AADSTS650056: Misconfigured application

[zukkaus]

Good morning,

I am trying to setup SSO with Azure AD. I followed the instructions step by step. However, I receive the error "AADSTS650056: Misconfigured application". I checked:

- "Identifier (Entity ID" is HTTP and NOT HTTPS

- I read from a couple of posts that entering the wildcard (*) solved some problems, but azure doesn't allow wildcards saying "Wild Cards * are not supported"

- Thumbprint, App Federation Metadata Url, Login URL, Azure AD Identifier and Logout URL match the Canvas auto-population.

Now, I am only using the "test" URL, and not the production one. The Production URL has not been entered since we don't want to lockout students. 

Also, how do observers access the Canvas site if they don't have an Office 365 account? Should I just leave the option 2 enabled?

I would really appreciate some guidance. I don't know where else to look to have the right answer and have this working properly.

Regards, 

Miguel 

[zukkaus]

I see that this guide from Instructure is from 2015:

https://community.canvaslms.com/docs/DOC-1402-configuring-azure-saml-and-canvas-authentication 

Is there a newer or updated guide?

Thank you

M--

[ciu_webservices]

I am having the exact same issue. I had an Azure App built long ago that had the wildcards in it, but ran into issues so I blew it away and recreated - but then couldn't put in Wildcards so that's probably an Azure change. The other option Azure lists as a solution is to give permissions to the app - but then the Permissions tab to grant consent or add permissions is grayed out because 'the app does not require consent or the app developer hasn't configured permissions in the App registration'. 

[zukkaus · Accepted solution]

I got my issue figured out. It seems that just trying the "test" environment as the reply URL does not work (or it is intended that way). Reading more in depth, Instructure provides a way to not get yourself locked out so I used the production environment URL and everything started working. The instructions seem to be accurate. 

[ciu_webservices]

I think I figured out my issue also, but will require a trouble ticket to fix. We updated our institution prefix (i.e old.instructure.com to new.instructure.com ) and that change has not been done on the saml2 identity page. Glad we got em figured out