[ARCHIVED] LDAP vs Shibboleth Pros and Cons

[bradhollenbeck]

We have been using the basic LDAP authentication for our online courses for two plus years. Now our Office of Information Technology would like us to consider moving to Shibboleth (SSO) authentication. We would like to find out how the transition from LDAP to SSO has worked for other Canvas users. Did you find the transition painless or painful? Have you received feedback from faculty and students?   Any unforeseen consequences? We are at the front end of this decision and would like to learn from those that have already taken the leap.

[RobDitto]

Our institution successfully made this change with the help of a custom solution from Instructure Professional Services.  The project was a complex one: merging of three separate Canvas instances for UPenn schools into a University-wide instance.  However, I believe the part of the project involving LDAP-to-SAML (Shibboleth) transition had a reasonably small scope, thanks to two key success factors:

1. SIS login IDs were largely the same -- nearly everyone had both an LDAP object and a SAML credential with the same username.
2. SIS user IDs were also the same -- the university's fictitious ID number for each student, faculty or staff member -- in both LDAP and SAML.

You might ask your CSM whether any part of the UPenn project might be repurposed to help with an LDAP-to-Shibboleth transition -- or whether doing that is necessary if you already have those two KSFs.  If the IDs are different, a potential new project might start with extending the UPenn work to consult a database which maps LDAP users to SAML users.

[Robbie_Grant]

 @bradhollenbeck ,

We are giving the Canvas Admins area a little bit of love (especially questions that are really, really old) and just want to check in with you.  This will also bring this question new attention. 

Were you able to find an answer to your question? I am going to go ahead and mark this question as answered because there hasn't been any more activity in a while so I assume that you have the information that you need. If you still have a question about this or if you have information that you would like to share with the community, by all means, please do come back and leave a comment.  Also, if this question has been answered by one of the previous replies, please feel free to mark that answer as correct.

Robbie

[bradhollenbeck · Accepted solution]

Robbie,

Thanks for reaching out. We got the question answered and eventually moved

to an ADFS authentication method

Brad

On Wed, Nov 15, 2017 at 8:43 AM, Robbie Grant Admin <instructure@jiveon.com>