Configuring SAML SSO for Canvas LMS by Instructure

These steps will guide you through setting up the single sign-on functionality between ADSelfService Plus and Instructure.

Prerequisites

1. Log in to ADSelfService Plus as an administrator.
2. Navigate to  Configuration > Self-Service > Password Sync/Single Sign On > Add Application, and select Canvas LMS by Instructure from the applications displayed.
   Note: You can also find the application that you need from the search bar located in the left pane or the alphabet-wise navigation option in the right pane.
3. Click IdP details at the top-right corner of the screen.
4. In the pop-up that appears, copy the Login URL, Logout URL, and SHA1 FingerPrint.

Instructure (Service Provider) configuration steps

1. Log in to your Canvas LMS domain as an Account Administrator.
2. Click Admin > Authentication.
3. From the Add an identity provider to this account drop-down, select SAML.
4. In the SAML configuration screen that opens:
   1. Enter the Login URL copied in step 4 of the prerequisites in the Log On URL field.
   2. Enter the Entity ID copied in step 4 of the prerequisites in the IdP Entity ID field.
   3. Enter the Logout URL copied in step 4 of the prerequisites in the Log out URL field.
   4. Paste the SHA1 FingerPrint copied in step 4 of the prerequisites in the Certificate Fingerprint field.

   

   5. Under Login Attribute, choose Email address.
   6. Click the Canvas SAML Entity ID URL at the top of the SAML section to view the Canvas metadata.
   7. Locate and copy the entityID and AssertionConsumerService parameter values. We will be using them in the upcoming steps.

   

5. In the Identifier Format field, select 1 from the drop-down box.
6. Click Save to complete the configuration.

ADSelfService Plus (Identity Provider) configuration steps

1. Now, switch to ADSelfService Plus’ Canvas LMS by Instructure configuration page.



2. Enter the Application Name and Description.
3. In the Assign Policies field, select the policies for which SSO need to be enabled.
   Note:ADSelfService Plus allows you to create OU and group-based policies for your AD domains. To create a policy, go to Configuration > Self-Service > Policy Configuration > Add New Policy.
4. Select Enable Single Sign-On.
5. Enter the Domain Name of your Canvas account. For example, if you use johndoe@thinktodaytech.com to log in to Canvas, then thinktodaytech.com is the domain name.
6. In the Subdomain field, enter the SP Identifier of your Canvas LMS Instructure account.
   Example: If your Instructure domain URL is https://test.instructure.com, your SP Identifier is test.
7. Enter the Assertion Consumer Service URL copied in step 4e of the SP configuration in the Assertion Consumer Service URL field. If your Canvas metadata contains multiple Assertion Consumer URLs, click the + button next to the text field to add each of them.
8. In the Name ID Format field, choose the format for the user login attribute value specific to the application.

Note: Use Unspecified as the default option if you are unsure about the format of the login attribute value used by the application

9. In the Name ID Format field, choose the format for the user login attribute value specific to the application.

Note: Use Unspecified as the default option if you are unsure about the format of the login attribute value used by the application

10. Click Add Application.

    Your users should now be able to sign in to Canvas through ADSelfService Plus.

Note: For Canvas LMS by Instructure, only IDP initiated flow is supported.