<div dir="ltr"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">The primary account identifier for Zoom is whatever attribute you put in the Zoom Email Address in the SAML mapping.</blockquote><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763">Yes, but you can also have Zoom track email address changes at login. From Zoom's help:</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763"><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small;color:#073763">Employee Unique ID: The unique ID for the user. Use this for simplifying the process when users change their email address. If your unique ID is in the NameID element, enter <NameID> instead.</div></blockquote><font color="#073763" face="trebuchet ms, sans-serif"><div><font color="#073763" face="trebuchet ms, sans-serif"><br></font></div><span class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">I don't think that this was configurable when we first started with Zoom, but I wouldn't swear to that either. FWIW we map email address to the user's actual email address and Employee Unique ID to eduPersonUniqueID.</span></font><div><div><div><font color="#073763" face="trebuchet ms, sans-serif"><span class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)"></span></font><div><font color="#073763" face="trebuchet ms, sans-serif"><span class="gmail_default" style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">-L</span></font><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><br><table style="color:rgb(136,136,136);border:none;border-collapse:collapse"><tbody><tr style="height:0pt;border-top:1pt solid rgb(204,204,204)"><td style="border-right:1pt solid rgb(204,204,204);vertical-align:middle;padding:5pt;overflow:hidden"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><a href="http://www.carleton.edu/" target="_blank"><span style="font-size:11pt;font-family:Arial;color:rgb(17,85,204);vertical-align:baseline;white-space:pre-wrap"><span style="border:none;display:inline-block;overflow:hidden;width:70px;height:73px"><img height="73" src="https://lh6.googleusercontent.com/QEL1To3Ci_dJA1huaKzfZ0Lf4MaZlAy_f-W3vQjbyzNq_yXq_ZYGv3tuT4dkaZS_bZ5X6fZR4iKzBboZhxbCF5htZFnLNKGqmrzHsVJtsjsy0pfK5w2z0Dlq-EtZcWhv0PxBpWmR" width="70" style="margin-left:0px;margin-top:0px"></span></span></a></p></td><td style="border-left:1pt solid rgb(204,204,204);vertical-align:top;padding:10.8pt;overflow:hidden"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font color="#dea410" face="Arial"><span style="font-size:14.6667px;white-space:pre-wrap"><b>Les LaCroix '79</b></span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Strategic Technologist</span></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Information Technology Services</span></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">t: (507) 222-5455</span></span></p></td></tr></tbody></table></div></div></div><br></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Aug 22, 2020 at 9:23 PM Mak, Steve <<a href="mailto:makst@upenn.edu">makst@upenn.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)">We've done extensive SSO testing with Zoom and this is what we found.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)">The primary account identifier for Zoom is whatever attribute you put in the Zoom Email Address in the SAML mapping.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)">We had a school use email address and eduPersonTargetedID as a fallback and if our users suppressed their email address the user would be logged into a new account based on their EPTID. Those with EPTIDs could not be easily invited
to meetings.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)">We've tried a combo of Zoom Email mapped to email and Zoom Employee Unique ID to EPPN/employeeNumber, but all that did was create a complex account identifier, where if either changed it resulted in an error or a new account.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)">What we've settled on is this: Zoom Email mapped to EPPN, and we deny release of email address to Zoom. This is the only choice we had due to a desire to cross integrate with Canvas and other EDU services.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,45,144)">- Steve<br>
</span></div>
<p style="margin:0in 0in 0pt"><b><span style="color:rgb(0,45,144)"><font face="Calibri"></font></span></b><br>
</p>
<div>
<div id="gmail-m_2471174133306929176Signature">
<div>
<div id="gmail-m_2471174133306929176divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p style="margin-top:0px;margin-bottom:0px"></p>
</div>
</div>
</div>
</div>
<div id="gmail-m_2471174133306929176appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_2471174133306929176divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Les LaCroix <<a href="mailto:llacroix@carleton.edu" target="_blank">llacroix@carleton.edu</a>><br>
<b>Sent:</b> Saturday, August 22, 2020 5:56 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Configuring Shibboleth for Zoom</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">
Donald,</div>
<div style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">
<br>
</div>
<div style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">
We have Shibb configured with the usual SAML persistent NameID, and Zoom configured to pay attention to eduPersonUniqueID as the user identifier, mail for email address etc. The config has been in place since last spring term, and we haven't had any issues
with logins or invitations.</div>
<div style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">
<br>
</div>
<div style="font-family:"trebuchet ms",sans-serif;font-size:small;color:rgb(7,55,99)">
-Les</div>
<div>
<div dir="ltr">
<div dir="ltr"><br>
<table style="color:rgb(136,136,136);border:none;border-collapse:collapse">
<tbody>
<tr style="height:0pt;border-top:1pt solid rgb(204,204,204)">
<td style="border-right:1pt solid rgb(204,204,204);vertical-align:middle;padding:5pt;overflow:hidden">
<p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><a href="http://www.carleton.edu/" target="_blank"><span style="font-size:11pt;font-family:Arial;color:rgb(17,85,204);vertical-align:baseline;white-space:pre-wrap"><span style="border:none;display:inline-block;overflow:hidden;width:70px;height:73px"><img height="73" width="70" style="margin-left: 0px; margin-top: 0px;" src="https://lh6.googleusercontent.com/QEL1To3Ci_dJA1huaKzfZ0Lf4MaZlAy_f-W3vQjbyzNq_yXq_ZYGv3tuT4dkaZS_bZ5X6fZR4iKzBboZhxbCF5htZFnLNKGqmrzHsVJtsjsy0pfK5w2z0Dlq-EtZcWhv0PxBpWmR"></span></span></a></p>
</td>
<td style="border-left:1pt solid rgb(204,204,204);vertical-align:top;padding:10.8pt;overflow:hidden">
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font color="#dea410" face="Arial"><span style="font-size:14.6667px;white-space:pre-wrap"><b>Les LaCroix '79</b></span></font></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Strategic Technologist</span></span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Information Technology Services</span></span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(11,80,145)"><span style="font-size:11pt;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">t: (507) 222-5455</span></span></p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<br>
</div>
<br>
<div>
<div dir="ltr">On Fri, Aug 21, 2020 at 9:42 PM Lohr, Donald A - lohrda <<a href="mailto:lohrda@jmu.edu" target="_blank">lohrda@jmu.edu</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="auto">
<div>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">Referring to this URL:</span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt"><a href="https://support.zoom.us/hc/en-us/articles/201363003-Getting-started-with-SSO" target="_blank">https://support.zoom.us/hc/en-us/articles/201363003-Getting-started-with-SSO</a></span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">...it states the following:</span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">First, configure your IdP to send us the following</span></p>
<ul>
<li style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:Menlo-Regular;font-size:10pt"></span><span style="font-family:".SFUIText";font-size:17pt">Any unique identifier linked to nameID such as eduPersonTargetedID, persistentID, or mail</span>
</li><li style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:Menlo-Regular;font-size:10pt"></span><span style="font-family:".SFUIText";font-size:17pt">(Optional) Accepted attributes are email (urn:oid:0.9.2342.19200300. 100.1.3), sn (urn:oid:2.5.4.4), and givenName (urn:oid:2.5.4.42).</span>
</li></ul>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">Our plan would be to configure Shibboleth to set the nameID for Zoom to not be a user's email address. We want to use a better unique & never changing attribute, the user's eduPersonUniqueId attribute value.
We will also send Zoom a user's mail, givenname and sn attribute values.</span></p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69);min-height:20.3px">
<span style="font-family:".SFUIText";font-size:17pt"></span><br>
</p>
<p style="margin:0px;line-height:normal;font-family:".SF UI Text";color:rgb(69,69,69)">
<span style="font-family:".SFUIText";font-size:17pt">Is anyone's Shibboleth configuration for Zoom using something other than email as the nameID value? If so have you encountered any issues with nameID not set as a users email value? Especially with SSO
login, the emailing of or accepting invitations or using the Canvas LTI Pro component.</span></p>
<br>
<span style="background-color:rgba(255,255,255,0)">-- <br>
D o n a l d L o h r<br>
I n f o r m a t i o n S y s t e m s<br>
J a m e s M a d i s o n U n i v e r s i t y<br>
5 4 0 . 5 6 8 . 3 7 3 0</span></div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>