SAML Authentication Issue

[nicko...@gmail.com]

I am trying to roll out a single sign on service for a customer that uses canvas and have been using simplesamlphp to do this. I think I have everything working correctly but when I try to login through my service canvas gives me this error Canvas doesn't have an account for user: RANDOM ALPHANUMERIC SEQUENCE 

I know that the user is in Canvas and my authentication is working correctly through simplesaml what I'm most confused about though is what I actually need to be sending back to canvas for the authentication.

What my auth source is returning

return array('name' => array($user->user_name));

What my metadata looks like 

$metadata['https://mytestsite.com/saml/saml2/idp/metadata.php'] = array(

'AssertionConsumerService' => 'https://client.test.instructure.com/saml_consume',

'ForceAuthn' => TRUE,

'SingleLogoutService' => 'https://client.test.instructure.com/saml_logout',

'NameIDFormat' => 'urn:oasis:names:tc:SAML2.0:nameid-format:email',

'simplesaml.nameidattribute' => 'Username',

'simplesaml.attributes' => false

);

My Canvas Authentication Settings

Login Attribute	NameID
Identifier Format	urn:oasis:names:tc:SAML:2.0:nameid-format:entity
Login Label	Username

Can anyone help me make sense of what I'm doing wrong, I would really appreciate it.

[da...@zerbash.com]

Did you ever find the solution to this?

[Nick Snyder]

Yes, I got it working but I don’t remember exactly what I did to fix the issue. It was probably something to do with the certificate

[Paul Hinze]

> Canvas doesn't have an account for user: RANDOM ALPHANUMERIC SEQUENCE 

This usually means that the Identity Provider sent along the "transient" login attribute rather than the actual user name or email. It usually points to some sort of configuration mismatch, but it can be a bunch of different things, so normally it's best to review the specific configs in question.

David, let me know if you're still having trouble with this and I'm happy to try and help.

Paul Hinze

Instructure Engineer 

--
 
---
You received this message because you are subscribed to the Google Groups "Canvas LMS Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to canvas-lms-use...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Sujit Sagar]

Hi, did you find solution to this?

[jason davis]

We ended up having luck with setting Login Attribute in canvas to eduPersonPrincipalName and on the simplesaml side remapping our username field to eduPersonPrincipalName

[Babu NV]

When I use SAML, the destination url is giving 'Page not found error'. Please help.
URL giving the error:
http://mysite.acme.instructure.com/saml_consume

Thanks

[Cody Cutrer]

Make sure you're using the URL in the SAML metadata (at /saml2). It should be pointing you at /login/saml, not /saml_consume

Cody Cutrer

Software Engineer

Instructure

--

---
You received this message because you are subscribed to the Google Groups "Canvas LMS Users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to canvas-lms-users+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.