Configuring OIDC-Based SSO with Canvas

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

To enable OpenID Connect (OIDC) single sign-on (SSO) for Canvas, configure a federation partner for Canvas in your RapidIdentity portal. After you save the federation partner, RapidIdentity issues a Client ID and Client Secret that you enter in Canvas to complete the integration.

Requirements
  • Access to your RapidIdentity administrator portal
  • A tenant administrator account in RapidIdentity
  1. Navigate to your RapidIdentity administrator portal.
  2. From the module selector, choose Configuration.
  3. Select Security > Identity Providers > Federation Partners.
  4. Click Add Federation Partner > OpenID Connect.
  5. In the General tab, set the following:
    1. Name: Canvas
    2. (Optional) Description: OIDC SSO Configuration for Canvas
    3. Callback URLs: https://sso.canvaslms.com/login/oauth2/callback
    4. (Optional) Update the default token expiration and refresh token settings.
  6. (Optional) In the Attributes tab, add custom claim attributes:
    1. Click Add Attribute.
    2. Enter a value in the Name field and the LDAP Attribute field.
    3. Click Add.
    Note:

    Add standard claim attributes in the Claim Attributes tab instead. Use the Attributes tab only for custom claims.

  7. (Optional) In the OpenID Connect Configuration tab, update the default encryption settings or add an RSA public key.
  8. In the Claim Attributes tab, add the following claims. For each claim, click Add Attribute, set the values from the table below, then click Add.
    NameClaimClaim TypeAttribute Value TypeLDAP AttributeRegex FilterSingle ValuedBinary
    ProfileprofilestringldapemployeeTypeLeave blankDeselectedDeselected
    SNsnstringldapsnLeave blankSelectedDeselected
    EmailemailstringldapmailLeave blankSelectedDeselected
    First Namefirst_namestringldapgivenNameLeave blankSelectedDeselected
    IDidstringldapidautoIDLeave blankSelectedDeselected
  9. Click Save.
  10. Record the Client ID and Client Secret values that appear in the General tab.
    Note:

    You must enter these values in Canvas LMS to complete the integration.

  11. Select Security > Identity Providers > IDP Configuration.
  12. Click Trigger Service Reload.
  13. Click Trigger Web Reload.

RapidIdentity is now configured as an OIDC identity provider for Canvas.