This article describes the process of configuring Google as an Identity Provider (IdP) ready to work with Canvas.
Security Assertion Markup Language
The job of the IdP is to identify users based on credentials. The IdP typically provides the login screen interface and presents information about the authenticated user to Service Providers after successful authentication.
ADFS is the Identity Provider.
An SP is usually a website providing information, tools, reports, etc to the end user. Canvas provides a learning environment to teachers, students, and admins and is therefore the Service Provider.
Note: An SP cannot authenticate against an IdP unless the IdP is known to the SP. Likewise, an IdP will not send assertions to an SP that it does now know about.
Information about the SP or IdP. This metadata is almost always provided in the form of XML. The metadata about your Canvas instance is located at https://<yourcanvas>.instructure.com/saml2 (replace <yourcanvas> with the first portion of your Canvas domain).
Single Sign On.
This is what happens when a user isn't required to log in to a second service because information about the authenticated user is passed to the service.
When a user logs out of a service, some IdPs can subsequently log the user out of all other services the user has authenticated to.
ADFS supports this but may occasionally experience issues such as preventing a successful logout. Users will be logged out of Canvas but may not be logged out of ADFS.
Username in Canvas terminology.
When information about an authenticated user is returned to Canvas, a user with a login_id matching the incoming data is looked for.
Unique ID of a user in Canvas.
Used to link a user to an outside system, often a Student Information System (SIS).
Student Information System
- Any user that needs to authenticate via Google SAML must already have a user account provisioned in Canvas.
- The login_id field in Canvas must match the selected field returned from Google.
- Canvas does not automatically create user accounts from successful single-sign-ons. User accounts must either be created manually in the web interface or through the SIS import CSVs.
- Your organization must be using Google Apps.
- You must be able to login to the admin console for your organization.
To complete the steps in this documentation, you will need to use your Production environment of Canvas. Testing Google SAML authentication will not work in Test or Beta.
Login Release Valve
You may lock yourself out of Canvas while you are working setup authentication. If this happens, there is a way to log in to Canvas using local authentication. Simply go to /login/canvas. For instance: http://<yourcanvasname>.instructure.com/login/canvas (This forces Canvas to display the local login form rather than redirecting to the SAML login page).
Configuration SSO App in Google
Follow the Set up your own SAML app instructions at https://support.google.com/a/answer/6087519?hl=en to configure Canvas as a SAML SSO application in Google. The information you need to enter is, for the most part, self-explanatory. Some of the information you will need comes from your Canvas Metadata to complete this. Your metadata is located at https://<yourschool>.instructure.com/saml2.
You will be in both the Google Apps admin console, as well as in Canvas, so have both sites open in different tabs.
- In Canvas, select Google SAML authentication by going to the Authentication tab on the left, and select “SAML” (rather than “Google”) from the drop-down menu on the right.
- Login to the Google Apps administration Console.
- Click the Apps option.
- Click SAML Apps
- Click the “+” icon in the bottom right
- Click the “Setup My Own Custom App” link
- You will need the information on this screen for configuring SAML with Canvas.
- Basic Information for your Custom App
- Service Provider Details
- Enter https://<your_Canvas_URL>/login/saml for “ACS URL”
- Enter http://<your_Canvas_URL>/saml2 for “Entity ID”
- Enter https://<your_Canvas_URL> for “Start URL”
- Check the “Signed Response” checkbox
- Change “Name ID Format” to “Email”
- Click “Next”
- Click Finish
- Click OK
- You have added the SAML App to Google Apps, but you also need to turn on the app for your users:
- If everything went well then your screen should look like this.
- Now you are ready to calculate the signing token fingerprint and configure Canvas.
Calculate the Fingerprint
- Open the metadata xml file (downloaded from the Google IdP Information page) in a text editor or using Google Chrome or Firefox.
- Copy the data contained between the <ds:X509Certificate>
- Calculate fingerprint using https://www.samltool.com/fingerprint.php
- Type '-----BEGIN CERTIFICATE-----' on the first line (five dashes before and after must be included) and hit enter
- Paste the x509certificate starting on second line
Note: Google SAML configurations do not need to be in first position. You just need to use a discovery URL when there are more than one method of authentication possible.
- Complete the configuration in Canvas:
- IdP Entity ID: Enter “Entity ID” from Google screen
- Log On URL: Enter “SSO URL” from Google screen
- Log Out URL: Enter “https://accounts.google.com/logout”
- Certificate Fingerprint: Copy the formatted fingerprint calculated the Calculate the Fingerprint section.
- Login Attribute: Select “NameID”
- Identifier Format: Select “urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress”
- Click “Save”