailSignature">Don<br>
<p style="margin: 0px; line-height: normal; font-family: '.SF UI Text'; color: rgb(69, 69, 69); min-height: 20.3px;">
<br>
</p>
</div>
<div><br>
On Aug 21, 2020, at 10:50 PM, Mike Osterman <<a href="mailto:ostermmg@whitman.edu">ostermmg@whitman.edu</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div dir="ltr">Hi Donald,
<div><br>
</div>
<div>We didn't use Shib for it, but rather the SAML IdP in CAS, but we have been sending eduPersonTargetedID and it's working just fine. </div>
<div><br>
</div>
<div>I literally just set up LTI Pro for Canvas last night, and only in our test Canvas instance, but the SSO seemed to work just fine. </div>
<div><br>
</div>
<div>On the LTI Pro front: one piece of advice is to join the EDU-ZOOM listserv as there's a fair amount of discussion around LTI Pro and configuring it in an SSO environment.</div>
<div><br>
</div>
<div>Good luck!</div>
<div>Mike</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Fri, Aug 21, 2020 at 7:42 PM Lohr, Donald A - lohrda <<a href="mailto:lohrda@jmu.edu">lohrda@jmu.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="auto">
<div>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">Referring to this URL:</span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__support.zoom.us_hc_en-2Dus_articles_201363003-2DGetting-2Dstarted-2Dwith-2DSSO&d=DwMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=GaeRgD-t3sx9pq6ZYQOIEWiWpYUYPfC1BO1pzgiVxuc&s=_V81VvDtXlg_ymfsyQaINE-3e5n3BB78G9am2aVjlII&e=" target="_blank">https://support.zoom.us/hc/en-us/articles/201363003-Getting-started-with-SSO</a></span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">...it states the following:</span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">First, configure your IdP to send us the following</span></p>
<ul>
<li style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:Menlo-Regular;font-size:10pt"></span><span style="font-family:".SFUIText";font-size:17pt">Any unique identifier linked to nameID such as eduPersonTargetedID, persistentID, or mail</span>
</li><li style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:Menlo-Regular;font-size:10pt"></span><span style="font-family:".SFUIText";font-size:17pt">(Optional) Accepted attributes are email (urn:oid:0.9.2342.19200300. 100.1.3), sn (urn:oid:2.5.4.4), and givenName (urn:oid:2.5.4.42).</span>
</li></ul>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">Our plan would be to configure Shibboleth to set the nameID for Zoom to not be a user's email address. We want to use a better unique & never changing attribute, the user's eduPersonUniqueId attribute value.
We will also send Zoom a user's mail, givenname and sn attribute values.</span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">Is anyone's Shibboleth configuration for Zoom using something other than email as the nameID value? If so have you encountered any issues with nameID not set as a users email value? Especially with SSO login,
the emailing of or accepting invitations or using the Canvas LTI Pro component.</span></p>
<br>
<span style="background-color:rgba(255,255,255,0)">-- <br>
D o n a l d L o h r<br>
I n f o r m a t i o n S y s t e m s<br>
J a m e s M a d i s o n U n i v e r s i t y<br>
5 4 0 . 5 6 8 . 3 7 3 0</span></div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=GaeRgD-t3sx9pq6ZYQOIEWiWpYUYPfC1BO1pzgiVxuc&s=-JMQXbcwjiKVIJ9et9QsxSU__ddyjzhqUKVNt00HKP4&e=" rel="noreferrer" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>-- </span><br>
<span>For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=GaeRgD-t3sx9pq6ZYQOIEWiWpYUYPfC1BO1pzgiVxuc&s=-JMQXbcwjiKVIJ9et9QsxSU__ddyjzhqUKVNt00HKP4&e=">
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=GaeRgD-t3sx9pq6ZYQOIEWiWpYUYPfC1BO1pzgiVxuc&s=-JMQXbcwjiKVIJ9et9QsxSU__ddyjzhqUKVNt00HKP4&e=</a>
</span><br>
<span>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span><br>
</div>
</blockquote>
</body>
</html>