Assistance Required with SAML Authentication Issue

[StefanNorinder]

This is the fourth time trying to post this question. It gets marked as spam. This time I will just add the question inside a attached file. 

We are encountering an issue configuring Canvas as a service provider for an IdP. Despite successful authentication from the IdP, Canvas is not processing the SAML response correctly, leading to authentication failures. 

Issue Description:

- Successful authentication response from the IdP, as indicated in the attached SAML trace logs.

- Canvas fails to process this response, resulting in authentication failure.

Please review attached file for full question. 

Could you please assist us in understanding why Canvas is failing to process a successful SAML response? 

• Is there a specific attribute or configuration setting in Canvas that might be causing this issue?
• Can you help identify why Canvas is unable to successfully process the successful SAML response from the IdP? 
• Are there known issues or additional settings in Canvas that we should check when integrating with an IdP? Maybe there's a general setting "approve external IdP:s" or something?

 Your insights on this matter would be greatly appreciated. Thank you for your assistance.

[nbpenn]

I'm still only starting to work with Canvas, but I have worked with SAML a bit - I've found that usually the authentication issues are due to mismatched Attribute name pairs - like the field with the email address in your doc looks like it's named 'eduPersonPrincipalName' which doesn't seem intuitive - I'd double check the IdP is responding with the right Attribute names as a first step.

Additionally, there are several Attribute 'NameFormat' values - including the 'eduPersonPrincipalName' attribute - that are declared as 'uri' - not sure that's correct.

There's also a GoogleChrome plugin in for tracing SAML requests & responses that I've found very helpful - good luck!